Spaces:
Running
Running
| #!/usr/bin/env python3 | |
| """Validate the original A11oy controls evidence map.""" | |
| from __future__ import annotations | |
| import json | |
| import re | |
| import sys | |
| from pathlib import Path | |
| REPO_ROOT = Path(__file__).resolve().parents[1] | |
| MAP_PATH = REPO_ROOT / "docs" / "controls-evidence-map.json" | |
| ALLOWED_STATUSES = { | |
| "verified-runtime", | |
| "release-payload", | |
| "lean-backed-current-green", | |
| "lean-backed-needs-upstream-ci", | |
| "thesis-anchor", | |
| "historical", | |
| "roadmap", | |
| } | |
| CONTROL_ID = re.compile(r"^A11OY-CE-\d{3}$") | |
| FORBIDDEN_HF = {"canonical", "source-of-truth"} | |
| FORBIDDEN_UDS = {"catalog-grade", "catalog-accepted", "endorsed"} | |
| def load_json(path: Path) -> dict: | |
| return json.loads(path.read_text(encoding="utf-8")) | |
| def main() -> int: | |
| errors: list[str] = [] | |
| data = load_json(MAP_PATH) | |
| if "no external control catalog" not in data.get("cleanRoomRule", "").lower(): | |
| errors.append("cleanRoomRule must reject copied external control catalogs") | |
| controls = data.get("controls", []) | |
| if not isinstance(controls, list) or len(controls) < 5: | |
| errors.append("controls must contain at least five controls") | |
| controls = [] | |
| seen: set[str] = set() | |
| required_fields = { | |
| "controlId", | |
| "title", | |
| "description", | |
| "claimStatus", | |
| "evidencePaths", | |
| "validationCommands", | |
| "receiptHook", | |
| "hfExposure", | |
| "udsExposure", | |
| "invariants", | |
| } | |
| for control in controls: | |
| control_id = control.get("controlId", "<missing>") | |
| if control_id in seen: | |
| errors.append(f"duplicate controlId: {control_id}") | |
| seen.add(control_id) | |
| if not CONTROL_ID.match(control_id): | |
| errors.append(f"{control_id}: controlId must match A11OY-CE-###") | |
| missing = sorted(required_fields - control.keys()) | |
| if missing: | |
| errors.append(f"{control_id}: missing fields: {', '.join(missing)}") | |
| status = control.get("claimStatus") | |
| if status not in ALLOWED_STATUSES: | |
| errors.append(f"{control_id}: unsupported claimStatus {status!r}") | |
| evidence_paths = control.get("evidencePaths", []) | |
| if not isinstance(evidence_paths, list) or not evidence_paths: | |
| errors.append(f"{control_id}: evidencePaths must be a non-empty list") | |
| for evidence in evidence_paths: | |
| if not (REPO_ROOT / evidence).exists(): | |
| errors.append(f"{control_id}: evidence path does not exist: {evidence}") | |
| commands = control.get("validationCommands", []) | |
| if not isinstance(commands, list) or not commands: | |
| errors.append(f"{control_id}: validationCommands must be a non-empty list") | |
| receipt_hook = control.get("receiptHook", {}) | |
| if not receipt_hook.get("eventType") or not receipt_hook.get("status"): | |
| errors.append(f"{control_id}: receiptHook requires eventType and status") | |
| if receipt_hook.get("status") not in {"runtime-available", "roadmap", "staged"}: | |
| errors.append(f"{control_id}: unsupported receiptHook.status {receipt_hook.get('status')!r}") | |
| if status == "verified-runtime" and receipt_hook.get("status") != "runtime-available": | |
| errors.append(f"{control_id}: verified-runtime controls need runtime-available receipt hook") | |
| hf_exposure = control.get("hfExposure", "").lower() | |
| if hf_exposure in FORBIDDEN_HF: | |
| errors.append(f"{control_id}: hfExposure cannot be canonical/source-of-truth") | |
| uds_exposure = control.get("udsExposure", "").lower() | |
| if uds_exposure in FORBIDDEN_UDS: | |
| errors.append(f"{control_id}: udsExposure cannot imply catalog/endorsement") | |
| invariants = control.get("invariants", []) | |
| if not isinstance(invariants, list) or not invariants: | |
| errors.append(f"{control_id}: invariants must be a non-empty list") | |
| required = {"A11OY-CE-001", "A11OY-CE-002", "A11OY-CE-005", "A11OY-CE-008"} | |
| missing_required = sorted(required - seen) | |
| if missing_required: | |
| errors.append(f"missing required controls: {', '.join(missing_required)}") | |
| if errors: | |
| print("Controls evidence map validation failed:") | |
| for error in errors: | |
| print(f" - {error}") | |
| return 1 | |
| print(f"Validated {MAP_PATH.relative_to(REPO_ROOT)} ({len(controls)} controls)") | |
| return 0 | |
| if __name__ == "__main__": | |
| sys.exit(main()) | |