Skip to content

Commit 83f5d27

Browse files
gHashTaggHashTag
gHashTag
and
gHashTag
authored
verify.sh: add [5/5] reseal-prev advisory sub-check (seal-state vs PR diff). Closes #1136 (#1139)
Co-authored-by: gHashTag <admin@t27.ai>
1 parent 3763fa5 commit 83f5d27

3 files changed

Lines changed: 101 additions & 20 deletions

File tree

‎Makefile‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,10 @@ help:
2121
@echo " make warnings-baseline Count non-test build warnings vs the recorded"
2222
@echo " baseline and list the top files (advisory; #969)."
2323
@echo " make verify Run all advisory pre-PR checks at once (seal-check"
24-
@echo " + warnings-baseline + quick test + gate-preview);"
25-
@echo " never blocks. VERIFY_SKIP_GATES=1 skips the"
26-
@echo " gate-preview; VERIFY_SKIP_TEST=1 skips the test."
24+
@echo " + warnings-baseline + quick test + gate-preview"
25+
@echo " + reseal-preview); never blocks. Skip flags:"
26+
@echo " VERIFY_SKIP_TEST / VERIFY_SKIP_GATES /"
27+
@echo " VERIFY_SKIP_RESEAL =1."
2728

2829
# Advisory umbrella: run the seal-freshness, warnings-baseline, and a quick test
2930
# back-to-back and print one compact summary. Never edits code, never reseals,

‎docs/NOW.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22

33
Last updated: 2026-06-14
44

5+
## verify-reseal-prev -- add [5/5] reseal-prev advisory sub-check to verify.sh (Closes #1136)
6+
7+
- **WHERE**: scripts/verify.sh, Makefile
8+
- **WHAT**: Extended `make verify` from 4 to 5 advisory sub-checks; renumbered [1/4..4/4] -> [1/5..4/5] and added [5/5] reseal-prev, which reuses the [1/5] seal verdict and diffs the base ref for bootstrap/src/compiler.rs: OK if compiler.rs not in diff or seal fresh, REMINDER (exit 0) if compiler.rs changed while seal stale/unsealed. VERIFY_SKIP_RESEAL=1 disables it.
9+
- **Why**: gives a local heads-up to re-seal IF a compiler.rs edit was numeric, without judging whether the edit is numeric and without ever resealing or gating CI; advisory only, exit 0. L6 gf16 SSOT untouched; catalog stays 83; no gen/ edits; ASCII-only added lines; no quality claim added. Closes #1136.
10+
- **Anchor**: phi^2 + phi^-2 = 3
11+
512
## host-dma-protocol-deadcode -- module-scoped allow(dead_code) on host/dma.rs + host/protocol.rs (Closes #1135)
613

714
- **WHERE**: bootstrap/src/host/dma.rs, bootstrap/src/host/protocol.rs, scripts/warnings-baseline.sh

‎scripts/verify.sh‎

Lines changed: 90 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,23 @@
1616
# check-linked-issue); this is a local convenience, not a substitute.
1717
#
1818
# Sub-checks (each best-effort; a missing script is reported as SKIP):
19-
# 1. seal -- scripts/reseal-check.sh --quiet (NMSE seal freshness)
20-
# 2. warnings -- scripts/warnings-baseline.sh --quiet (#969 meter)
21-
# 3. test -- a quick cargo test of the compiler reject/accept suite
22-
# (the negative-test gate from variants K/M/Q), unless
23-
# VERIFY_FULL_TEST=1 asks for the whole binary test run.
19+
# 1. seal -- scripts/reseal-check.sh --quiet (NMSE seal freshness)
20+
# 2. warnings -- scripts/warnings-baseline.sh --quiet (#969 meter)
21+
# 3. test -- a quick cargo test of the compiler reject/accept suite
22+
# (the negative-test gate from variants K/M/Q), unless
23+
# VERIFY_FULL_TEST=1 asks for the whole binary test run.
24+
# 4. gate-preview -- local preview of the NOW-sync + L3 PURITY CI gates
25+
# against the base ref (variant U).
26+
# 5. reseal-prev -- ties the seal state to the current PR diff: warns only if
27+
# this PR edits the sealed compiler.rs (variant W).
2428
#
2529
# Usage:
2630
# scripts/verify.sh # run all sub-checks, print summary, exit 0
2731
# scripts/verify.sh --quiet # print only the final one-line summary
2832
# VERIFY_SKIP_TEST=1 scripts/verify.sh # skip the (slow) test sub-check
2933
# VERIFY_FULL_TEST=1 scripts/verify.sh # run the full binary test suite
34+
# VERIFY_SKIP_GATES=1 scripts/verify.sh # skip the gate-preview sub-check
35+
# VERIFY_SKIP_RESEAL=1 scripts/verify.sh # skip the reseal-preview sub-check
3036
#
3137
# Anchor: phi^2 + phi^-2 = 3
3238

@@ -64,10 +70,10 @@ if [ -x scripts/reseal-check.sh ]; then
6470
3) SEAL_VERDICT="seal:UNSEALED (advisory)" ;;
6571
*) SEAL_VERDICT="seal:UNKNOWN (exit $SEAL_CODE)" ;;
6672
esac
67-
log " [1/4] seal-check -> ${SEAL_OUT:-$SEAL_VERDICT}"
73+
log " [1/5] seal-check -> ${SEAL_OUT:-$SEAL_VERDICT}"
6874
else
6975
SEAL_VERDICT="seal:SKIP (script missing)"
70-
log " [1/4] seal-check -> SKIP (scripts/reseal-check.sh not found)"
76+
log " [1/5] seal-check -> SKIP (scripts/reseal-check.sh not found)"
7177
fi
7278
add_summary "$SEAL_VERDICT"
7379

@@ -83,10 +89,10 @@ if [ -x scripts/warnings-baseline.sh ]; then
8389
2) WARN_VERDICT="warnings:BUILD-FAILED" ;;
8490
*) WARN_VERDICT="warnings:UNKNOWN (exit $WARN_CODE)" ;;
8591
esac
86-
log " [2/4] warnings -> ${WARN_OUT:-$WARN_VERDICT}"
92+
log " [2/5] warnings -> ${WARN_OUT:-$WARN_VERDICT}"
8793
else
8894
WARN_VERDICT="warnings:SKIP (script missing)"
89-
log " [2/4] warnings -> SKIP (scripts/warnings-baseline.sh not found)"
95+
log " [2/5] warnings -> SKIP (scripts/warnings-baseline.sh not found)"
9096
fi
9197
add_summary "$WARN_VERDICT"
9298

@@ -97,7 +103,7 @@ add_summary "$WARN_VERDICT"
97103
# ----------------------------------------------------------------------------
98104
if [ "${VERIFY_SKIP_TEST:-0}" = "1" ]; then
99105
TEST_VERDICT="test:SKIP (VERIFY_SKIP_TEST=1)"
100-
log " [3/4] test -> SKIP (VERIFY_SKIP_TEST=1)"
106+
log " [3/5] test -> SKIP (VERIFY_SKIP_TEST=1)"
101107
else
102108
if [ "${VERIFY_FULL_TEST:-0}" = "1" ]; then
103109
TEST_DESC="full binary test suite"
@@ -108,10 +114,10 @@ else
108114
fi
109115
if "$CARGO_BIN" test --bin t27c $TEST_FILTER >/dev/null 2>&1; then
110116
TEST_VERDICT="test:PASS ($TEST_DESC)"
111-
log " [3/4] test -> PASS ($TEST_DESC)"
117+
log " [3/5] test -> PASS ($TEST_DESC)"
112118
else
113119
TEST_VERDICT="test:FAIL ($TEST_DESC) -- advisory, inspect with 'cargo test'"
114-
log " [3/4] test -> FAIL ($TEST_DESC) (advisory; re-run 'cargo test --bin t27c' for detail)"
120+
log " [3/5] test -> FAIL ($TEST_DESC) (advisory; re-run 'cargo test --bin t27c' for detail)"
115121
fi
116122
fi
117123
add_summary "$TEST_VERDICT"
@@ -129,10 +135,10 @@ add_summary "$TEST_VERDICT"
129135
# ----------------------------------------------------------------------------
130136
if [ "${VERIFY_SKIP_GATES:-0}" = "1" ]; then
131137
GATES_VERDICT="gates:SKIP (VERIFY_SKIP_GATES=1)"
132-
log " [4/4] gate-preview-> SKIP (VERIFY_SKIP_GATES=1)"
138+
log " [4/5] gate-preview-> SKIP (VERIFY_SKIP_GATES=1)"
133139
elif ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
134140
GATES_VERDICT="gates:SKIP (not a git work tree)"
135-
log " [4/4] gate-preview-> SKIP (not a git work tree)"
141+
log " [4/5] gate-preview-> SKIP (not a git work tree)"
136142
else
137143
# Pick a base ref to diff against: prefer origin/master, fall back to master.
138144
BASE_REF=""
@@ -143,7 +149,7 @@ else
143149
fi
144150
if [ -z "$BASE_REF" ]; then
145151
GATES_VERDICT="gates:SKIP (no master base ref; fetch first)"
146-
log " [4/4] gate-preview-> SKIP (no origin/master or master ref found)"
152+
log " [4/5] gate-preview-> SKIP (no origin/master or master ref found)"
147153
else
148154
GATE_ISSUES=""
149155
# (a) NOW.md present in the diff vs base.
@@ -173,10 +179,10 @@ else
173179
fi
174180
if [ -z "$GATE_ISSUES" ]; then
175181
GATES_VERDICT="gates:OK ($NOW_IN_DIFF, $NOW_DATE, $ASCII)"
176-
log " [4/4] gate-preview-> OK ($NOW_IN_DIFF | $NOW_DATE | $ASCII) [base $BASE_REF]"
182+
log " [4/5] gate-preview-> OK ($NOW_IN_DIFF | $NOW_DATE | $ASCII) [base $BASE_REF]"
177183
else
178184
GATES_VERDICT="gates:WARN ($NOW_IN_DIFF, $NOW_DATE, $ASCII) -- advisory"
179-
log " [4/4] gate-preview-> WARN [base $BASE_REF]:"
185+
log " [4/5] gate-preview-> WARN [base $BASE_REF]:"
180186
log " $NOW_IN_DIFF | $NOW_DATE | $ASCII"
181187
log " likely CI-gate issue(s):$GATE_ISSUES (advisory; fix before push)"
182188
if [ -n "$NONASCII" ]; then
@@ -188,6 +194,73 @@ else
188194
fi
189195
add_summary "$GATES_VERDICT"
190196

197+
# ----------------------------------------------------------------------------
198+
# 5. Reseal preview (variant W). The NMSE certification is sealed against
199+
# sha256(bootstrap/src/compiler.rs) (see scripts/reseal-check.sh). Sub-check
200+
# [1/5] reports the ABSOLUTE seal state; this one ties that state to the
201+
# CURRENT PR DIFF and answers the only question a contributor actually has:
202+
# "does THIS change need a reseal?"
203+
# - diff does NOT touch compiler.rs -> seal state is irrelevant to this PR
204+
# (any pre-existing staleness is unrelated); report OK.
205+
# - diff DOES touch compiler.rs AND seal is stale/unsealed -> remind that a
206+
# reseal MAY be needed IF the edit changed numerics; a non-numeric edit
207+
# (an allow(), a comment, a test) legitimately leaves the seal as-is.
208+
# This is a REMINDER, never a verdict on whether the edit is numeric.
209+
# Best-effort and advisory: reuses [1/5]'s seal exit code, diffs the local
210+
# base ref, never reseals, never blocks. Skipped outside a git work tree, with
211+
# no base ref, or with VERIFY_SKIP_RESEAL=1.
212+
# ----------------------------------------------------------------------------
213+
SEALED_SRC="bootstrap/src/compiler.rs"
214+
if [ "${VERIFY_SKIP_RESEAL:-0}" = "1" ]; then
215+
RESEAL_VERDICT="reseal:SKIP (VERIFY_SKIP_RESEAL=1)"
216+
log " [5/5] reseal-prev -> SKIP (VERIFY_SKIP_RESEAL=1)"
217+
elif ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
218+
RESEAL_VERDICT="reseal:SKIP (not a git work tree)"
219+
log " [5/5] reseal-prev -> SKIP (not a git work tree)"
220+
else
221+
# Reuse the same base ref discovery as [4/5].
222+
RBASE=""
223+
if git rev-parse --verify -q origin/master >/dev/null 2>&1; then
224+
RBASE="origin/master"
225+
elif git rev-parse --verify -q master >/dev/null 2>&1; then
226+
RBASE="master"
227+
fi
228+
if [ -z "$RBASE" ]; then
229+
RESEAL_VERDICT="reseal:SKIP (no master base ref; fetch first)"
230+
log " [5/5] reseal-prev -> SKIP (no origin/master or master ref found)"
231+
else
232+
if git diff --name-only "$RBASE"...HEAD 2>/dev/null | grep -qx "$SEALED_SRC"; then
233+
SRC_TOUCHED=1
234+
else
235+
SRC_TOUCHED=0
236+
fi
237+
# Map [1/5]'s verdict into a coarse seal state without re-running it.
238+
case "$SEAL_VERDICT" in
239+
seal:FRESH*) SEAL_STATE="fresh" ;;
240+
seal:STALE*) SEAL_STATE="stale" ;;
241+
seal:UNSEALED*) SEAL_STATE="unsealed" ;;
242+
*) SEAL_STATE="unknown" ;;
243+
esac
244+
if [ "$SRC_TOUCHED" -eq 0 ]; then
245+
RESEAL_VERDICT="reseal:OK (compiler.rs not in diff; seal state irrelevant to this PR)"
246+
log " [5/5] reseal-prev -> OK (compiler.rs not in diff; seal state irrelevant) [base $RBASE]"
247+
elif [ "$SEAL_STATE" = "fresh" ]; then
248+
RESEAL_VERDICT="reseal:OK (compiler.rs in diff; seal fresh)"
249+
log " [5/5] reseal-prev -> OK (compiler.rs in diff; seal fresh) [base $RBASE]"
250+
else
251+
RESEAL_VERDICT="reseal:REMINDER (compiler.rs in diff; seal $SEAL_STATE) -- advisory"
252+
log " [5/5] reseal-prev -> REMINDER [base $RBASE]:"
253+
log " this PR edits $SEALED_SRC and the seal is $SEAL_STATE."
254+
log " IF your edit changed numerics, reseal explicitly:"
255+
log " make seal (or: python repro/numerics/nmse_gf16.py --seal)"
256+
log " IF it did NOT (an allow(), a comment, a test), the existing"
257+
log " seal state is fine and no reseal is needed. This is a"
258+
log " reminder only -- it does NOT judge whether your edit is numeric."
259+
fi
260+
fi
261+
fi
262+
add_summary "$RESEAL_VERDICT"
263+
191264
log "----------------------------------------------------------------"
192265
log " advisory only: never edits code, never reseals, never gates CI."
193266
log " required CI checks remain: check-now-freshness / validate /"

0 commit comments

Comments
 (0)