T1.28w: the L0 guards read the parser crate's name from the checked tree

The gate runs its checkpoint's copies of l0_deps.py and l0_scan.py over
a candidate's tree, and their data named the parser crate as it stood
(PARSER, CLASSES and ALLOWED; PARSER_CRATE and CORE_CRATES). A package
that renames the crate therefore could not pass its own gate: the
checkpoint's l0_deps.py refused sdm-pql as a crate with no class and an
edge outside the graph, its l0_scan.py the allowlist's paths outside the
old crate (T1.6b, E69(e), found by the gate at 51c387b and fed8174).

Each guard now reads the parser crate's name from the checked tree's own
copy of itself (l0_scan.tree_name: the last top-level assignment of
PARSER, or PARSER_CRATE, as a string literal, never run), and takes its
own classes, edges and core crates with the parser's entries under that
name (l0_deps.tree_crates, l0_scan.parser_crates). A copy missing,
unparsed, not a literal, or naming another crate the data hold is
refused. Only the parser's name moves: the classes, the edges and every
other list stay the running copy's, so a candidate's own copy cannot
re-class a crate or grant an edge. l0_deps.py is a protected path a
landing must name, and reviewers check it.

selftest.py seeds it on a fixture of the crates, the bridge files and
both guards' copies: the fixture as it is and the parser renamed in its
crates and the guard data pass; renamed in its crates only, in the data
only, the copies missing, the name not a literal and the name of another
crate fail, each in both guards. With the fix undone (each guard reading
its own name) the rename seed and the five refusals fail. The vocabulary
fixtures now carry l0_scan.py's copy.

A bug fix to a frozen guard shown by an integration failure (E56(a));
it adds no check.

Refs: T1.6b, T1.24b
Signed-off-by: Adi Wadaskar <awadaskar@nvidia.com>

Author: adi-kumo

scripts/rust_core/l0_deps.py

@@ -20,7 +20,13 @@
 - the parser rule: only ``sdm-core`` depends on the parser crate, and only
   its adapter (``src/pql.rs``, and ``src/test_ops.rs``, compiled only with
   the ``test-ops`` feature) names it, by its own name or any name a
-  ``package =`` rename gives it, read from ``cargo metadata``;
+  ``package =`` rename gives it, read from ``cargo metadata``; the parser
+  crate's name is the checked tree's: its own copy of this file's
+  ``PARSER``, read as a string literal, never run, the classes and edges
+  this copy's with the parser's under that name (``tree_crates``), so a gate
+  running its checkpoint's copy over a candidate that renames the crate
+  judges the candidate's name (a bug fix at T1.28w, E56(a)); a copy
+  missing, unparsed, not a literal, or naming another crate is refused;
 - nothing shipped (domain, host or binding) reaches ``sdm-testkit`` over
   normal or build edges;
 - no domain crate, and not ``sdm-host``, reaches ``pyo3``, ``jni``,
@@ -65,16 +71,18 @@
 import subprocess
 import sys
 from collections.abc import Iterable
+from dataclasses import dataclass
 from pathlib import Path
 from typing import Any
 
 import tomllib
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import bridge_freeze  # noqa: E402
-from l0_scan import read_rust  # noqa: E402
+from l0_scan import read_rust, tree_name  # noqa: E402
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = Path('scripts/rust_core/l0_deps.py')
 
 DOMAIN = 'domain'
 HOST = 'host'
@@ -280,25 +288,64 @@ def reach(self, crate: str) -> dict[str, list[str]]:
         return paths
 
 
-def check_classes(graph: Graph) -> list[str]:
+@dataclass(frozen=True)
+class Crates:
+    """The crates' data a check reads: the parser's name and the classes
+    and edges, the parser's under that name."""
+
+    parser: str
+    classes: dict[str, str]
+    allowed: dict[str, frozenset[str]]
+
+
+def tree_crates(root: Path) -> tuple[Crates, list[str]]:
+    """The crates' data for the tree at ``root``: the parser's name its own
+    copy of this file gives (``PARSER``), with this copy's ``CLASSES`` and
+    ``ALLOWED`` under it; a name this copy gives another crate is
+    refused."""
+    ours = Crates(PARSER, CLASSES, ALLOWED)
+    name, problems = tree_name(root, SCRIPT, 'PARSER')
+    others = {*CLASSES, *ALLOWED, *REQUIRED, *BINDING_FORBIDDEN} - {PARSER}
+    if name in others:
+        problems = [f"the tree's {SCRIPT}: PARSER names {name}, another crate"]
+    if name is None or problems:
+        return ours, problems
+
+    def renamed(crate: str) -> str:
+        return name if crate == PARSER else crate
+
+    return (
+        Crates(
+            name,
+            {renamed(c): kind for c, kind in CLASSES.items()},
+            {
+                renamed(c): frozenset(renamed(d) for d in deps)
+                for c, deps in ALLOWED.items()
+            },
+        ),
+        [],
+    )
+
+
+def check_classes(graph: Graph, crates: Crates) -> list[str]:
     problems = [
         f'{crate}: a workspace crate with no class; add it to CLASSES and ALLOWED'
         for crate in graph.members
-        if crate not in CLASSES
+        if crate not in crates.classes
     ]
     problems += [
         f'{crate}: classified, but not a workspace crate'
-        for crate in CLASSES
+        for crate in crates.classes
         if crate not in graph.members
     ]
     return problems
 
 
-def check_edges(graph: Graph) -> list[str]:
+def check_edges(graph: Graph, crates: Crates) -> list[str]:
     problems = []
     members = set(graph.members)
     for crate in graph.members:
-        allowed = ALLOWED.get(crate, frozenset())
+        allowed = crates.allowed.get(crate, frozenset())
         first_party = {dep for dep, _ in graph.direct(crate) if dep in members}
         for dep, kinds in graph.direct(crate):
             if dep in members and dep not in allowed:
@@ -312,21 +359,22 @@ def check_edges(graph: Graph) -> list[str]:
     for crate in graph.members:
         if crate == 'sdm-core':
             continue
-        if any(dep == PARSER for dep, _ in graph.direct(crate)):
+        if any(dep == crates.parser for dep, _ in graph.direct(crate)):
             problems.append(
-                f"{crate} -> {PARSER}: only sdm-core's adapter reaches the parser"
+                f"{crate} -> {crates.parser}: only sdm-core's adapter reaches "
+                'the parser'
             )
     return problems
 
 
-def check_reach(graph: Graph) -> list[str]:
+def check_reach(graph: Graph, crates: Crates) -> list[str]:
     problems = []
     for crate in graph.members:
-        kind = CLASSES.get(crate)
+        kind = crates.classes.get(crate)
         if kind not in SHIPPED:
             continue
         reached = graph.reach(crate)
-        dev = [c for c in reached if CLASSES.get(c) == DEV]
+        dev = [c for c in reached if crates.classes.get(c) == DEV]
         for target in dev:
             problems.append(
                 f'{crate} reaches {target} ({" -> ".join(reached[target])}); '
@@ -349,13 +397,13 @@ def crate_root(graph: Graph, crate: str) -> Path:
     return graph.manifests[crate].parent
 
 
-def check_parser_users(graph: Graph) -> list[str]:
+def check_parser_users(graph: Graph, parser: str) -> list[str]:
     if 'sdm-core' not in graph.manifests:
         return ['sdm-core: missing']
     root = crate_root(graph, 'sdm-core')
     problems = []
-    names = {PARSER.replace('-', '_')} | graph.externs.get(
-        ('sdm-core', PARSER), set()
+    names = {parser.replace('-', '_')} | graph.externs.get(
+        ('sdm-core', parser), set()
     )
     pattern = re.compile(
         r'\b(' + '|'.join(re.escape(n) for n in sorted(names)) + r')\b'
@@ -380,7 +428,7 @@ def check_parser_users(graph: Graph) -> list[str]:
     return problems
 
 
-def check_unsafe(graph: Graph) -> list[str]:
+def check_unsafe(graph: Graph, crates: Crates) -> list[str]:
     problems = []
     workspace = tomllib.loads((graph.workspace_root / 'Cargo.toml').read_text())
     workspace_rust = (
@@ -391,7 +439,7 @@ def check_unsafe(graph: Graph) -> list[str]:
             'rust/Cargo.toml: the workspace lints do not forbid unsafe_code'
         )
     for crate in graph.members:
-        kind = CLASSES.get(crate)
+        kind = crates.classes.get(crate)
         manifest = tomllib.loads(graph.manifests[crate].read_text())
         lints = manifest.get('lints', {})
         if kind in (DOMAIN, HOST):
@@ -482,17 +530,21 @@ def check_bridges(root: Path, parser_root: Path) -> list[str]:
 
 def run_checks(metadata: dict[str, Any], root: Path) -> dict[str, list[str]]:
     graph = Graph(metadata)
+    crates, unreadable = tree_crates(root)
+    if unreadable:
+        return {'classes': unreadable}
+    parser = crates.parser
     parser_root = (
-        crate_root(graph, PARSER)
-        if PARSER in graph.manifests
-        else root / 'rust/crates' / PARSER
+        crate_root(graph, parser)
+        if parser in graph.manifests
+        else root / 'rust/crates' / parser
     )
     return {
-        'classes': check_classes(graph),
-        'edges': check_edges(graph),
-        'reach': check_reach(graph),
-        'parser': check_parser_users(graph),
-        'unsafe': check_unsafe(graph),
+        'classes': check_classes(graph, crates),
+        'edges': check_edges(graph, crates),
+        'reach': check_reach(graph, crates),
+        'parser': check_parser_users(graph, parser),
+        'unsafe': check_unsafe(graph, crates),
         'bridges': check_bridges(root, parser_root),
     }
 

scripts/rust_core/l0_scan.py

@@ -17,7 +17,13 @@
   the like, a ``py``-prefixed Python type name (``pyint``, ``pystr``), a
   dunder name, or a string literal naming Python, pandas, NumPy or pyarrow,
   is emulation vocabulary. The public names the allowlisted modules define
-  may be used anywhere in their crate.
+  may be used anywhere in their crate. The parser crate's name is the
+  checked tree's: its own copy of this file's ``PARSER_CRATE``, read as a
+  string literal, never run, with ``CORE_CRATES``' parser entry under that
+  name (``parser_crates``), so a gate running its checkpoint's copy over a
+  candidate that renames the crate judges the candidate's name (a bug fix at
+  T1.28w, E56(a)); a copy missing, unparsed, not a literal, or naming
+  another crate is refused.
 - ``sql``: no SQL fragment and no provider match in ``sdm-schema``,
   ``sdm-engine``, ``sdm-request`` or ``sdm-core`` (migration plan,
   "Ownership"; ``sdm-core`` from T1.21c). It is a
@@ -122,6 +128,7 @@
 import tomllib
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
+SCRIPT = Path('scripts/rust_core/l0_scan.py')
 
 # The crates whose code ships and whose rules are the core's: the domain
 # crates and the host layer. The binding, sdm-py, talks to Python by design,
@@ -341,7 +348,59 @@ def crate_dir(root: Path, crate: str) -> Path:
 )
 
 
-def read_allowlist(root: Path) -> tuple[list[Path], list[str]]:
+def tree_name(
+    root: Path, script: Path, name: str
+) -> tuple[str | None, list[str]]:
+    """The string the checked tree's own copy of ``script`` assigns to
+    ``name`` at its top level, read as a literal, never run; or why it
+    cannot be read. A gate runs its checkpoint's copy of a guard over a
+    candidate's tree, so a crate's name in a guard's data is the tree's
+    (T1.28w: the checkpoint's copy named the parser crate as it stood, so a
+    package that renamed it could not pass its own gate)."""
+    path = root / script
+    if not path.is_file():
+        return None, [f"the tree's {script} is missing"]
+    try:
+        tree = ast.parse(path.read_text(encoding='utf-8'))
+    except SyntaxError as error:
+        return None, [f"the tree's {script} does not parse: {error.msg}"]
+    value: ast.expr | None = None
+    for node in tree.body:
+        target = (
+            node.target
+            if isinstance(node, ast.AnnAssign)
+            else node.targets[0]
+            if isinstance(node, ast.Assign) and len(node.targets) == 1
+            else None
+        )
+        if isinstance(target, ast.Name) and target.id == name:
+            value = node.value  # type: ignore[union-attr]
+    if (
+        isinstance(value, ast.Constant)
+        and isinstance(value.value, str)
+        and value.value
+    ):
+        return value.value, []
+    return None, [f"the tree's {script}: {name} is not a string literal"]
+
+
+def parser_crates(root: Path) -> tuple[str, tuple[str, ...], list[str]]:
+    """The parser crate's name in the tree at ``root`` (its copy of this
+    file's ``PARSER_CRATE``), and ``CORE_CRATES`` with the parser under it;
+    a name this copy gives another crate is refused."""
+    name, problems = tree_name(root, SCRIPT, 'PARSER_CRATE')
+    others = {*CORE_CRATES, *DIALECT_FREE_CRATES, *DEV_CRATES} - {PARSER_CRATE}
+    if name in others:
+        problems = [
+            f"the tree's {SCRIPT}: PARSER_CRATE names {name}, another crate"
+        ]
+    if name is None or problems:
+        return PARSER_CRATE, CORE_CRATES, problems
+    crates = tuple(name if c == PARSER_CRATE else c for c in CORE_CRATES)
+    return name, crates, []
+
+
+def read_allowlist(root: Path, parser: str) -> tuple[list[Path], list[str]]:
     entries: list[Path] = []
     problems: list[str] = []
     path = root / ALLOWLIST
@@ -355,7 +414,7 @@ def read_allowlist(root: Path) -> tuple[list[Path], list[str]]:
         if not (root / entry).is_file():
             problems.append(f'{ALLOWLIST}:{number}: {line} does not exist')
             continue
-        parser_src = Path('rust/crates') / PARSER_CRATE / 'src'
+        parser_src = Path('rust/crates') / parser / 'src'
         if parser_src not in entry.parents:
             problems.append(
                 f'{ALLOWLIST}:{number}: {line} is outside {parser_src}; '
@@ -376,7 +435,10 @@ def vocabulary_term(identifier: str) -> str | None:
 
 
 def check_vocabulary(root: Path) -> list[str]:
-    allowed, problems = read_allowlist(root)
+    parser, crates, unreadable = parser_crates(root)
+    if unreadable:
+        return unreadable
+    allowed, problems = read_allowlist(root, parser)
     allowed_set = {root / p for p in allowed}
     # The names the allowlisted modules define, and the modules themselves,
     # may be named anywhere in their crate.
@@ -385,7 +447,7 @@ def check_vocabulary(root: Path) -> list[str]:
         permitted.update(
             _PUB_ITEM.findall(read_rust(path.read_text()).skeleton)
         )
-    for crate in CORE_CRATES:
+    for crate in crates:
         src = crate_dir(root, crate) / 'src'
         for path in rust_files(src):
             if path in allowed_set:
@@ -394,7 +456,7 @@ def check_vocabulary(root: Path) -> list[str]:
             rel = path.relative_to(root)
             for offset, name in identifiers(source):
                 term = vocabulary_term(name)
-                if term and not (crate == PARSER_CRATE and name in permitted):
+                if term and not (crate == parser and name in permitted):
                     problems.append(
                         f'{rel}:{source.line(offset)}: `{name}` is Python-emulation '
                         f'vocabulary ({term}); emulation lives only in the modules '