fix(wasm): bind known WABT source provenance to its verified release

src/application/wasm/WasmArtifactService.test.ts

@@ -325,3 +325,37 @@ it("replays imported rebound WASM Evidence in views and comparisons", async () =
     ).ok,
   ).toBe(true);
 });
+
+it.each([
+  { release: "1.0.42", knownCommit: true, accepted: true },
+  { release: "1.0.42", knownCommit: false, accepted: true },
+  { release: "1.0.44", knownCommit: false, accepted: true },
+  { release: "1.0.44", knownCommit: true, accepted: false },
+])(
+  "admits only release-consistent WABT provenance ($release, known commit $knownCommit)",
+  async ({ release, knownCommit, accepted }) => {
+    const value = wasmArtifactFixture();
+    value.tool_profile.release = release;
+    if (!knownCommit) value.tool_profile.source_commit = null;
+    for (const command of value.tool_profile.commands)
+      command.version_banner = `${release}\n`;
+    const service = new WasmArtifactService({
+      close: async () => {},
+      inspect: async () => ok(wasmArtifactExecution(value)),
+    });
+    const result = await service.inspect({ path: value.artifact.path });
+    if (accepted) {
+      if (!result.ok) throw result.error;
+      expect(result.value.normalized_result).toMatchObject({
+        tool_profile: {
+          release,
+          source_commit: value.tool_profile.source_commit,
+        },
+      });
+    } else
+      expect(result).toMatchObject({
+        ok: false,
+        error: { _tag: "AnalysisOutputError" },
+      });
+  },
+);

src/artifacts/pyinstaller/MarshalSubset.test.ts

@@ -20,11 +20,6 @@ it("reads a Python 3.9 reference-flagged PYZ table", () => {
   ]);
 });
 
-it("reads marshal one-byte string tags as Latin-1", () => {
-  for (const hex of ["6101000000e9", "4101000000e9", "7a01e9", "5a01e9"])
-    expect(readMarshalSubset(bytes(hex))).toEqual({ ok: true, value: "é" });
-});
-
 it("decodes CPython marshal Unicode with surrogatepass", () => {
   expect(
     readMarshalSubset(

src/artifacts/pyinstaller/MarshalSubset.ts

@@ -168,8 +168,14 @@ const readAsciiBytes = (
 ): Result<string, PyInstallerFailure> => {
   const bytes = readBytes(cursor, length);
   if (!bytes.ok) return bytes;
-  // These tags use CPython's one-byte Unicode constructor, not an ASCII check.
-  return ok(bytes.value.toString("latin1"));
+  if (bytes.value.some((byte) => byte > 0x7f))
+    return err(
+      pyInstallerFailure(
+        "format",
+        "PYZ marshal ASCII string contains a non-ASCII byte",
+      ),
+    );
+  return ok(bytes.value.toString("ascii"));
 };
 
 const readUtf8 = (

src/domain/wasm/wasmArtifact.ts

@@ -8,14 +8,16 @@ import { constants as bufferConstants } from "node:buffer";
 import type { EvidenceSubjectTarget } from "../evidence.js";
 
 import { absoluteLocalPathStringSchema } from "../localPath.js";
-/** Release banners of the admitted WABT range, owned here so this schema stays pure. */
-const WABT_ACCEPTED_MINOR = 42;
-const WABT_SOURCE_COMMIT = "ff0ef7e0009402740c805a9744c09b05be063e48";
+/** Exact upstream release whose tool profile REA verified. */
+export const WABT_VERSION = "1.0.42";
+const WABT_MINIMUM_PATCH = Number(WABT_VERSION.split(".")[2]);
+/** Upstream revision known for the verified release only. */
+export const WABT_SOURCE_COMMIT = "ff0ef7e0009402740c805a9744c09b05be063e48";
 const wabtReleaseBanner = z
   .string()
   .regex(/^1\.0\.\d+$/u)
-  .refine((release) => Number(release.split(".")[2]) >= WABT_ACCEPTED_MINOR, {
-    message: `Expected one admitted WABT banner (^1.0.${String(WABT_ACCEPTED_MINOR)})`,
+  .refine((release) => Number(release.split(".")[2]) >= WABT_MINIMUM_PATCH, {
+    message: `Expected one admitted WABT banner (^1.0.${String(WABT_MINIMUM_PATCH)})`,
   });
 
 const digest = z.string().regex(/^[a-f0-9]{64}$/);
@@ -226,6 +228,16 @@ export const wasmArtifactSchema = z
         "--ignore-custom-section-errors",
       );
     const releaseVersion = value.tool_profile.release;
+    if (
+      value.tool_profile.source_commit !== null &&
+      releaseVersion !== WABT_VERSION
+    )
+      context.addIssue({
+        code: "custom",
+        path: ["tool_profile", "source_commit"],
+        message:
+          "The known WABT source revision applies only to its verified release; other releases require an unknown source commit.",
+      });
     for (const [index, command] of value.tool_profile.commands.entries()) {
       const expected = ["wasm-validate", "wasm-objdump", "wasm2wat"][index];
       const argumentsExpected =

src/python/PythonPycParser.test.ts

@@ -407,30 +407,6 @@ it("charges long digits to the string budget and keeps large previews bounded",
   );
 });
 
-it("reads marshal one-byte string tags as Latin-1 with Unicode identity", () => {
-  for (const tag of [0x61, 0x41, 0x7a, 0x5a]) {
-    const encoded = Buffer.concat([
-      Buffer.from([tag]),
-      tag === 0x61 || tag === 0x41 ? u32(1) : Buffer.from([1]),
-      Buffer.from([0xe9]),
-    ]);
-    const sameUnicode = marshalUnicode(Buffer.from("é", "utf8"));
-    const set = Buffer.concat([
-      Buffer.from([0x3c]),
-      u32(2),
-      encoded,
-      sameUnicode,
-    ]);
-    const report = root(parse(withConsts([encoded, set])));
-    expect(report.consts[0]).toMatchObject({
-      kind: "str",
-      value: "é",
-      bytes: 1,
-    });
-    expect(report.consts[1]).toEqual({ kind: "set", length: 1 });
-  }
-});
-
 it("decodes marshal strings with CPython surrogatepass rules", () => {
   const report = parse(
     withConsts([marshalUnicode(Buffer.from("efbbbf73eda080efbbbf", "hex"))]),
@@ -1558,36 +1534,6 @@ it("hashes a long TYPE_REF tuple chain without recursing", () => {
   expect(pythonPycSchema.safeParse(report).success).toBe(true);
 });
 
-it("hashes shallow TYPE_REF code chains without using the JavaScript stack", () => {
-  const links = 3000;
-  const codes = Array.from({ length: links }, (_, index) =>
-    marshalCode("py311", {
-      flagged: true,
-      name: "f",
-      consts: index === 0 ? [Buffer.from([0x4e])] : [marshalRef(index - 1)],
-    }),
-  );
-  const bytes = Buffer.concat([
-    pythonPycHeader(3531),
-    marshalCode("py311", {
-      constsObject: Buffer.concat([
-        Buffer.from([0x28]),
-        u32(links + 1),
-        ...codes,
-        Buffer.from([0x3c]),
-        u32(1),
-        marshalRef(links - 1),
-      ]),
-    }),
-  ]);
-  const report = parseWith(bytes, { max_objects: 65_536 });
-  expect(root(report).consts.at(-1)).toEqual({ kind: "set", length: 1 });
-  expect(report.coverage).toMatchObject({
-    status: "complete",
-    code_objects: links + 1,
-  });
-});
-
 it("rejects code CPython treats as corrupt instead of complete coverage", () => {
   const file = (
     layout: "py37" | "py38" | "py311",

src/python/PythonPycParser.ts

@@ -332,7 +332,7 @@ class MarshalReader {
   readonly #codeKeys = new WeakMap<CodeNode, string>();
   readonly #codeIdentities = new WeakMap<CodeNode, number>();
   readonly #codeEquality = new WeakMap<CodeNode, CodeEquality>();
-  /** Completed Python hashability checks per code object. */
+  /** Python hashability per code object. False while that check is in progress. */
   readonly #codeHashable = new WeakMap<CodeNode, boolean>();
   /** Tuples whose items are still being read; CPython cannot hash them yet. */
   readonly #readingTuples = new WeakSet<MarshalValue>();
@@ -436,19 +436,13 @@ class MarshalReader {
         };
       case TYPE_INTERNED:
       case TYPE_UNICODE:
-        return this.string(
-          this.nonNegativeInt32("Marshal string length"),
-          "utf8",
-        );
+        return this.utf8(this.nonNegativeInt32("Marshal string length"), false);
       case TYPE_ASCII:
       case TYPE_ASCII_INTERNED:
-        return this.string(
-          this.nonNegativeInt32("Marshal string length"),
-          "latin1",
-        );
+        return this.utf8(this.nonNegativeInt32("Marshal string length"), true);
       case TYPE_SHORT_ASCII:
       case TYPE_SHORT_ASCII_INTERNED:
-        return this.string(this.u8(), "latin1");
+        return this.utf8(this.u8(), true);
       case TYPE_TUPLE:
         return this.sequenceValue(
           "tuple",
@@ -1315,70 +1309,13 @@ class MarshalReader {
   #isCodeHashable(node: CodeNode): boolean {
     const known = this.#codeHashable.get(node);
     if (known !== undefined) return known;
-    const frames: { value: MarshalValue; finish: boolean }[] = [
-      { value: { kind: "code", value: node }, finish: false },
-    ];
-    const gray = new Set<MarshalValue | CodeNode>();
-    const complete = new Set<MarshalValue>();
-    const reject = (): false => {
-      this.#codeHashable.set(node, false);
-      return false;
-    };
-    while (frames.length > 0) {
-      this.#takeKeyStep();
-      const frame = frames.pop()!;
-      const value = frame.value;
-      const identity = value.kind === "code" ? value.value : value;
-      if (frame.finish) {
-        gray.delete(identity);
-        if (value.kind === "code") {
-          const material =
-            this.#codeEquality.get(value.value) ??
-            malformed("Code object is missing equality material.");
-          // Child code checks are now complete, so the existing tuple key
-          // walker preserves its equality and expansion budgets without recursion.
-          const hashable =
-            this.#equalityKey(material.constsTuple, "hash") !== null;
-          this.#codeHashable.set(value.value, hashable);
-          if (!hashable) return reject();
-        } else complete.add(value);
-        continue;
-      }
-      if (value.kind === "code") {
-        const cached = this.#codeHashable.get(value.value);
-        if (cached === false) return reject();
-        if (cached === true) continue;
-      } else {
-        const cached = this.#keyCache.get(value);
-        if (cached === null) return reject();
-        if (cached !== undefined || complete.has(value)) continue;
-      }
-      if (
-        gray.has(identity) ||
-        this.#readingTuples.has(value) ||
-        value.kind === "list" ||
-        value.kind === "set" ||
-        value.kind === "dict" ||
-        value.kind === "null"
-      )
-        return reject();
-      const children =
-        value.kind === "code"
-          ? [
-              (
-                this.#codeEquality.get(value.value) ??
-                malformed("Code object is missing equality material.")
-              ).constsTuple,
-            ]
-          : value.kind === "tuple" || value.kind === "frozenset"
-            ? value.items
-            : [];
-      gray.add(identity);
-      frames.push({ value, finish: true });
-      for (let index = children.length - 1; index >= 0; index -= 1)
-        frames.push({ value: children[index]!, finish: false });
-    }
-    return true;
+    this.#codeHashable.set(node, false);
+    const material =
+      this.#codeEquality.get(node) ??
+      malformed("Code object is missing equality material.");
+    const hashable = this.#equalityKey(material.constsTuple, "hash") !== null;
+    this.#codeHashable.set(node, hashable);
+    return hashable;
   }
 
   #codeIdentity(node: CodeNode): number {
@@ -1555,20 +1492,17 @@ class MarshalReader {
     );
   }
 
-  string(length: number, encoding: "latin1" | "utf8"): MarshalValue {
+  utf8(length: number, ascii: boolean): MarshalValue {
     const bytes = this.blob(length);
-    if (encoding === "latin1") {
-      // CPython reads the ASCII-tagged forms as one-byte Unicode, even when
-      // high bytes appear. Identity must agree with the UTF-8 string form.
-      const value = bytes.toString("latin1");
+    if (ascii) {
+      if (bytes.some((byte) => byte > 0x7f))
+        malformed("Marshal ASCII string contains a non-ASCII byte.");
       return {
         kind: "str",
-        value,
+        value: bytes.toString("latin1"),
         previewEnd: Math.min(length, PYTHON_PYC_CONST_PREVIEW_LIMIT),
         bytes: length,
-        raw: bytes.some((byte) => byte > 0x7f)
-          ? Buffer.from(value, "utf8")
-          : bytes,
+        raw: bytes,
       };
     }
     const decoded = decodeMarshalUtf8(bytes, PYTHON_PYC_CONST_PREVIEW_LIMIT);

src/wasm/WabtArtifactProvider.ts

@@ -40,6 +40,8 @@ import { createAnalysisExecutionEvidence } from "../domain/analysisObservation.j
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import {
   wasmArtifactSchema,
+  WABT_SOURCE_COMMIT,
+  WABT_VERSION,
   DEFAULT_WASM_COMMAND_TIMEOUT_MS,
   wasmResourceLimits,
   type InspectWasmArtifactInput,
@@ -58,8 +60,6 @@ import {
 import { WabtRuntime } from "./WabtRuntime.js";
 import {
   WABT_PROVIDER_IDENTITY,
-  WABT_SOURCE_COMMIT,
-  WABT_VERSION,
   admitWabtVersion,
   wabtReleaseLine,
 } from "./WabtRelease.js";

src/wasm/WabtFailures.ts

@@ -32,16 +32,13 @@ import {
 import { WabtAdmissionError } from "./WabtAdmissionError.js";
 import {
   DEFAULT_WASM_COMMAND_TIMEOUT_MS,
+  WABT_VERSION,
   MAX_WASM_COMMAND_TIMEOUT_MS,
   WASM_RESOURCE_DEFAULTS,
   WASM_RESOURCE_MAXIMUMS,
   type WasmResourceLimits,
 } from "../domain/wasm/wasmArtifact.js";
-import {
-  WABT_ACCEPTED_RANGE,
-  WABT_PROVIDER_IDENTITY,
-  WABT_VERSION,
-} from "./WabtRelease.js";
+import { WABT_ACCEPTED_RANGE, WABT_PROVIDER_IDENTITY } from "./WabtRelease.js";
 const OUTPUT_LIMIT_EXCERPT_BYTES = 4096;
 
 /** Recovery names the exhausted per-call byte owner, independently of deadlines. */

src/wasm/WabtRelease.ts

@@ -1,7 +1,6 @@
 import { satisfies, valid } from "semver";
+import { WABT_VERSION } from "../domain/wasm/wasmArtifact.js";
 
-/** Exact upstream release whose producer output this adapter verified. */
-export const WABT_VERSION = "1.0.42";
 /**
  * Releases admitted for caller-configured tools. WABT changes `wasm-validate`,
  * `wasm-objdump` and `wasm2wat` output only by addition within a minor version;
@@ -10,9 +9,7 @@ export const WABT_VERSION = "1.0.42";
  * banners `wasmArtifactSchema` accepts; letting 1.1.0 through would admit a
  * tool profile whose report the schema then rejects after inspection ran.
  */
-export const WABT_ACCEPTED_RANGE = ">=1.0.42 <1.1.0";
-/** Upstream revision of the verified release. */
-export const WABT_SOURCE_COMMIT = "ff0ef7e0009402740c805a9744c09b05be063e48";
+export const WABT_ACCEPTED_RANGE = `>=${WABT_VERSION} <1.1.0`;
 export const WABT_PROVIDER_IDENTITY = {
   id: "wabt-artifact",
   name: "REA WABT artifact adapter",