fix(wasm): bind known WABT source provenance to its verified release

src/application/python/PythonPycService.test.ts

@@ -66,28 +66,6 @@ const report: PythonPyc = {
   ],
 };
 
-it.each([
-  {
-    flags: 1,
-    hash_based: true,
-    source_hash_hex: "",
-    source_mtime: null,
-    source_size: null,
-  },
-  { flags: 1 },
-])("refuses inconsistent provider header facts %j", async (header) => {
-  const result = await new PythonPycService({
-    close: async () => {},
-    identity,
-    inspect: async () =>
-      ok({ ...report, header: { ...report.header, ...header } }),
-  }).inspect({ path: report.artifact.path });
-  expect(result).toMatchObject({
-    ok: false,
-    error: { _tag: "AnalysisOutputError" },
-  });
-});
-
 it("rejects a relative path and extra arguments before reading", async () => {
   let calls = 0;
   const service = new PythonPycService({

src/application/wasm/WasmArtifactService.test.ts

@@ -325,3 +325,37 @@ it("replays imported rebound WASM Evidence in views and comparisons", async () =
     ).ok,
   ).toBe(true);
 });
+
+it.each([
+  { release: "1.0.42", knownCommit: true, accepted: true },
+  { release: "1.0.42", knownCommit: false, accepted: true },
+  { release: "1.0.44", knownCommit: false, accepted: true },
+  { release: "1.0.44", knownCommit: true, accepted: false },
+])(
+  "admits only release-consistent WABT provenance ($release, known commit $knownCommit)",
+  async ({ release, knownCommit, accepted }) => {
+    const value = wasmArtifactFixture();
+    value.tool_profile.release = release;
+    if (!knownCommit) value.tool_profile.source_commit = null;
+    for (const command of value.tool_profile.commands)
+      command.version_banner = `${release}\n`;
+    const service = new WasmArtifactService({
+      close: async () => {},
+      inspect: async () => ok(wasmArtifactExecution(value)),
+    });
+    const result = await service.inspect({ path: value.artifact.path });
+    if (accepted) {
+      if (!result.ok) throw result.error;
+      expect(result.value.normalized_result).toMatchObject({
+        tool_profile: {
+          release,
+          source_commit: value.tool_profile.source_commit,
+        },
+      });
+    } else
+      expect(result).toMatchObject({
+        ok: false,
+        error: { _tag: "AnalysisOutputError" },
+      });
+  },
+);

src/domain/python/pythonPyc.test.ts

@@ -3,49 +3,9 @@ import {
   inspectPythonPycInputSchema,
   pythonPycMarshalProfile,
   PYTHON_PYC_MARSHAL_PROFILES,
-  pythonPycHeaderSchema,
 } from "./pythonPyc.js";
 import { pythonBytecodeIdentity } from "./pythonBytecodeIdentity.js";
 
-const hashHeader = {
-  magic: 3531,
-  python_version: "3.12",
-  code_layout: "py311",
-  flags: 3,
-  hash_based: true,
-  check_source: true,
-  source_hash_hex: "0123456789abcdef",
-  source_mtime: null,
-  source_size: null,
-};
-
-it.each(["", "ab", "g".repeat(16)])(
-  "rejects an invalid source hash %j",
-  (source_hash_hex) => {
-    expect(
-      pythonPycHeaderSchema.safeParse({ ...hashHeader, source_hash_hex })
-        .success,
-    ).toBe(false);
-  },
-);
-
-it.each([
-  { hash_based: false },
-  { check_source: false },
-  { source_hash_hex: null },
-  { source_mtime: 0 },
-  { source_size: 0 },
-])("keeps header facts consistent with the recorded flags: %j", (changed) => {
-  expect(
-    pythonPycHeaderSchema.safeParse({ ...hashHeader, ...changed }).success,
-  ).toBe(false);
-});
-
-it("preserves unknown raw header flags and valid hash bytes", () => {
-  const header = { ...hashHeader, flags: 0x80000003 };
-  expect(pythonPycHeaderSchema.parse(header)).toEqual(header);
-});
-
 it("keeps pinned CPython identity separate from standalone marshal coverage", () => {
   expect(pythonPycMarshalProfile(3394)).toEqual({
     code_layout: "py37",

src/domain/python/pythonPyc.ts

@@ -205,53 +205,17 @@ const pythonCodeObjectSchema = z.strictObject({
 });
 export type PythonPycCodeObject = z.infer<typeof pythonCodeObjectSchema>;
 
-export const pythonPycHeaderSchema = z
-  .strictObject({
-    magic: z.number().int().min(0).max(0xffff),
-    python_version: z.string().min(1),
-    code_layout: z.enum(PYTHON_PYC_CODE_LAYOUTS),
-    flags: uint,
-    hash_based: z.boolean(),
-    check_source: z.boolean(),
-    source_hash_hex: z
-      .string()
-      .regex(/^[0-9a-f]{16}$/u)
-      .nullable(),
-    source_mtime: uint.nullable(),
-    source_size: uint.nullable(),
-  })
-  .superRefine((header, context) => {
-    for (const [field, flag] of [
-      ["hash_based", PYTHON_PYC_HASH_BASED],
-      ["check_source", PYTHON_PYC_CHECK_SOURCE],
-    ] as const)
-      if (header[field] !== ((header.flags & flag) !== 0))
-        context.addIssue({
-          code: "custom",
-          path: [field],
-          message: `${field} disagrees with its recorded header flag.`,
-        });
-    if (header.hash_based === (header.source_hash_hex === null))
-      context.addIssue({
-        code: "custom",
-        path: ["source_hash_hex"],
-        message:
-          "Hash-based pycs require an 8-byte source hash; others must omit it.",
-      });
-    if (header.hash_based === (header.source_mtime !== null))
-      context.addIssue({
-        code: "custom",
-        path: ["source_mtime"],
-        message: "Timestamp pycs require mtime; hash-based pycs must omit it.",
-      });
-    if (header.hash_based === (header.source_size !== null))
-      context.addIssue({
-        code: "custom",
-        path: ["source_size"],
-        message:
-          "Timestamp pycs require source_size; hash-based pycs must omit it.",
-      });
-  });
+export const pythonPycHeaderSchema = z.strictObject({
+  magic: z.number().int().min(0).max(0xffff),
+  python_version: z.string().min(1),
+  code_layout: z.enum(PYTHON_PYC_CODE_LAYOUTS),
+  flags: uint,
+  hash_based: z.boolean(),
+  check_source: z.boolean(),
+  source_hash_hex: z.string().nullable(),
+  source_mtime: uint.nullable(),
+  source_size: uint.nullable(),
+});
 
 /** Bounded CPython 3.7–3.13 pyc observation; marshal is walked, bytecode is not decompiled. */
 export const pythonPycSchema = z
@@ -289,6 +253,29 @@ export const pythonPycSchema = z
         message: "Marshal byte count disagrees with the header-stripped file.",
       });
     }
+    if (report.header.hash_based === (report.header.source_hash_hex === null)) {
+      context.addIssue({
+        code: "custom",
+        path: ["header", "source_hash_hex"],
+        message:
+          "Hash-based pycs require an 8-byte source hash; others must omit it.",
+      });
+    }
+    if (report.header.hash_based === (report.header.source_mtime !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: ["header", "source_mtime"],
+        message: "Timestamp pycs require mtime; hash-based pycs must omit it.",
+      });
+    }
+    if (report.header.hash_based === (report.header.source_size !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: ["header", "source_size"],
+        message:
+          "Timestamp pycs require source_size; hash-based pycs must omit it.",
+      });
+    }
     if (report.coverage.code_objects !== report.code_objects.length) {
       context.addIssue({
         code: "custom",

src/domain/wasm/wasmArtifact.ts

@@ -8,14 +8,16 @@ import { constants as bufferConstants } from "node:buffer";
 import type { EvidenceSubjectTarget } from "../evidence.js";
 
 import { absoluteLocalPathStringSchema } from "../localPath.js";
-/** Release banners of the admitted WABT range, owned here so this schema stays pure. */
-const WABT_ACCEPTED_MINOR = 42;
-const WABT_SOURCE_COMMIT = "ff0ef7e0009402740c805a9744c09b05be063e48";
+/** Exact upstream release whose tool profile REA verified. */
+export const WABT_VERSION = "1.0.42";
+const WABT_MINIMUM_PATCH = Number(WABT_VERSION.split(".")[2]);
+/** Upstream revision known for the verified release only. */
+export const WABT_SOURCE_COMMIT = "ff0ef7e0009402740c805a9744c09b05be063e48";
 const wabtReleaseBanner = z
   .string()
   .regex(/^1\.0\.\d+$/u)
-  .refine((release) => Number(release.split(".")[2]) >= WABT_ACCEPTED_MINOR, {
-    message: `Expected one admitted WABT banner (^1.0.${String(WABT_ACCEPTED_MINOR)})`,
+  .refine((release) => Number(release.split(".")[2]) >= WABT_MINIMUM_PATCH, {
+    message: `Expected one admitted WABT banner (^1.0.${String(WABT_MINIMUM_PATCH)})`,
   });
 
 const digest = z.string().regex(/^[a-f0-9]{64}$/);
@@ -226,6 +228,16 @@ export const wasmArtifactSchema = z
         "--ignore-custom-section-errors",
       );
     const releaseVersion = value.tool_profile.release;
+    if (
+      value.tool_profile.source_commit !== null &&
+      releaseVersion !== WABT_VERSION
+    )
+      context.addIssue({
+        code: "custom",
+        path: ["tool_profile", "source_commit"],
+        message:
+          "The known WABT source revision applies only to its verified release; other releases require an unknown source commit.",
+      });
     for (const [index, command] of value.tool_profile.commands.entries()) {
       const expected = ["wasm-validate", "wasm-objdump", "wasm2wat"][index];
       const argumentsExpected =

src/wasm/WabtArtifactProvider.ts

@@ -40,6 +40,8 @@ import { createAnalysisExecutionEvidence } from "../domain/analysisObservation.j
 import { projectAnalysisError } from "../domain/analysisErrorProjection.js";
 import {
   wasmArtifactSchema,
+  WABT_SOURCE_COMMIT,
+  WABT_VERSION,
   DEFAULT_WASM_COMMAND_TIMEOUT_MS,
   wasmResourceLimits,
   type InspectWasmArtifactInput,
@@ -58,8 +60,6 @@ import {
 import { WabtRuntime } from "./WabtRuntime.js";
 import {
   WABT_PROVIDER_IDENTITY,
-  WABT_SOURCE_COMMIT,
-  WABT_VERSION,
   admitWabtVersion,
   wabtReleaseLine,
 } from "./WabtRelease.js";

src/wasm/WabtFailures.ts

@@ -32,16 +32,13 @@ import {
 import { WabtAdmissionError } from "./WabtAdmissionError.js";
 import {
   DEFAULT_WASM_COMMAND_TIMEOUT_MS,
+  WABT_VERSION,
   MAX_WASM_COMMAND_TIMEOUT_MS,
   WASM_RESOURCE_DEFAULTS,
   WASM_RESOURCE_MAXIMUMS,
   type WasmResourceLimits,
 } from "../domain/wasm/wasmArtifact.js";
-import {
-  WABT_ACCEPTED_RANGE,
-  WABT_PROVIDER_IDENTITY,
-  WABT_VERSION,
-} from "./WabtRelease.js";
+import { WABT_ACCEPTED_RANGE, WABT_PROVIDER_IDENTITY } from "./WabtRelease.js";
 const OUTPUT_LIMIT_EXCERPT_BYTES = 4096;
 
 /** Recovery names the exhausted per-call byte owner, independently of deadlines. */

src/wasm/WabtRelease.ts

@@ -1,7 +1,6 @@
 import { satisfies, valid } from "semver";
+import { WABT_VERSION } from "../domain/wasm/wasmArtifact.js";
 
-/** Exact upstream release whose producer output this adapter verified. */
-export const WABT_VERSION = "1.0.42";
 /**
  * Releases admitted for caller-configured tools. WABT changes `wasm-validate`,
  * `wasm-objdump` and `wasm2wat` output only by addition within a minor version;
@@ -10,9 +9,7 @@ export const WABT_VERSION = "1.0.42";
  * banners `wasmArtifactSchema` accepts; letting 1.1.0 through would admit a
  * tool profile whose report the schema then rejects after inspection ran.
  */
-export const WABT_ACCEPTED_RANGE = ">=1.0.42 <1.1.0";
-/** Upstream revision of the verified release. */
-export const WABT_SOURCE_COMMIT = "ff0ef7e0009402740c805a9744c09b05be063e48";
+export const WABT_ACCEPTED_RANGE = `>=${WABT_VERSION} <1.1.0`;
 export const WABT_PROVIDER_IDENTITY = {
   id: "wabt-artifact",
   name: "REA WABT artifact adapter",