mirror of
https://github.com/firestar5683/StarPilot.git
synced 2026-11-08 13:33:42 +08:00
firestar5683
303 lines
16 KiB
Python
303 lines
16 KiB
Python
"""Declared synthetic arithmetic/type contracts, NOT native or route evidence.
|
|
|
|
Root executes in the matching composed project. Author did not import/run.
|
|
Actual registered producer/native/CAN positive remains a separate root fixture.
|
|
"""
|
|
from dataclasses import asdict, replace
|
|
import math
|
|
from types import SimpleNamespace
|
|
from unittest.mock import Mock
|
|
|
|
import pytest
|
|
|
|
from openpilot.starpilot.flm import plant_lag as p
|
|
from openpilot.starpilot.flm import physical_input_observation as o
|
|
|
|
|
|
def h(value):
|
|
return p.digest(value)
|
|
|
|
|
|
def reseal(row, **changed):
|
|
row = replace(row, **changed)
|
|
return replace(row, observation_digest=o.observation_digest(row))
|
|
|
|
|
|
def retape(binding, tape, commands):
|
|
commands = tuple(commands)
|
|
return replace(tape, commands=commands, verified_tape_digest=o.physical_tape_digest(binding, commands))
|
|
|
|
|
|
def physical_fixture(*, tags=None):
|
|
"""All51 complete varying OBSERVED inputs, all performance tags originally True.
|
|
|
|
Evidence hashes are explicitly synthetic placeholders; this does not test the
|
|
real from_original constructor or grant native permission/profile authority.
|
|
"""
|
|
binding = p.SourceBinding(*(h(name) for name in ('identity', 'cp', 'source', 'controller', 'epoch',
|
|
'baseline', 'native', 'calibration', 'vm')), session='SYNTHETIC_ARITHMETIC_NOT_NATIVE_PROOF',
|
|
source_clock_contract_sha256=h('synthetic-clock-proof'), native_required=True)
|
|
bound = p.binding_digest(binding)
|
|
tags = tags if tags is not None else o.OriginalPerformanceTags(True, True, True, True, True)
|
|
commands, poses, windows = [], [], []
|
|
for block in range(8):
|
|
start = 20_000_000_000 + block * 6_000_000_000
|
|
sign = 1 if block % 2 == 0 else -1
|
|
|
|
def value(stamp, *, start=start, sign=sign):
|
|
t = (stamp - start) * 1e-9
|
|
return sign * (.25 + .13 * math.sin(1.9 * t) + .02 * math.sin(7.3 * t))
|
|
|
|
for index in range(501):
|
|
apply = start + index * 10_000_000
|
|
control = apply - 1_000_000
|
|
row = o.PhysicalDeliveredInput(o.PROTOCOL, control, control, control, apply, value(apply),
|
|
control - 10_000_000, control - 1_000_000, apply + 100_000_000, len(commands) + 1,
|
|
apply + 1_000_000, h(('encoded', block, index)), h(('original-control', block, index)),
|
|
h(('original-applied', block, index)), h(('effective-applied', block, index)),
|
|
h(('declared-synthetic-emission', block, index)), binding.identity, 1, binding.source_epoch,
|
|
binding.baseline_revision, binding.controller_revision, binding.native_identity, True,
|
|
'measured', tags, 'observed_input_performance_tagged' if any(asdict(tags).values()) else
|
|
'observed_input_clean', bound, '')
|
|
commands.append(reseal(row))
|
|
ids = []
|
|
for index in range(80):
|
|
source = start + 605_000_000 + index * 50_000_000
|
|
pid = h(('pose', block, index))
|
|
ids.append(pid)
|
|
selected = start + ((source - 170_000_000 - start) // 10_000_000) * 10_000_000
|
|
y = 1.98 * value(selected) + .01
|
|
poses.append(p.SourcePose(pid, source, source + 40_000_000, source,
|
|
'mono_boot_equivalent_interval_v1', 0, 1_000, source - 1_000, source + 1_000,
|
|
0, 25., y / 25., 0., bound))
|
|
windows.append(p.CalibrationWindow(h(('time-block', block)), start, start + 5_000_000_000,
|
|
tuple(ids), h(('declared-original-slot', block))))
|
|
commands = tuple(commands)
|
|
tape = o.VerifiedPhysicalTape(o.PROTOCOL, commands, bound,
|
|
o.physical_tape_digest(binding, commands), h('synthetic-not-native-verifier'))
|
|
return binding, tape, tuple(poses), tuple(windows)
|
|
|
|
|
|
def test_known_limited_physical_inputs_preserve_all51_original_rows_and_affine_gates():
|
|
evidence = physical_fixture()
|
|
result = p.identify_physical_plant_lag(*evidence)
|
|
assert result.status == 'physical_affine_test_passed'
|
|
assert result.reason == 'NO_PROFILE_NO_CURRENT_AUTHORITY'
|
|
assert result.decision.protocol == p.PHYSICAL_PROTOCOL != p.PROTOCOL
|
|
assert result.decision.lag_ns == 170_000_000
|
|
assert result.decision.slope == pytest.approx(1.98)
|
|
assert result.decision.intercept == pytest.approx(.01)
|
|
assert len(result.decision.training_scores) == 51
|
|
assert all(score is not None for _, score in result.decision.training_scores)
|
|
assert len(result.rows) == 640
|
|
assert tuple(row.pose_id for row in result.rows) == tuple(pose.pose_id for pose in evidence[2])
|
|
assert all(error < 1e-10 and outside == 0 for _, error, outside in result.heldout_blocks)
|
|
assert all(all(asdict(row.tags).values()) for row in evidence[1].commands)
|
|
assert not isinstance(evidence[1].commands[0], p.DeliveredCommand)
|
|
assert not hasattr(result, 'profile') and not hasattr(result, 'admission')
|
|
|
|
|
|
def test_performance_tag_disposition_is_bound_but_not_a_numeric_physics_parameter():
|
|
tagged = p.identify_physical_plant_lag(*physical_fixture())
|
|
clean = p.identify_physical_plant_lag(*physical_fixture(tags=o.OriginalPerformanceTags(False, False, False, False, False)))
|
|
assert (tagged.decision.lag_ns, tagged.decision.slope, tagged.decision.intercept) == (
|
|
clean.decision.lag_ns, clean.decision.slope, clean.decision.intercept)
|
|
assert tagged.rows == clean.rows
|
|
assert tagged.experiment_digest != clean.experiment_digest
|
|
assert tagged.decision.train_source_digest != clean.decision.train_source_digest
|
|
|
|
|
|
def test_legacy_strict_types_cannot_receive_or_coerce_physical_observations():
|
|
binding, tape, poses, windows = physical_fixture()
|
|
with pytest.raises(ValueError, match='independently verified command tape'):
|
|
p.identify_plant_lag(binding, tape, poses, windows)
|
|
disguised = p.VerifiedCommandTape(tape.commands, p.binding_digest(binding),
|
|
p.command_tape_digest(binding, tape.commands), h('fake-strict-wrapper'), True)
|
|
with pytest.raises(ValueError, match='actual delivered command type'):
|
|
p.identify_plant_lag(binding, disguised, poses, windows)
|
|
|
|
|
|
def test_tag_or_original_body_tamper_cannot_keep_an_old_observation_digest():
|
|
binding, tape, poses, windows = physical_fixture()
|
|
for changed in (
|
|
replace(tape.commands[0], tags=replace(tape.commands[0].tags, output_limited=False)),
|
|
replace(tape.commands[0], original_applied_sha256=h('forged-original-body')),
|
|
replace(tape.commands[0], actual_emission_sha256=h('different-native-emission')),
|
|
):
|
|
attacked = retape(binding, tape, (changed, *tape.commands[1:]))
|
|
with pytest.raises(ValueError, match='custody'):
|
|
p.identify_physical_plant_lag(binding, attacked, poses, windows)
|
|
|
|
|
|
@pytest.mark.parametrize('changed', [
|
|
{'state_ns': 1}, {'output_state_ns': 1}, {'source_receipt_ns': 1},
|
|
{'native_expires_ns': 1}, {'native_observed_ns': 0}, {'native_required': False},
|
|
{'native_identity': h('different-native')}, {'identity': h('different-car')},
|
|
{'source_epoch': h('different-epoch')}, {'baseline_revision': h('different-baseline')},
|
|
{'controller_revision_sha256': h('different-controller')}, {'binding_digest': h('different-binding')},
|
|
{'limiter_kind': 'unknown'}, {'disposition': 'live_permission'}, {'command': 1.01}, {'generation': -1},
|
|
])
|
|
def test_hard_clock_native_identity_support_guards_survive_resealed_attack(changed):
|
|
binding, tape, poses, windows = physical_fixture()
|
|
changed_row = reseal(tape.commands[0], **changed)
|
|
attacked = retape(binding, tape, (changed_row, *tape.commands[1:]))
|
|
with pytest.raises(ValueError):
|
|
p.identify_physical_plant_lag(binding, attacked, poses, windows)
|
|
|
|
|
|
def test_boolean_flags_are_not_truthy_integer_permissions():
|
|
binding, tape, poses, windows = physical_fixture()
|
|
changed = reseal(tape.commands[0], tags=replace(tape.commands[0].tags, control_limited=1))
|
|
with pytest.raises(ValueError, match='boolean tags'):
|
|
p.identify_physical_plant_lag(binding, retape(binding, tape, (changed, *tape.commands[1:])), poses, windows)
|
|
|
|
|
|
def test_fifo_previous_carrier_and_stale_tape_hash_reject():
|
|
binding, tape, poses, windows = physical_fixture()
|
|
for commands in (
|
|
(tape.commands[0], reseal(tape.commands[1], carrier_frame=tape.commands[1].carrier_frame + 4), *tape.commands[2:]),
|
|
(tape.commands[1], tape.commands[0], *tape.commands[2:]),
|
|
):
|
|
with pytest.raises(ValueError, match='FIFO/carrier'):
|
|
p.identify_physical_plant_lag(binding, retape(binding, tape, commands), poses, windows)
|
|
with pytest.raises(ValueError, match='tape custody'):
|
|
p.identify_physical_plant_lag(binding, replace(tape, commands=tape.commands[1:]), poses, windows)
|
|
|
|
|
|
def test_missing_one_maximum_lookback_input_rejects_entire_common51_experiment():
|
|
binding, tape, poses, windows = physical_fixture()
|
|
commands = tuple(row for row in tape.commands if row.apply_ns >= poses[0].mono_ns - 100_000_000)
|
|
result = p.identify_physical_plant_lag(binding, retape(binding, tape, commands), poses, windows)
|
|
assert result.status == 'collecting' and result.reason.startswith('common_command_')
|
|
assert result.decision is None and not result.rows
|
|
|
|
|
|
def test_heldout_failure_cannot_choose_another_lag_or_mutate_training_receipt():
|
|
binding, tape, poses, windows = physical_fixture()
|
|
before = p.identify_physical_plant_lag(binding, tape, poses, windows)
|
|
attacked = tuple(replace(pose, calibrated_yaw_rate=pose.calibrated_yaw_rate + .5)
|
|
if index >= 320 else pose for index, pose in enumerate(poses))
|
|
result = p.identify_physical_plant_lag(binding, tape, attacked, windows)
|
|
assert result.status == 'rejected' and result.reason == 'heldout_rmse'
|
|
assert result.decision == before.decision
|
|
assert result.model_receipt_digest is None and len(result.heldout_blocks) == 4
|
|
|
|
|
|
@pytest.mark.parametrize('changed', [{'healthy': False}, {'native_allowed_at_receipt': False},
|
|
{'overridden': True}, {'fault': True}, {'clock_generation': 7}])
|
|
def test_performance_tags_cannot_cover_invalid_original_pose(changed):
|
|
binding, tape, poses, windows = physical_fixture()
|
|
attacked = (replace(poses[0], **changed), *poses[1:])
|
|
with pytest.raises(ValueError, match='source pose'):
|
|
p.identify_physical_plant_lag(binding, tape, attacked, windows)
|
|
|
|
|
|
def test_heldout_range_and_training_excitation_remain_original_gates():
|
|
binding, tape, poses, windows = physical_fixture()
|
|
original = p.identify_physical_plant_lag(binding, tape, poses, windows)
|
|
edge = windows[4].original_start_ns
|
|
changed = tuple(reseal(row, command=row.command * 1.5) if row.apply_ns >= edge else row
|
|
for row in tape.commands)
|
|
result = p.identify_physical_plant_lag(binding, retape(binding, tape, changed), poses, windows)
|
|
assert result.reason == 'heldout_command_range' and result.decision == original.decision
|
|
constant = tuple(reseal(row, command=.1) for row in tape.commands)
|
|
quiet = p.identify_physical_plant_lag(binding, retape(binding, tape, constant), poses, windows)
|
|
assert quiet.status == 'collecting' and quiet.reason == 'training_excitation_slope_direction'
|
|
|
|
|
|
def test_observation_packet_does_not_expand_original_resource_or_row_bounds():
|
|
binding, tape, poses, windows = physical_fixture()
|
|
enlarged = retape(binding, tape, tape.commands * 4)
|
|
with pytest.raises(ValueError, match='tape custody/bounds'):
|
|
p.identify_physical_plant_lag(binding, enlarged, poses, windows)
|
|
with pytest.raises(ValueError, match='40|declaration'):
|
|
p.identify_physical_plant_lag(binding, tape, poses, (replace(windows[0], pose_ids=windows[0].pose_ids[:39]), *windows[1:]))
|
|
|
|
|
|
def _boundary_objects():
|
|
"""Only negative trust-boundary tests use an uninitialized real engine type."""
|
|
from openpilot.starpilot.flm.controller_replay import ControllerReplay
|
|
from openpilot.starpilot.flm.fullrate_collector import ControlEvidence, AppliedEvidence
|
|
binding = physical_fixture()[0]
|
|
stamp = 30_000_000_000
|
|
control = ControlEvidence(binding.identity, 1, stamp, stamp, 'normalized_torque', 'stage', 'response',
|
|
.1, (.1,), .1, True, False, True, True, False, False, False, False, False, False,
|
|
source_epoch=binding.source_epoch, source_receipt_ns=stamp - 10_000_000,
|
|
baseline_revision=binding.baseline_revision, controller_revision='declared-boundary-negative',
|
|
native_required=True, native_allowed=True, native_identity=binding.native_identity,
|
|
native_observed_ns=stamp - 1_000_000, native_expires_ns=stamp + 100_000_000)
|
|
output = AppliedEvidence(stamp, stamp, stamp + 1_000_000, 'normalized_torque', .1,
|
|
True, True, False, False, True, True, carrier_frame=1, carrier_observed_ns=stamp + 1_000_000)
|
|
engine = object.__new__(ControllerReplay)
|
|
engine.failed, engine.raw_mode = False, True
|
|
engine.applied_matches = Mock(side_effect=AssertionError('hard rejection must precede any proof call'))
|
|
return control, output, engine, binding
|
|
|
|
|
|
@pytest.mark.parametrize('field,value', [
|
|
('enabled', False), ('manual', True), ('active', False), ('valid', False),
|
|
('override', True), ('fault', True), ('applied_coordinates', (.01,)),
|
|
])
|
|
def test_constructor_keeps_original_hard_control_guard_even_when_performance_tagged(field, value):
|
|
control, output, engine, binding = _boundary_objects()
|
|
control = replace(control, saturated=True, limited=True, controller_chatter=True, model_wobble=True,
|
|
**{field: value})
|
|
with pytest.raises(ValueError, match='hard validity'):
|
|
o.from_original(control, output, engine, binding, original_output=output)
|
|
engine.applied_matches.assert_not_called()
|
|
|
|
|
|
@pytest.mark.parametrize('field,value', [('valid', False), ('active', False), ('override', True), ('fault', True), ('native_allowed', False)])
|
|
def test_constructor_keeps_original_hard_output_guard(field, value):
|
|
control, output, engine, binding = _boundary_objects()
|
|
output = replace(output, **{field: value})
|
|
with pytest.raises(ValueError, match='hard validity'):
|
|
o.from_original(control, output, engine, binding, original_output=output)
|
|
engine.applied_matches.assert_not_called()
|
|
|
|
|
|
def test_caller_callback_or_claimed_qualified_engine_cannot_create_an_observation():
|
|
control, output, _, binding = _boundary_objects()
|
|
forged_engine = SimpleNamespace(applied_matches=lambda *_: True, verified_source_native_can=True)
|
|
with pytest.raises(ValueError, match='actual replay types'):
|
|
o.from_original(control, output, forged_engine, binding, original_output=output)
|
|
|
|
|
|
def test_real_class_without_actual_original_context_cannot_claim_a_receipt():
|
|
control, output, engine, binding = _boundary_objects()
|
|
with pytest.raises(ValueError, match='original context owner body'):
|
|
o.from_original(control, output, engine, binding, original_output=output)
|
|
engine.applied_matches.assert_not_called()
|
|
|
|
|
|
def test_changed_original_control_body_is_not_blessed_by_a_matching_epoch():
|
|
control, output, engine, binding = _boundary_objects()
|
|
engine.original_context_controls = {control.control_ns: replace(control, controller_chatter=True)}
|
|
with pytest.raises(ValueError, match='original context owner body'):
|
|
o.from_original(control, output, engine, binding, original_output=output)
|
|
engine.applied_matches.assert_not_called()
|
|
|
|
|
|
@pytest.mark.parametrize('changed', [{'native_allowed': False}, {'native_observed_ns': 0},
|
|
{'native_expires_ns': 1}, {'source_receipt_ns': 1}, {'generation': -1}])
|
|
def test_constructor_rejects_original_expired_native_source_or_generation_before_proof(changed):
|
|
control, output, engine, binding = _boundary_objects()
|
|
with pytest.raises(ValueError, match='lease/carrier'):
|
|
o.from_original(replace(control, **changed), output, engine, binding, original_output=output)
|
|
engine.applied_matches.assert_not_called()
|
|
|
|
|
|
@pytest.mark.parametrize('control_field,output_field', [
|
|
('saturated', None), ('model_wobble', None), ('controller_chatter', None),
|
|
('limited', None), (None, 'limited'),
|
|
])
|
|
def test_old_stage_command_verifier_retains_performance_veto(control_field, output_field):
|
|
from openpilot.starpilot.flm.source_plant_fit import _command
|
|
control, output, _, binding = _boundary_objects()
|
|
control = replace(control, **({control_field: True} if control_field else {}))
|
|
output = replace(output, limited=False, **({output_field: True} if output_field else {})) if output_field != 'limited' else replace(output, limited=True)
|
|
proof = Mock(return_value=True)
|
|
with pytest.raises(ValueError, match='plant actual endpoint'):
|
|
_command(control, output, SimpleNamespace(applied_matches=proof), binding)
|
|
proof.assert_not_called()
|