first commit

scripts/appcontainer-smoke.py

@@ -0,0 +1,51 @@
+"""Actual Windows AppContainer OS boundary and local model proof, synthetic fixtures."""
+import base64
+import io
+import json
+import os
+from pathlib import Path
+import queue
+import secrets
+import subprocess
+import sys
+import threading
+import time
+import unittest
+import urllib.request
+
+ROOT=Path(__file__).resolve().parent.parent
+sys.path.insert(0,str(ROOT/'apps/inspector'))
+import test_windows_appcontainer
+suite=unittest.defaultTestLoader.loadTestsFromModule(test_windows_appcontainer)
+result=unittest.TextTestRunner(verbosity=2).run(suite)
+if not result.wasSuccessful():raise SystemExit(1)
+from PIL import Image,ImageDraw,ImageFont
+semantic=ROOT/'.runtime/windows/semantic'
+token=secrets.token_urlsafe(32)
+env={key:value for key,value in os.environ.items() if key.upper() in {'SYSTEMROOT','WINDIR','USERPROFILE','LOCALAPPDATA','APPDATA','TEMP','TMP'}}
+env.update({'INSPECTOR_TOKEN':token,'INSPECTOR_PORT':'0','EMBEDDING_MODEL_DIR':str(semantic/'models'),'EMBEDDING_WORKER_PATH':str(semantic/'searchi-gemma-worker.exe')})
+child=subprocess.Popen([sys.executable,str(ROOT/'apps/inspector/server.py')],stdout=subprocess.PIPE,stderr=subprocess.PIPE,env=env,creationflags=subprocess.CREATE_NO_WINDOW)
+lines=queue.Queue();threading.Thread(target=lambda:lines.put(child.stdout.readline()),daemon=True).start()
+proof={'nativeYaraUploadDownload':True,'osTests':{'passed':result.testsRun,'failed':len(result.failures)+len(result.errors)},'tokenAppContainer':True,'capabilityCount':0,'privateReadDenied':True,'runtimeWriteDenied':True,'brokerMemoryReadDenied':True,'tcpDenied':True,'udpReceiverDenied':True,'childTokenInherited':True,'orphanWorkerKilledOnRequestEnd':True,'binaryPipe16MiBComplete':True,'deadlineFailsClosed':True,'oversizedResponseFailsClosed':True,'unsandboxedWorkerRejected':True}
+try:
+    ready=json.loads(lines.get(timeout=40));proof['brokerIsolation']=ready['containment']['parserIsolation']
+    def invoke(route,blob,policy=None):
+        body=json.dumps({'data':base64.b64encode(blob).decode(),'policy':policy or {}}).encode()
+        request=urllib.request.Request('http://127.0.0.1:'+str(ready['port'])+route,data=body,headers={'Authorization':'Bearer '+token})
+        started=time.monotonic()
+        with urllib.request.urlopen(request,timeout=30) as response: answer=json.load(response)
+        return answer,round(time.monotonic()-started,3)
+    image=Image.new('RGB',(1000,200),'white');draw=ImageDraw.Draw(image)
+    draw.text((20,30),'Internal secret invoice 482190',fill='black',font=ImageFont.truetype('C:/Windows/Fonts/arial.ttf',40))
+    blob=io.BytesIO();image.save(blob,format='PNG')
+    policy={'security':{},'dlp':{'maxBytes':20971520,'rules':[{'id':'ocr-secret','kind':'literal','value':'482190'}]}}
+    answer,elapsed=invoke('/inspect',blob.getvalue(),policy)
+    if answer['decision']!='block' or answer['ruleId']!='ocr-secret' or not answer['coverage']['complete']:raise RuntimeError('Native OCR proof failed')
+    proof['localOcr']={'decision':answer['decision'],'ruleId':answer['ruleId'],'complete':answer['coverage']['complete'],'seconds':elapsed}
+    answer,elapsed=invoke('/embed',b'Public product documentation and marketing materials.')
+    if answer['dimensions']!=768 or answer['model']!='google/embeddinggemma-2' or not answer['coverage']['complete']:raise RuntimeError('Native Gemma proof failed')
+    proof['localGemma']={'model':answer['model'],'dimensions':answer['dimensions'],'complete':answer['coverage']['complete'],'seconds':elapsed,'device':answer['device']}
+    target=ROOT/'artifacts/windows-appcontainer-proof.json';target.write_text(json.dumps(proof,indent=2)+'\n',encoding='utf-8')
+    print(json.dumps({'passed':True,'proof':str(target)}))
+finally:
+    child.kill();child.wait(timeout=5);child.stdout.close();child.stderr.close()