fix: cryptographically bind DGR-001 evidence

packages/node/meshnet_node/recipe_drivers.py

@@ -20,6 +20,7 @@ rules:
 
 from __future__ import annotations
 
+import base64
 import hashlib
 import hmac
 import json
@@ -27,15 +28,27 @@ import os
 import platform
 import re
 import socket
+import stat
 import subprocess
 import sys
 import tempfile
 import time
 import urllib.error
 import urllib.request
+import uuid
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any, Mapping
 
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from .performance_contract import (
+    PROVENANCE_SCHEMA_VERSION,
+    REAL_REPORT_PRODUCER,
+    _canonical_sha256,
+    report_signing_payload,
+)
 from .recipe_benchmark import (
     BenchmarkError,
     BenchmarkPlan,
@@ -50,6 +63,7 @@ from .recipe_benchmark import (
 )
 
 REAL_INFERENCE_ENV = "MESHNET_ENABLE_REAL_INFERENCE_TESTS"
+EVIDENCE_SIGNING_KEY_ENV = "MESHNET_EVIDENCE_SIGNING_KEY"
 
 
 def real_inference_enabled() -> bool:
@@ -64,6 +78,37 @@ def require_real_inference() -> None:
         )
 
 
+def _load_evidence_signing_key() -> Ed25519PrivateKey:
+    raw_path = os.environ.get(EVIDENCE_SIGNING_KEY_ENV)
+    if not raw_path:
+        raise BenchmarkError(
+            f"real evidence requires {EVIDENCE_SIGNING_KEY_ENV} to name an Ed25519 private key"
+        )
+    path = Path(raw_path).expanduser().resolve(strict=True)
+    if os.name != "nt" and stat.S_IMODE(path.stat().st_mode) != 0o600:
+        raise BenchmarkError("evidence signing key must have mode 0600")
+    key = serialization.load_pem_private_key(path.read_bytes(), password=None)
+    if not isinstance(key, Ed25519PrivateKey):
+        raise BenchmarkError("evidence signing key must be Ed25519")
+    return key
+
+
+def _utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _sign_report(report: dict[str, Any], key: Ed25519PrivateKey) -> None:
+    public_key = key.public_key().public_bytes(
+        serialization.Encoding.Raw, serialization.PublicFormat.Raw
+    )
+    report["provenance"]["signer_public_key_sha256"] = hashlib.sha256(
+        public_key
+    ).hexdigest()
+    report["provenance"]["signature"] = base64.b64encode(
+        key.sign(report_signing_payload(report))
+    ).decode("ascii")
+
+
 def _process_rss(pid: int | None = None) -> int:
     """Resident bytes for a process and its children, or 0 when unobservable."""
     try:
@@ -120,7 +165,7 @@ def _artifact_sha256(path: Path) -> str:
     return digest.hexdigest()
 
 
-def _host_manifest() -> dict[str, Any]:
+def _host_manifest(config: Mapping[str, Any] | None = None) -> dict[str, Any]:
     """Capture non-secret host facts with the report rather than trusting prose."""
     manifest: dict[str, Any] = {
         "hostname": socket.gethostname(),
@@ -142,6 +187,30 @@ def _host_manifest() -> dict[str, Any]:
             )
     except ImportError:
         manifest["torch_version"] = None
+
+    llama_identities: dict[str, dict[str, str]] = {}
+    for spec in (config or {}).get("recipes", ()):
+        driver = spec.get("driver", {})
+        if driver.get("type") != "llama-cpp-server":
+            continue
+        binary = Path(driver["binary"]).resolve(strict=True)
+        key = str(binary)
+        if key in llama_identities:
+            continue
+        version_result = subprocess.run(
+            [str(binary), "--version"],
+            check=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            text=True,
+            timeout=10,
+        )
+        llama_identities[key] = {
+            "sha256": _artifact_sha256(binary),
+            "version": " | ".join(version_result.stdout.strip().splitlines()),
+        }
+    if llama_identities:
+        manifest["llama_server_identities"] = llama_identities
     return manifest
 
 
@@ -635,6 +704,13 @@ def run_configured_benchmark(config: Mapping[str, Any]) -> dict:
     """
     require_real_inference()
     _validate_config(config)
+    evidence_class = config.get("evidence_class", "local-real")
+    if evidence_class not in {"local-real", "multi-machine-real"}:
+        raise BenchmarkError("canonical real runner cannot emit synthetic evidence")
+    signing_key = _load_evidence_signing_key()
+    started_at = _utc_now()
+    run_id = str(uuid.uuid4())
+    config_sha256 = _canonical_sha256(config)
     plan = _plan_from_config(config)
 
     from .recipe_benchmark import RecipeMeasurement  # local import keeps the seam obvious
@@ -656,9 +732,20 @@ def run_configured_benchmark(config: Mapping[str, Any]) -> dict:
             if driver is not None:
                 driver.close()
 
-    return build_report(
+    report = build_report(
         plan,
         measurements,
-        host={**dict(config.get("host", {})), **_host_manifest()},
-        evidence_class=config.get("evidence_class", "local-real"),
+        host={**dict(config.get("host", {})), **_host_manifest(config)},
+        evidence_class=evidence_class,
+        provenance={
+            "schema_version": PROVENANCE_SCHEMA_VERSION,
+            "producer": REAL_REPORT_PRODUCER,
+            "run_id": run_id,
+            "started_at": started_at,
+            "completed_at": _utc_now(),
+            "config_sha256": config_sha256,
+            "signature_algorithm": "ed25519",
+        },
     )
+    _sign_report(report, signing_key)
+    return report