Fingerprint Frontier source snapshots

runs/frontier-multicase-sufficiency-v0/best_effort/frontier_prefill_grid.py

@@ -90,39 +90,66 @@ def sha256_bytes(payload: bytes) -> str:
     return hashlib.sha256(payload).hexdigest()
 
 
-def frontier_source_fingerprint(source: Path) -> dict[str, Any]:
-    commit = subprocess.run(
-        ["git", "rev-parse", "HEAD"],
-        cwd=source,
-        check=True,
-        stdout=subprocess.PIPE,
-        text=True,
-    ).stdout.strip()
-    status = subprocess.run(
-        ["git", "status", "--porcelain=v1"],
-        cwd=source,
-        check=True,
-        stdout=subprocess.PIPE,
-        text=True,
-    ).stdout
-    diff = subprocess.run(
-        ["git", "diff", "--binary", "HEAD"],
-        cwd=source,
-        check=True,
-        stdout=subprocess.PIPE,
-    ).stdout
+def frontier_source_fingerprint(
+    source: Path, declared_commit: str
+) -> dict[str, Any]:
     model_config = source / "data" / "config" / "models" / f"{MODEL}.json"
     if not model_config.is_file():
         raise FileNotFoundError(f"Frontier model config is missing: {model_config}")
-    return {
-        "commit": commit,
-        "status_porcelain": status.splitlines(),
-        "tracked_diff_sha256": sha256_bytes(diff),
+    device_config = source / "data" / "config" / "device" / "h20.json"
+    files = sorted((source / "frontier").glob("**/*.py")) + [
+        model_config,
+        device_config,
+    ]
+    missing = [str(path) for path in files if not path.is_file()]
+    if missing:
+        raise FileNotFoundError(f"Frontier fingerprint inputs are missing: {missing}")
+    digest = hashlib.sha256()
+    for path in files:
+        relative = path.relative_to(source).as_posix()
+        digest.update(relative.encode() + b"\0")
+        digest.update(bytes.fromhex(sha256(path)))
+    fingerprint = {
+        "declared_upstream_commit": declared_commit,
+        "python_and_config_tree_sha256": digest.hexdigest(),
+        "fingerprinted_file_count": len(files),
         "model_config": {
             "path": str(model_config.resolve()),
             "sha256": sha256(model_config),
         },
     }
+    git_dir = source / ".git"
+    if git_dir.exists():
+        commit = subprocess.run(
+            ["git", "rev-parse", "HEAD"],
+            cwd=source,
+            check=True,
+            stdout=subprocess.PIPE,
+            text=True,
+        ).stdout.strip()
+        status = subprocess.run(
+            ["git", "status", "--porcelain=v1"],
+            cwd=source,
+            check=True,
+            stdout=subprocess.PIPE,
+            text=True,
+        ).stdout
+        diff = subprocess.run(
+            ["git", "diff", "--binary", "HEAD"],
+            cwd=source,
+            check=True,
+            stdout=subprocess.PIPE,
+        ).stdout
+        fingerprint.update(
+            {
+                "git_commit": commit,
+                "status_porcelain": status.splitlines(),
+                "tracked_diff_sha256": sha256_bytes(diff),
+            }
+        )
+    else:
+        fingerprint["git_metadata"] = "absent_source_snapshot"
+    return fingerprint
 
 
 def anchor_key(anchor: float) -> str:
@@ -550,7 +577,9 @@ def run_grid(args: argparse.Namespace) -> None:
         "frontier": {
             "source": str(args.frontier_source.resolve()),
             "python": str(args.python.resolve()),
-            "fingerprint": frontier_source_fingerprint(args.frontier_source),
+            "fingerprint": frontier_source_fingerprint(
+                args.frontier_source, args.frontier_commit
+            ),
         },
         "trace_manifest": {
             "path": str(args.trace_manifest.resolve()),
@@ -675,6 +704,10 @@ def parse_args() -> argparse.Namespace:
 
     run = subparsers.add_parser("run")
     run.add_argument("--frontier-source", type=Path, required=True)
+    run.add_argument(
+        "--frontier-commit",
+        default="d9cfeb6d8791fbf2f295dd9744c56a666171776e",
+    )
     run.add_argument("--python", type=Path, required=True)
     run.add_argument("--profile-root", type=Path, required=True)
     run.add_argument("--trace-manifest", type=Path, required=True)