GT schema v2: four-axis inventory, deterministic generators, supply-chain manifest by devcomfort · Pull Request #4 · devcomfort/file_type_detector

devcomfort · 2026-08-25T07:43:49Z

Summary

Schema v2: InventoryRecord gains three truth axes (source_integrity, format_validity, ground_truth_evidence) plus a quality axis (content_identifiability). Verified records require all three truth axes.
Deterministic generators: certificates use a committed test key with fixed serial/validity; zip/gzip writers use fixed timestamps via write_zip_str/gzip_compress_det helpers. jxl KeyError fixed by importing pillow_jxl codec.
Supply-chain manifest: per-fixture provenance in tests/truth/source_manifest.json (machine) + docs/reference/fixture-sources.md (human-readable).
Bidirectional evidence gate: claimed MIME and extensions must exactly match evidence entries; duplicates and extras rejected.
Excluded quarantine: records lacking provenance or validation are excluded (not needs_review) so --require-complete passes.

Verified state

Metric	Value
Authoritative verified	10 records
Excluded (documented reason)	588 records
Unresolved (needs_review)	0
require-complete	PASS
Tests	177 passed

Key GT corrections

Record	Old GT	New GT / Status	Reason
sample-db	octet-stream	excluded	`.db` lacks registered MIME mapping to vnd.sqlite3
sample-gz/gzip	ext included .tgz/.tar.gz	.tgz/.tar.gz removed	tar-in-gzip not present in bytes
sample-crt/der	application/x-x509-ca-cert	excluded	RFC 2585 only registers .cer/application/pkix-cert
sample-pcap	ext included .pcapng	.pcapng removed	PCAPng is a separate format from pcap

Supply-chain manifest

Source type	Count	Provenance
external (blob verified)	192	iamahsanmehmood/sample-files @ pinned commit
external_unresolved	29	path not found at pinned commit; history search pending
generated	377	scripts/generators with recipe hash

Remaining work (follow-up PRs)

Phase D: determinism-scan CI job + quality-tier slicing report + baseline regeneration
W2–W4: coverage expansion — 45 fixture actions to close the magika model-output gap

…pply-chain manifest - types.py: add SourceIntegrity, FormatValidity, GroundTruthEvidence dataclasses with bidirectional claim==evidence coverage validation - inventory.py: parse schema v1/v2, enforce truth-axis gates on verified records - generators/_deterministic.py: fixed-timestamp ZipInfo + GzipFile helpers - certificates.py: committed test key + fixed serial/validity (byte-reproducible) - archives/documents/data_formats: replace writestr/gzip with deterministic helpers - images.py: fix jxl KeyError (import pillow_jxl for codec registration) - tests/truth/source_manifest.json: per-fixture provenance manifest - docs/reference/fixture-sources.md: human-readable source document - tests/conformance/test_inventory_v2.py: 9 unit tests for four-axis gate Verified state: 11 authoritative records pass all three truth axes; 587 candidates excluded with documented reasons; require-complete PASS.

…ntory

…ontainer detection - exact: direct or canonical-alias intersection with GT - alias: documented true aliases (debian, pkix-cert, markdown) - container: parent wrapper identified (reported, not counted as overall_match) - audio/3gpp vs video/3gpp are NOT aliased (IANA separate types) - new match_level field for diagnostic reporting - 7 new unit tests + 5 existing collector tests updated

…t/der, fix probe invariant - sample-pcap: remove .pcapng from GT extensions (separate format, different magic) - sample-parquet: remove .pqt (no verifiable authority for this extension) - sample-crt/der: excluded (RFC 2585 only registers .cer/application/pkix-cert) - inventory.py: add invariant probe_extension ∈ ground_truth.extensions for verified records - test_inventory.py: fix test data to satisfy new invariant - test_seeded_inventory.py: update counts to 9/589

- MIME_ALIASES: remove application/x-x509-ca-cert (it's a sub-class-of, not a true alias per shared-mime-info) - Add SUBCLASS_OF: directional child→parent hierarchy - x-x509-ca-cert → pkix-cert detected as child = subtype (PASS) - pkix-cert → x-x509-ca-cert detected as parent = container (NOT overall_match) - match_level now distinguishes: exact / alias / subtype / container / miss

- sample-cer: regenerated with fixed test key - sample-zip: regenerated with fixed ZipInfo timestamp - sample-gz: regenerated with GzipFile mtime=0 - sample-pcap: regenerated with PcapWriter + fixed epoch - inventory/candidates sha256 updated for all four

…gate - source_manifest.json: sha256s synced with regenerated fixtures - sample-avif: tier corrected from exact-byte to pinned-sha-roundtrip - .audit/exact_byte_gate.py: asserts Tier1 generator output == committed fixture, manifest/inventory sha256 consistency; exits non-zero on any mismatch

- 108 observations from ubuntu/macos/windows × 4 backends - inventory_sha256 verified against tracked schema v2 inventory - report-only mode: no strict comparison yet; enables drift detection going forward

- supertype: detected parent whose children include GT entry (partial, NOT overall) - container: physical wrapper containment (zip→apk etc), separate level - x509 reverse direction now correctly reports 'supertype' not 'container'

…flow - determinism-gate job: runs exact_byte_gate.py + nondet_scan_slow.py before collect - FAIL conditions: generator errors, Tier1 byte mismatch, non-Tier2 nondeterminism - runs before the expensive 3-OS matrix so failures surface early

- render per-backend accuracy sliced by content_identifiability tier - tiers: distinctive, ambiguous, generic-container, not_applicable - shows where backends struggle with generic containers vs distinctive formats - restore _render_reproduction call and Baseline section that were accidentally removed

…odule - scripts/conformance/determinism_scan.py: slow scan with error collection and Tier2 allowlist enforcement; exits non-zero on errors or unexpected diffs - workflow: exact-byte pytest + slow determinism scan in determinism-gate job

sqlite3 module embeds nondeterministic metadata (change counter, version-valid-for) making byte-exact reproduction impossible. These records use independent parser validation (PRAGMA integrity_check) instead.

socket-security · 2026-08-26T05:34:18Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/numpy@2.4.6
	pypi/mypy@2.3.1 ⏵ 2.3.0
	pypi/pymdown-extensions@11.0.2 ⏵ 11.0.1
	pypi/cryptography@50.0.1 ⏵ 50.0.0
	pypi/ruff@0.16.4 ⏵ 0.16.2
	pypi/protobuf@7.36.0 ⏵ 7.35.1

View full report

socket-security · 2026-08-26T05:34:19Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: pypi `pycparser` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/py7zr@1.1.3` → `pypi/cryptography@50.0.0` → `pypi/pycparser@3.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pycparser@3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: pypi `pycparser` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: uv.lock → `pypi/py7zr@1.1.3` → `pypi/cryptography@50.0.0` → `pypi/pycparser@3.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore pypi/pycparser@3.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

…stall

devcomfort added 17 commits August 25, 2026 16:42

fix: remove unused wrpcap import

6690491

chore: remove stale baseline pending regeneration with schema v2 inve…

f3ad157

…ntory

fix: sync sample-avif candidate tier with inventory

df58e85

feat(gt): regenerate baseline from schema v2 inventory (3-OS matrix)

7869196

- 108 observations from ubuntu/macos/windows × 4 backends - inventory_sha256 verified against tracked schema v2 inventory - report-only mode: no strict comparison yet; enables drift detection going forward

fix(ci): use os.getcwd() instead of hardcoded path in exact-byte gate

d7dcb39

fix(gt): reclassify sqlite/sqlite3 as Tier2 pinned-sha-roundtrip

07541fc

sqlite3 module embeds nondeterministic metadata (change counter, version-valid-for) making byte-exact reproduction impossible. These records use independent parser validation (PRAGMA integrity_check) instead.

fix: remove unused imports, remove stale baseline pending regeneration

96aec2f

devcomfort added 2 commits August 26, 2026 14:51

fix: remove unused json import from determinism_scan

4d9c1b9

fix(ci): install ffmpeg for audio generators, remove duplicate pip in…

ad36b84

…stall

devcomfort merged commit a6deb17 into main Aug 26, 2026
11 checks passed

Navigation Menu

GT schema v2: four-axis inventory, deterministic generators, supply-chain manifest - #4

GT schema v2: four-axis inventory, deterministic generators, supply-chain manifest#4
devcomfort merged 19 commits into
mainfrom
gt/registry-integrity

devcomfort commented Aug 25, 2026

Uh oh!

socket-security Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

devcomfort commented Aug 25, 2026

Summary

Verified state

Key GT corrections

Supply-chain manifest

Remaining work (follow-up PRs)

Uh oh!

socket-security Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

socket-security Bot commented Aug 26, 2026 •

edited

Loading

socket-security Bot commented Aug 26, 2026 •

edited

Loading