p1 bootstrap v2: licenses key required; existence != privacy; stage in /tmp

probes/p1_secret_bootstrap.py

@@ -1,23 +1,23 @@
 # Phase 1 bootstrap worker: create a PRIVATE Kaggle dataset to hold the HF token, safely.
 #
-# Why this exists (closes D-002). §2 permits the token to come "from the environment or a secret
-# store" and forbids it reaching a public artifact. p1_credential_path proved the Kaggle CLI is
-# preinstalled and already authenticated inside an internet-enabled session, so a job can create its
-# own private dataset and later jobs can mount it from /kaggle/input instead of carrying the token in
-# their source.
+# Why (closes D-002): §2 permits "the environment or a secret store" and forbids the token reaching a
+# public artifact. p1_credential_path showed the Kaggle CLI is preinstalled and pre-authenticated
+# inside an internet-enabled session, so a job can create its own private dataset and later jobs can
+# mount it from /kaggle/input instead of carrying the token in their source.
 #
-# THE ORDERING HERE IS A SECURITY CONTROL, NOT STYLE. `kaggle datasets create` decides visibility
-# from a metadata field whose name has varied between CLI versions (isPrivate vs defineIsPrivate), and
-# an unrecognised key is silently ignored -- which would create a PUBLIC dataset. A public dataset
-# containing the token would be an unrecoverable leak, so:
+# v1 FAILED, and the failure taught two things that are encoded here:
+#   * `kaggle datasets create` on CLI 2.0.2 aborts with "Key licenses not found in data" unless
+#     dataset-metadata.json carries a `licenses` array. Nothing was created, so nothing leaked.
+#   * worse, my privacy gate was NOT discriminating: it treated an anonymous 403 as "private", but a
+#     403 is also what a NON-EXISTENT dataset returns. So v1 reported private_confirmed=true for a
+#     dataset that did not exist. Existence and privacy are now proved by two different calls, and
+#     privacy is only asserted when the dataset is known to exist.
 #
-#   1. create with an inert placeholder file only,
-#   2. PROVE it is private by failing to download that file anonymously,
-#   3. only then push the real credential as a new version,
-#   4. re-prove, and delete nothing that was not created here.
+# Staging lives under /tmp, never /kaggle/working: files in the working directory are published as
+# kernel output artifacts, and v1 briefly wrote the credential there. It stayed behind private-kernel
+# auth, but there is no reason for a secret to be an output artifact at all.
 #
-# If step 2 ever shows anonymous read succeeding, the secret is never uploaded and the job says so.
-# No token value is ever printed; kernel stdout is retained. Zero GPU quota (CPU session).
+# No token value is ever printed. Zero GPU quota (CPU session).
 
 import hashlib
 import json
@@ -31,7 +31,7 @@ R = {}
 DS_SLUG = "ounce100m-secret-store"
 DS_ID = f"dodosoomro/{DS_SLUG}"
 TOKEN_ENV = "OUNCE100M_HF_TOKEN"
-DS_DIR = "/kaggle/working/ds"
+DS_DIR = "/tmp/ounce100m_ds"  # outside /kaggle/working on purpose -- see header
 PLACEHOLDER = "placeholder.txt"
 SECRET_FILE = "credentials.json"
 
@@ -49,44 +49,54 @@ def run(cmd, timeout=300):
     return {"rc": p.returncode, "out": scrub(p.stdout), "err": scrub(p.stderr)}
 
 
-def anon_can_read(path):
-    """True only if an unauthenticated request can fetch the file. That means PUBLIC -- bad."""
+def exists_authenticated():
+    """A successful *authenticated* listing proves the dataset exists."""
+    r = run(f"kaggle datasets files {DS_ID} 2>&1", 120)
+    return {"rc": r["rc"], "out": r["out"][:400], "exists": r["rc"] == 0}
+
+
+def anon_access():
+    """Classify anonymous reachability. Only HTTP 200 means PUBLIC-and-leaking. 404 means the dataset
+    is not there at all, which is NOT evidence of privacy."""
     url = f"https://www.kaggle.com/api/v1/datasets/download/{DS_ID}"
     try:
         with urllib.request.urlopen(url, timeout=60) as r:
-            return {"readable": True, "status": r.status, "bytes": len(r.read(2048))}
+            return {"status": r.status, "verdict": "PUBLIC"}
     except urllib.error.HTTPError as e:
-        return {"readable": False, "status": e.code, "reason": str(e.reason)[:80]}
+        return {"status": e.code,
+                "verdict": "PRIVATE" if e.code in (401, 403) else "OTHER_HTTP"}
     except Exception as e:
-        return {"readable": None, "error": f"{type(e).__name__}: {e}"[:160]}
+        return {"error": f"{type(e).__name__}: {e}"[:160], "verdict": "UNKNOWN"}
 
 
-def write_metadata(private=True):
-    """Both spellings of the visibility key, because the CLI version in the image is 2.0.2 and the
-    field name has moved across releases; an unrecognised key is ignored without error."""
-    md = {
-        "title": "ounce100m runtime assets",
-        "id": DS_ID,
-        "resources": [{"path": PLACEHOLDER, "description": "bootstrap placeholder",
-                       "resourceName": "placeholder", "resourceType": "dataset"}],
-    }
-    if private:
-        md["isPrivate"] = True
-        md["defineIsPrivate"] = True
-    with open(os.path.join(DS_DIR, "dataset-metadata.json"), "w") as f:
-        json.dump(md, f)
-
-
-def write_files(with_secret):
+def write_metadata(with_secret):
     os.makedirs(DS_DIR, exist_ok=True)
     with open(os.path.join(DS_DIR, PLACEHOLDER), "w") as f:
         f.write("ounce100m bootstrap placeholder\n")
     if with_secret:
-        tok = os.environ[TOKEN_ENV]
         with open(os.path.join(DS_DIR, SECRET_FILE), "w") as f:
-            json.dump({"HF_TOKEN": tok}, f)
+            json.dump({"HF_TOKEN": os.environ[TOKEN_ENV]}, f)
         os.chmod(os.path.join(DS_DIR, SECRET_FILE), 0o600)
 
+    resources = [{"path": PLACEHOLDER, "description": "bootstrap placeholder",
+                  "resourceName": "placeholder", "resourceType": "dataset"}]
+    if with_secret:
+        resources.append({"path": SECRET_FILE, "description": "runtime credentials",
+                          "resourceName": "credentials", "resourceType": "dataset"})
+    md = {
+        "title": "ounce100m runtime assets",
+        "id": DS_ID,
+        # CLI 2.0.2 refuses to create without this key -- the exact fault that stopped v1.
+        "licenses": [{"name": "other"}],
+        "resources": resources,
+        # Both historical spellings of the visibility flag: an unrecognised key is ignored silently,
+        # and a silently-ignored key here would mean a public dataset holding a credential.
+        "isPrivate": True,
+        "defineIsPrivate": True,
+    }
+    with open(os.path.join(DS_DIR, "dataset-metadata.json"), "w") as f:
+        json.dump(md, f)
+
 
 tok = os.environ.get(TOKEN_ENV, "")
 R["pre"] = {"token_present": bool(tok), "token_length": len(tok),
@@ -95,44 +105,52 @@ R["pre"] = {"token_present": bool(tok), "token_length": len(tok),
 if not tok:
     R["fatal"] = f"{TOKEN_ENV} unset; nothing created"
 else:
-    write_files(with_secret=False)
-    write_metadata(private=True)
-
-    existing = run(f"kaggle datasets status {DS_ID} 2>&1", 120)
-    R["pre_existing_status"] = existing
-    already = existing["rc"] == 0
-
-    if not already:
+    write_metadata(with_secret=False)
+    if not exists_authenticated()["exists"]:
         t = time.monotonic()
         R["create"] = run(f"kaggle datasets create -p {DS_DIR} -q 2>&1", timeout=600)
         R["create"]["seconds"] = round(time.monotonic() - t, 1)
-        time.sleep(12)  # visibility is applied asynchronously; an immediate probe can lie
+        time.sleep(15)
 
-    # ---- the gate: prove privacy BEFORE any secret exists on the dataset
-    privacy = anon_can_read(PLACEHOLDER)
-    R["privacy_check_placeholder_only"] = privacy
-    R["private_confirmed"] = privacy.get("readable") is False
+    # Gate 1: does it exist? (authenticated)  Gate 2: is it unreachable anonymously?
+    ex = exists_authenticated()
+    R["existence"] = ex
+    priv = anon_access() if ex["exists"] else {"verdict": "SKIPPED_NOT_EXISTING"}
+    R["privacy_placeholder_only"] = priv
+    R["safe_to_upload_secret"] = bool(ex["exists"]) and priv["verdict"] == "PRIVATE"
 
-    if R["private_confirmed"]:
-        write_files(with_secret=True)
+    if R["safe_to_upload_secret"]:
+        write_metadata(with_secret=True)
         t = time.monotonic()
         R["version_with_secret"] = run(
             f'kaggle datasets version -p {DS_DIR} -m "provision runtime credential" -q 2>&1',
             timeout=600)
         R["version_with_secret"]["seconds"] = round(time.monotonic() - t, 1)
-        time.sleep(12)
-        after = anon_can_read(SECRET_FILE)
-        R["privacy_check_after_secret"] = after
-        R["secret_still_private"] = after.get("readable") is False
+        time.sleep(15)
+        after = anon_access()
+        R["privacy_after_secret"] = after
+        R["secret_still_private"] = after["verdict"] == "PRIVATE"
         if not R["secret_still_private"]:
-            R["EMERGENCY"] = ("Anonymous read succeeded AFTER the credential was uploaded -- the "
-                              "dataset may be public. Delete dodosoomro/ounce100m-secret-store from "
-                              "the Kaggle web UI immediately and rotate the HF token.")
+            R["EMERGENCY"] = ("Anonymous read works AFTER the credential upload: delete "
+                              f"{DS_ID} from the Kaggle web UI now and rotate the HF token.")
+        # A public dataset would also show up in the public search index -- independent second check.
+        R["public_search_check"] = scrub(
+            urllib.request.urlopen(
+                f"https://www.kaggle.com/api/v1/datasets/list?public=true&user=dodosoomro"
+                f"&search=ounce100m", timeout=60).read().decode()[:400])
     else:
-        R["refused_to_upload"] = ("Dataset was anonymously readable while holding only a placeholder; "
-                                  "the secret was NOT uploaded. Fix visibility handling before retry.")
+        R["refused_to_upload"] = {
+            "reason": "existence or privacy not positively established",
+            "existence_rc": ex["rc"], "privacy": priv,
+            "create_output": R.get("create", {}).get("out"),
+        }
 
-    R["files"] = run(f"kaggle datasets files {DS_ID} 2>&1", 120)
+    # Remove the staged credential from disk regardless of outcome, then report what is left.
+    if os.path.exists(os.path.join(DS_DIR, SECRET_FILE)):
+        os.remove(os.path.join(DS_DIR, SECRET_FILE))
+    R["staging_after"] = {"secret_removed": not os.path.exists(os.path.join(DS_DIR, SECRET_FILE)),
+                          "dir_listing": sorted(os.listdir(DS_DIR)),
+                          "working_dir_listing": sorted(os.listdir("/kaggle/working"))}
     if R.get("secret_still_private"):
         R["mount_hint_for_future_jobs"] = {
             "datasetDataSources": [DS_ID],