scripts/package_server_evidence.py

#!/usr/bin/env python3
"""Package completed hosted Server-mode checks, including recorded failures."""
import hashlib
import json
import csv
from pathlib import Path
import re
import shutil

ROOT = Path(__file__).resolve().parents[1]
DEST = ROOT / 'evidence/server-ui'
DEST.mkdir(parents=True, exist_ok=True)

for result in sorted((ROOT / 'artifacts/server-ui').glob('*/observations.json')):
    shutil.copytree(result.parent, DEST / result.parent.name, dirs_exist_ok=True)
for name in ['20260921T074025-smoke']:
    shutil.copytree(ROOT / 'artifacts/benchmarks' / name, DEST / 'benchmarks' / name, dirs_exist_ok=True)
for result in sorted((ROOT / 'artifacts/validation').glob('20260921T*/results.json')):
    if result.parent.name >= '20260921T075143':
        target = DEST / 'validation' / result.parent.name
        target.mkdir(parents=True, exist_ok=True)
        shutil.copy2(result, target / result.name)
(DEST / 'logs').mkdir(exist_ok=True)
for path in (ROOT / 'artifacts/logs').glob('server-mode*'):
    if path.is_file():
        shutil.copy2(path, DEST / 'logs' / path.name)
shutil.copy2(ROOT / 'artifacts/redesign/inference-preservation.json', DEST / 'inference-preservation.json')
for path in (ROOT/'artifacts/release').glob('*.json'):
    (DEST/'release').mkdir(exist_ok=True)
    shutil.copy2(path,DEST/'release'/path.name)

# One row per generated image. Replayed examples and duplicate downloads never
# inflate the model-call count. A failed UI phase may still contain a real image.
measurements=[]
seen=set()
for observations in sorted(DEST.glob('*/observations.json')):
    run=json.loads(observations.read_text())
    for recipe in sorted(observations.parent.glob('*.json')):
        record=json.loads(recipe.read_text())
        if not isinstance(record,dict) or record.get('model')!='Qwen/Qwen-Image-2.1' or record['id'] in seen:
            continue
        seen.add(record['id']);metrics=record['metrics'];parameters=record['parameters']
        measurements.append({'recipe':recipe.relative_to(DEST).as_posix(),'id':record['id'],
            'hub_commit':run['hub_commit'],'ui_run_status':run['status'],'source_sha256':record['source_sha256'],
            'width':parameters['width'],'height':parameters['height'],'steps':parameters['steps'],
            'seed':parameters['seed'],'has_reference':record['reference_pixel_sha256'] is not None,
            'inference_seconds':metrics['inference_seconds'],'gpu_call_seconds':metrics['gpu_call_wall_seconds'],
            'peak_allocated_bytes':metrics['gpu']['peak_allocated_bytes'],
            'boot_id':record['boot_id'],'request_index':record['request_index_in_boot'],
            'gpu_worker_pid':metrics['gpu_worker_pid'],'gpu_worker_call_index':metrics['gpu_worker_call_index']})
if measurements:
    with (DEST/'browser-generations.csv').open('w',newline='') as handle:
        writer=csv.DictWriter(handle,fieldnames=list(measurements[0]));writer.writeheader();writer.writerows(measurements)

rows = []
for path in sorted(DEST.rglob('*')):
    if not path.is_file() or path.name in {'files.json', 'README.md'}:
        continue
    data = path.read_bytes()
    if path.suffix not in {'.png', '.jpg', '.webp'}:
        # Inspect only for credential material, never print a matched value.
        if re.search(rb'hf_[A-Za-z0-9]{20,}|Bearer\s+[A-Za-z0-9._-]{20,}|__sign=|eyJ[A-Za-z0-9_-]{20,}\.', data):
            raise SystemExit(f'Credential-shaped material needs review: {path.relative_to(ROOT)}')
    rows.append({'path': path.relative_to(DEST).as_posix(), 'bytes': len(data),
                 'sha256': hashlib.sha256(data).hexdigest()})
(DEST / 'files.json').write_text(json.dumps(rows, indent=2) + '\n')
print(f'Packaged {len(rows)} audited files in {DEST}')