import hashlib,itertools,json
from fractions import Fraction
SLUG='build-provenance-trust'
def build(source,path,epoch,normalize=False):
    value=dict(source=source,path='/canonical/build' if normalize else path,epoch=1700000000 if normalize else epoch)
    return json.dumps(value,sort_keys=True,separators=(',',':')).encode('utf-8')
def digest(data):return hashlib.sha256(data).hexdigest()
def probability(n,p,c):return c+(1-c)*p**n
def enumerate_probability(n,p,c):
    total=Fraction(0)
    for bits in itertools.product([False,True],repeat=n):
        weight=Fraction(1)
        for b in bits:weight*=p if b else 1-p
        if all(bits):total+=weight
    return c+(1-c)*total

def run():
    envs=[('/build/'+str(i),1700000100+i) for i in range(8)]
    raw=[build('source-v1',p,t) for p,t in envs]
    norm=[build('source-v1',p,t,True) for p,t in envs]
    count_cases=[(n,Fraction(p,10),Fraction(c,100)) for n in range(1,9) for p in [0,1,5,10] for c in [0,1,100]]
    prob_ok=all(probability(n,p,c)==enumerate_probability(n,p,c) for n,p,c in count_cases)
    checks=[dict(name='Raw artifact matches an independently stated byte fixture',passed=raw[0]==b'{"epoch":1700000100,"path":"/build/0","source":"source-v1"}' and raw[0]==build('source-v1','/build/0',1700000100),cases=1,detail='Known serialized bytes and a repeated build; no external clock reads.'),dict(name='Normalization removes selected environment differences',passed=len(set(raw))==8 and len(set(norm))==1,cases=8,detail='Raw paths/timestamps vary; canonical fields fixed by declared model.'),dict(name='Normalization remains sensitive to meaningful source changes',passed=all(build('source-v1',p,t,True)!=build('source-v2',p,t,True) for p,t in envs),cases=8,detail='Negative control prevents a constant-output pseudo-build.'),dict(name='Mixture formula equals explicit compromise-state enumeration',passed=prob_ok,cases=len(count_cases),detail='Exact Fraction arithmetic across n=1..8 and boundary probabilities.'),dict(name='Common-mode floor and monotonicity',passed=all(probability(n+1,Fraction(1,10),Fraction(1,100))<=probability(n,Fraction(1,10),Fraction(1,100)) for n in range(1,8)) and probability(3,Fraction(1,10),Fraction(1,100))==Fraction(1099,100000),cases=8,detail='Joint all-malicious-and-matching event, not a posterior given agreement.')]
    ns=list(range(1,9));p=Fraction(1,10)
    return dict(slug=SLUG,checks=checks,figures=[dict(id='environment-determinism',title='Distinct outputs under controlled environment variation',x_label='Number of environment variants',y_label='Distinct artifact digests',series=[dict(name='Raw path and timestamp',x=ns,y=[len({digest(a) for a in raw[:n]}) for n in ns]),dict(name='Declared normalization',x=ns,y=[len({digest(a) for a in norm[:n]}) for n in ns])],caption='Eight constructed path/time variants give eight raw outputs and one normalized output; source-change controls still differ.',assumptions=['Toy JSON build serializer','Fixed source identity','Only selected fields normalized'],kind='Constructed analytical model; not a measured benchmark'),dict(id='shared-compromise',title='Shared failure limits the benefit of additional rebuilders',x_label='Number of rebuilders',y_label='Modeled joint probability',series=[dict(name='Independent only: c=0',x=ns,y=[float(probability(n,p,Fraction(0))) for n in ns]),dict(name='Shared channel: c=0.01',x=ns,y=[float(probability(n,p,Fraction(1,100))) for n in ns])],caption='Illustrative p=0.1; at n=3 the probabilities are 0.001 and 0.01099. No real risk estimate or posterior is implied.',assumptions=['Common event makes all artifacts identically malicious','Otherwise independent identical-malicious probability p','Parameters are illustrative'],kind='Constructed analytical model; not a measured benchmark')],result_summary=dict(environment_variants=8,raw_unique_outputs=len(set(raw)),normalized_unique_outputs=len(set(norm)),independent_n3=float(probability(3,p,Fraction(0))),shared_n3=float(probability(3,p,Fraction(1,100))),common_mode_floor=0.01))
if __name__=='__main__':print(json.dumps(run(),indent=2))