fix(oracle): classify every oracle invocation

.github/actions/ci-fixtures/action.yml

@@ -11,7 +11,9 @@ runs:
         helpers=$(grep -o '\$SCRIPTS/[A-Za-z0-9_.-]*' scripts/gen-fixtures.sh | sed 's|^\$SCRIPTS/|scripts/|' | sort -u)
         support=$(python3 -I -B -c 'import sys; sys.path.insert(0, "scripts"); from test_oracle import SUPPORT; print(" ".join("scripts/" + name for name in SUPPORT))')
         identity="$(cat scripts/gen-fixtures.sh scripts/install-oracle-ffmpeg.sh scripts/oracle-ffmpeg.env $helpers $support | sha256sum | cut -c1-32)"
+        composed="$(cat docs/design/composed-opus-aac-v2.json scripts/composed_audio.py scripts/composed_audio_fixtures.py scripts/install-oracle-ffmpeg.sh $support | sha256sum | cut -c1-32)"
         echo "key=linux-x64-fixtures-$identity" >> "$GITHUB_OUTPUT"
+        echo "composed=linux-x64-composed-$composed" >> "$GITHUB_OUTPUT"
     - name: Restore the fixtures
       id: fixtures
       uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
@@ -23,7 +25,7 @@ runs:
       uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: ${{ runner.temp }}/coreav-composed-fixtures
-        key: linux-x64-composed-${{ hashFiles('docs/design/composed-opus-aac-v2.json', 'scripts/composed_audio.py', 'scripts/composed_audio_fixtures.py', 'scripts/oracle_audio.py', 'scripts/oracle-audio-args.txt', 'scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }}
+        key: ${{ steps.key.outputs.composed }}
     - name: Cache pinned black-box binaries
       if: steps.fixtures.outputs.cache-hit != 'true' || steps.composed.outputs.cache-hit != 'true'
       id: ffmpeg-cache
@@ -50,8 +52,21 @@ runs:
       if: steps.composed.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        python3 -I scripts/composed_audio_fixtures.py \
-          --ffmpeg "$RUNNER_TEMP/coreav-oracle-bin/ffmpeg" --out "$RUNNER_TEMP/coreav-composed-fixtures"
+        url=$(python3 -I -c 'import json; print(json.load(open("docs/design/composed-opus-aac-v2.json"))["opus_compare"]["url"])')
+        rm -rf "$RUNNER_TEMP/coreav-composed-fixtures"
+        for attempt in 1 2 3; do
+          if python3 -I scripts/composed_audio_fixtures.py \
+              --ffmpeg "$RUNNER_TEMP/coreav-oracle-bin/ffmpeg" --out "$RUNNER_TEMP/coreav-composed-fixtures"; then
+            exit 0
+          fi
+          rm -rf "$RUNNER_TEMP/coreav-composed-fixtures"
+          status=0
+          probe=$(curl --silent --show-error --location --proto =https --proto-redir =https --connect-timeout 15 \
+            --max-time 60 --range 0-1023 --output /dev/null --write-out '%{http_code} %{url_effective}' "$url" 2>&1) || status=$?
+          echo "::warning::composed fixtures attempt $attempt failed; comparator archive probe: curl exit $status, $probe"
+          if [ "$attempt" -lt 3 ]; then sleep $((attempt * 60)); fi
+        done
+        exit 1
     - name: Publish the registered composed-audio fixtures
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
@@ -64,7 +79,7 @@ runs:
       uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
       with:
         path: ${{ runner.temp }}/coreav-composed-fixtures
-        key: linux-x64-composed-${{ hashFiles('docs/design/composed-opus-aac-v2.json', 'scripts/composed_audio.py', 'scripts/composed_audio_fixtures.py', 'scripts/oracle_audio.py', 'scripts/oracle-audio-args.txt', 'scripts/oracle-ffmpeg.env', 'scripts/install-oracle-ffmpeg.sh') }}
+        key: ${{ steps.key.outputs.composed }}
     - name: Publish this run's fixtures
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:

.github/workflows/audio-conformance.yml

@@ -530,7 +530,7 @@ jobs:
           set -euo pipefail
           mkdir -p "$RUNNER_TEMP/opus-vectors"
           cd "$RUNNER_TEMP/opus-vectors"
-          curl -sSfL --retry 3 -o vectors.tar.gz "$OPUS_VECTORS_URL"
+          curl -sSfL --retry 3 --retry-all-errors --retry-delay 5 -o vectors.tar.gz "$OPUS_VECTORS_URL"
           echo "$OPUS_VECTORS_SHA256  vectors.tar.gz" | sha256sum -c -
           tar xzf vectors.tar.gz
           rm vectors.tar.gz
@@ -539,7 +539,7 @@ jobs:
           set -euo pipefail
           mkdir -p "$RUNNER_TEMP/opus-compare"
           cd "$RUNNER_TEMP/opus-compare"
-          curl -sSfL --retry 3 -o libopus.tar.gz "$LIBOPUS_URL"
+          curl -sSfL --retry 3 --retry-all-errors --retry-delay 5 -o libopus.tar.gz "$LIBOPUS_URL"
           echo "$LIBOPUS_SHA256  libopus.tar.gz" | sha256sum -c -
           tar xzf libopus.tar.gz opus-1.6.1/src/opus_compare.c
           cc -O2 -o opus_compare opus-1.6.1/src/opus_compare.c -lm

.github/workflows/ci.yml

@@ -1085,7 +1085,14 @@ jobs:
         run: |
           set -euo pipefail
           cargo test --locked --release -p coreav-isobmff-write --test join fixtures_round_trip -- --ignored
+          ORACLE_PATHS="$(python3 -I -B scripts/test_oracle.py --resolve)"
+          if ! { IFS= read -r FFMPEG && IFS= read -r FFPROBE; } <<< "$ORACLE_PATHS" ||
+             [[ -z "$FFMPEG" || -z "$FFPROBE" || "$ORACLE_PATHS" != "$FFMPEG"$'\n'"$FFPROBE" ]]; then
+            echo "stage=oracle_qualification: invalid retained oracle pair" >&2
+            exit 1
+          fi
           python3 -I scripts/join_check.py --manifest "$COREAV_JOIN_OUT/manifest.json" \
+            --ffmpeg "$FFMPEG" --ffprobe "$FFPROBE" \
             --mediainfo "$RUNNER_TEMP/coreav-oracle-bin/mediainfo" --ffmpeg-concat \
             --report "$RUNNER_TEMP/coreav-join.json"
       # docs/design/compat-cli.md, "coreav ffmpeg" (R3 on the fixtures):
@@ -1104,7 +1111,14 @@ jobs:
           set -euo pipefail
           cargo test --locked --release -p coreav-cli --test ffmpeg the_0_1_0_commands_on_the_fixtures -- --ignored
           cargo test --locked --release -p coreav-cli --test ffmpeg_concat c02_guard_concat_preserves_complete_native_output -- --ignored
+          ORACLE_PATHS="$(python3 -I -B scripts/test_oracle.py --resolve)"
+          if ! { IFS= read -r FFMPEG && IFS= read -r FFPROBE; } <<< "$ORACLE_PATHS" ||
+             [[ -z "$FFMPEG" || -z "$FFPROBE" || "$ORACLE_PATHS" != "$FFMPEG"$'\n'"$FFPROBE" ]]; then
+            echo "stage=oracle_qualification: invalid retained oracle pair" >&2
+            exit 1
+          fi
           python3 -I tools/compat-corpus/copy_check.py --records "$COREAV_FFMPEG_OUT/records.json" \
+            --ffmpeg "$FFMPEG" --ffprobe "$FFPROBE" \
             --mediainfo "$RUNNER_TEMP/coreav-oracle-bin/mediainfo" \
             --report "$RUNNER_TEMP/coreav-ffmpeg.json"
           COREAV_CURRENT_CI_ORACLE=1 python3 -I -m unittest discover -s tools/compat-corpus/tests -p test_copy_check.py
@@ -1678,7 +1692,14 @@ jobs:
         run: |
           set -euo pipefail
           cargo test --locked --release -p coreav-cli --test ffmpeg the_0_1_0_commands_on_the_fixtures -- --ignored
+          ORACLE_PATHS="$(python3 -I -B scripts/test_oracle.py --resolve)"
+          if ! { IFS= read -r FFMPEG && IFS= read -r FFPROBE; } <<< "$ORACLE_PATHS" ||
+             [[ -z "$FFMPEG" || -z "$FFPROBE" || "$ORACLE_PATHS" != "$FFMPEG"$'\n'"$FFPROBE" ]]; then
+            echo "stage=oracle_qualification: invalid retained oracle pair" >&2
+            exit 1
+          fi
           python3 -I tools/compat-corpus/copy_check.py --records "$COREAV_FFMPEG_OUT/records.json" \
+            --ffmpeg "$FFMPEG" --ffprobe "$FFPROBE" \
             --mediainfo mediainfo --report "$RUNNER_TEMP/mkv-ffmpeg.json"
       # docs/design/remux.md, "Audio sample entries": FLAC, ALAC, AC-3 and
       # E-AC-3 copied into MP4 by remux, clip, split, join and coreav ffmpeg

.github/workflows/codec-coverage.yml

@@ -387,6 +387,21 @@ jobs:
         with:
           ref: ${{ needs.coverage-plan.outputs.commit }}
           persist-credentials: false
+      - name: Check out the oracle owner from this run's commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.sha }}
+          path: oracle-owner
+          persist-credentials: false
+          sparse-checkout: |
+            /scripts/test_oracle.py
+            /scripts/oracle_pin.py
+            /scripts/oracle_pin_macos.py
+            /scripts/oracle-ffmpeg.env
+            /scripts/oracle-ffmpeg-macos.env
+          sparse-checkout-cone-mode: false
+      - name: Keep the oracle owner outside the candidate tree
+        run: mv "$GITHUB_WORKSPACE/oracle-owner" "$RUNNER_TEMP/oracle-owner"
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: coverage-binaries
@@ -438,8 +453,15 @@ jobs:
         run: |
           set -euo pipefail
           chmod +x "$RUNNER_TEMP/bin/decode-oracle"
+          ORACLE_PATHS="$(python3 -I -B "$RUNNER_TEMP/oracle-owner/scripts/test_oracle.py" --resolve \
+            --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" --ffprobe "$RUNNER_TEMP/oracle/ffprobe")"
+          if ! { IFS= read -r FFMPEG && IFS= read -r FFPROBE; } <<< "$ORACLE_PATHS" ||
+             [[ -z "$FFMPEG" || -z "$FFPROBE" || "$ORACLE_PATHS" != "$FFMPEG"$'\n'"$FFPROBE" ]]; then
+            echo "stage=oracle_qualification: invalid retained oracle pair" >&2
+            exit 1
+          fi
           python3 -I tools/compat-corpus/decode_breadth.py run --decode-oracle "$RUNNER_TEMP/bin/decode-oracle" \
-            --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" --ffprobe "$RUNNER_TEMP/oracle/ffprobe" \
+            --ffmpeg "$FFMPEG" --ffprobe "$FFPROBE" \
             --files "$RUNNER_TEMP/private/set.json" --shard "$SHARD/$SHARDS" --fetch "$RUNNER_TEMP/media" \
             --deadline "$DEADLINE" --records "$RUNNER_TEMP/private/v1.jsonl" --jobs 2
       - name: Count what the shard left for the rerun host
@@ -559,6 +581,21 @@ jobs:
         with:
           ref: ${{ needs.coverage-plan.outputs.commit }}
           persist-credentials: false
+      - name: Check out the oracle owner from this run's commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.sha }}
+          path: oracle-owner
+          persist-credentials: false
+          sparse-checkout: |
+            /scripts/test_oracle.py
+            /scripts/oracle_pin.py
+            /scripts/oracle_pin_macos.py
+            /scripts/oracle-ffmpeg.env
+            /scripts/oracle-ffmpeg-macos.env
+          sparse-checkout-cone-mode: false
+      - name: Keep the oracle owner outside the candidate tree
+        run: mv "$GITHUB_WORKSPACE/oracle-owner" "$RUNNER_TEMP/oracle-owner"
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: coverage-binaries
@@ -582,8 +619,15 @@ jobs:
           scripts/gen-fixtures.sh "$RUNNER_TEMP/fixtures"
           scripts/gen-fixtures-mkv.sh "$RUNNER_TEMP/fixtures"
           scripts/gen-fixtures-ts.sh "$RUNNER_TEMP/fixtures"
-          python3 -I scripts/gen-v2-fixtures.py --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" \
-            --ffprobe "$RUNNER_TEMP/oracle/ffprobe" --out "$RUNNER_TEMP/fixtures"
+          ORACLE_PATHS="$(python3 -I -B "$RUNNER_TEMP/oracle-owner/scripts/test_oracle.py" --resolve \
+            --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" --ffprobe "$RUNNER_TEMP/oracle/ffprobe")"
+          if ! { IFS= read -r FFMPEG && IFS= read -r FFPROBE; } <<< "$ORACLE_PATHS" ||
+             [[ -z "$FFMPEG" || -z "$FFPROBE" || "$ORACLE_PATHS" != "$FFMPEG"$'\n'"$FFPROBE" ]]; then
+            echo "stage=oracle_qualification: invalid retained oracle pair" >&2
+            exit 1
+          fi
+          python3 -I scripts/gen-v2-fixtures.py --ffmpeg "$FFMPEG" \
+            --ffprobe "$FFPROBE" --out "$RUNNER_TEMP/fixtures"
       - name: Record the host and the fixtures
         run: |
           mkdir -p "$RUNNER_TEMP/public"
@@ -600,7 +644,15 @@ jobs:
           python3 -I -m unittest discover -s scripts/tests -p 'test_gen_v2_fixtures.py'
       - name: Verify supplemental reference assignments
         run: |
-          python3 -I scripts/v2_fixture_check.py --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" \
+          set -euo pipefail
+          ORACLE_PATHS="$(python3 -I -B "$RUNNER_TEMP/oracle-owner/scripts/test_oracle.py" --resolve \
+            --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" --ffprobe "$RUNNER_TEMP/oracle/ffprobe")"
+          if ! { IFS= read -r FFMPEG && IFS= read -r FFPROBE; } <<< "$ORACLE_PATHS" ||
+             [[ -z "$FFMPEG" || -z "$FFPROBE" || "$ORACLE_PATHS" != "$FFMPEG"$'\n'"$FFPROBE" ]]; then
+            echo "stage=oracle_qualification: invalid retained oracle pair" >&2
+            exit 1
+          fi
+          python3 -I scripts/v2_fixture_check.py --ffmpeg "$FFMPEG" \
             --fixtures "$RUNNER_TEMP/fixtures" --work "$RUNNER_TEMP/fixture-check" \
             --report "$RUNNER_TEMP/public/v2-fixture-reference.json"
       - name: V2 and V3, encode breadth and the native share
@@ -611,10 +663,17 @@ jobs:
           chmod +x "$RUNNER_TEMP/bin/coreav" "$RUNNER_TEMP/bin/ffmpeg-harness" "$RUNNER_TEMP/bin/x264"
           # 0: a complete run; 2: void (a fallback log line that ran, a fault, a missing command), a result all the
           # same. Anything else is not a run.
+          ORACLE_PATHS="$(python3 -I -B "$RUNNER_TEMP/oracle-owner/scripts/test_oracle.py" --resolve \
+            --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" --ffprobe "$RUNNER_TEMP/oracle/ffprobe")"
+          if ! { IFS= read -r FFMPEG && IFS= read -r FFPROBE; } <<< "$ORACLE_PATHS" ||
+             [[ -z "$FFMPEG" || -z "$FFPROBE" || "$ORACLE_PATHS" != "$FFMPEG"$'\n'"$FFPROBE" ]]; then
+            echo "stage=oracle_qualification: invalid retained oracle pair" >&2
+            exit 1
+          fi
           code=0
           python3 -I tools/compat-corpus/encode_breadth.py run --coreav "$RUNNER_TEMP/bin/coreav" \
-            --harness "$RUNNER_TEMP/bin/ffmpeg-harness" --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" \
-            --ffprobe "$RUNNER_TEMP/oracle/ffprobe" --x264 "$RUNNER_TEMP/bin/x264" \
+            --harness "$RUNNER_TEMP/bin/ffmpeg-harness" --ffmpeg "$FFMPEG" \
+            --ffprobe "$FFPROBE" --x264 "$RUNNER_TEMP/bin/x264" \
             --fixtures "$RUNNER_TEMP/fixtures" --work "$RUNNER_TEMP/work" \
             --records "$RUNNER_TEMP/public/v2-v3.jsonl" --summary "$RUNNER_TEMP/public/v2-v3-summary.json" \
             --jobs 4 || code=$?
@@ -649,6 +708,21 @@ jobs:
           [ "$(git rev-parse HEAD)" = "$COMMIT" ] || { echo '::error::image checkout differs from the selected commit'; exit 1; }
           python3 -I scripts/png_bmp_yuv_plan.py --event "$GITHUB_EVENT_NAME" --ref "$GITHUB_REF" \
             --set v2 --registration "$REGISTRATION" --commit "$COMMIT"
+      - name: Check out the oracle owner from this run's commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ github.sha }}
+          path: oracle-owner
+          persist-credentials: false
+          sparse-checkout: |
+            /scripts/test_oracle.py
+            /scripts/oracle_pin.py
+            /scripts/oracle_pin_macos.py
+            /scripts/oracle-ffmpeg.env
+            /scripts/oracle-ffmpeg-macos.env
+          sparse-checkout-cone-mode: false
+      - name: Keep the oracle owner outside the candidate tree
+        run: mv "$GITHUB_WORKSPACE/oracle-owner" "$RUNNER_TEMP/oracle-owner"
       - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: coverage-binaries
@@ -666,9 +740,16 @@ jobs:
           scripts/gen-fixtures.sh "$RUNNER_TEMP/fixtures"
           scripts/gen-fixtures-mkv.sh "$RUNNER_TEMP/fixtures"
           scripts/gen-fixtures-ts.sh "$RUNNER_TEMP/fixtures"
-          python3 -I scripts/gen-v2-fixtures.py --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" \
-            --ffprobe "$RUNNER_TEMP/oracle/ffprobe" --out "$RUNNER_TEMP/fixtures"
-          python3 -I scripts/v2_fixture_check.py --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" \
+          ORACLE_PATHS="$(python3 -I -B "$RUNNER_TEMP/oracle-owner/scripts/test_oracle.py" --resolve \
+            --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" --ffprobe "$RUNNER_TEMP/oracle/ffprobe")"
+          if ! { IFS= read -r FFMPEG && IFS= read -r FFPROBE; } <<< "$ORACLE_PATHS" ||
+             [[ -z "$FFMPEG" || -z "$FFPROBE" || "$ORACLE_PATHS" != "$FFMPEG"$'\n'"$FFPROBE" ]]; then
+            echo "stage=oracle_qualification: invalid retained oracle pair" >&2
+            exit 1
+          fi
+          python3 -I scripts/gen-v2-fixtures.py --ffmpeg "$FFMPEG" \
+            --ffprobe "$FFPROBE" --out "$RUNNER_TEMP/fixtures"
+          python3 -I scripts/v2_fixture_check.py --ffmpeg "$FFMPEG" \
             --fixtures "$RUNNER_TEMP/fixtures" --work "$RUNNER_TEMP/fixture-check" \
             --report "$RUNNER_TEMP/public/v2-fixture-reference.json"
           python3 -I scripts/codec_coverage_gcp.py host --job v2-images --oracle "$RUNNER_TEMP/oracle" \
@@ -682,11 +763,18 @@ jobs:
           chmod +x "$RUNNER_TEMP/bin/coreav" "$RUNNER_TEMP/bin/ffmpeg-harness" \
             "$RUNNER_TEMP/bin/image-harness" "$RUNNER_TEMP/bin/x264"
           cp "$RUNNER_TEMP/bin/manifest-image-build.json" "$RUNNER_TEMP/public/"
+          ORACLE_PATHS="$(python3 -I -B "$RUNNER_TEMP/oracle-owner/scripts/test_oracle.py" --resolve \
+            --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" --ffprobe "$RUNNER_TEMP/oracle/ffprobe")"
+          if ! { IFS= read -r FFMPEG && IFS= read -r FFPROBE; } <<< "$ORACLE_PATHS" ||
+             [[ -z "$FFMPEG" || -z "$FFPROBE" || "$ORACLE_PATHS" != "$FFMPEG"$'\n'"$FFPROBE" ]]; then
+            echo "stage=oracle_qualification: invalid retained oracle pair" >&2
+            exit 1
+          fi
           python3 -I tools/compat-corpus/png_bmp_yuv.py run --registration "$REGISTRATION" \
             --coreav "$RUNNER_TEMP/bin/coreav" --harness "$RUNNER_TEMP/bin/ffmpeg-harness" \
             --image-harness "$RUNNER_TEMP/bin/image-harness" \
             --build-manifest "$RUNNER_TEMP/bin/manifest-image-build.json" \
-            --ffmpeg "$RUNNER_TEMP/oracle/ffmpeg" --ffprobe "$RUNNER_TEMP/oracle/ffprobe" \
+            --ffmpeg "$FFMPEG" --ffprobe "$FFPROBE" \
             --x264 "$RUNNER_TEMP/bin/x264" --fixtures "$RUNNER_TEMP/fixtures" \
             --work "$RUNNER_TEMP/image-work" --records "$RUNNER_TEMP/public/v2-images.jsonl" \
             --summary "$RUNNER_TEMP/public/v2-images-summary.json" \

.github/workflows/deny.yml

@@ -80,6 +80,7 @@ jobs:
           set -euo pipefail
           python3 -I scripts/workflow_check.py
           python3 -I scripts/compat_sources.py check
+          python3 -I scripts/compat_frozen_check.py
           python3 -I scripts/oracle_pin.py --check
           python3 -I scripts/workflow_check_selftest.py
           python3 -I -m unittest discover -s .github/actions/changed-paths/tests -p 'test_*.py'