Hash Dragon descriptors from serialized bytes

[tpn]

Dragon launch descriptors were hashed by reopening their published path. A change between publication and that read could make the expected digest describe different content from the coordinator's descriptor.

Return the exact serialized bytes from atomic JSON publication and hash those bytes in the shared and xPOIS launch paths. Workers then reject a descriptor changed during publication before resolving or constructing the worker target.

Validation: 256 focused tests passed, with one optional test skipped. Regression coverage includes shared workers, single-pass xPOIS, and repeated rounds. All repository pre-commit checks passed.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/cuPhoton/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 45c161c6-91cc-474a-ae1d-6029b9851e2c

📥 Commits

Reviewing files that changed from the base of the PR and between 2b9219b and 4b901d3.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/cuPhoton/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: e78f419a-d974-46df-8137-3c3c38295516

📥 Commits

Reviewing files that changed from the base of the PR and between ffb1d38 and 2b9219b.

📒 Files selected for processing: 5

• src/cuphoton/core/bulk.py
• src/cuphoton/core/dragon.py
• src/cuphoton/xpois/dragon.py
• tests/core/test_dragon.py
• tests/xpois/test_dragon.py

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Walkthrough

atomic_write_json now returns the exact UTF-8 bytes it writes. Dragon launch paths use those bytes to calculate descriptor sizes and SHA-256 digests. Regression tests mutate published descriptors and verify that startup validation rejects them.

Changes: Descriptor Integrity

Layer / File(s)	Summary
Return serialized JSON bytes src/cuphoton/core/bulk.py	atomic_write_json serializes normalized JSON to UTF-8 bytes, writes those bytes in binary mode, and returns them.
Use serialized bytes in Dragon launches src/cuphoton/core/dragon.py, src/cuphoton/xpois/dragon.py, tests/core/test_dragon.py, tests/xpois/test_dragon.py	Core and xpois launch paths use the returned descriptor bytes for size and SHA-256 calculations. Tests verify that descriptor mutation causes SHA-256 validation to fail before worker execution or target resolution.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 2b921

The descriptor-integrity change is ready to merge after normal checks.

Pre-merge checks: 2

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tpn]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Already reviewed the last commit. Use @coderabbitai full review to rerun a review of the entire changeset.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[melo-gonzo]

LGTM. Descriptor length and digest now use the exact serialized bytes. Regression tests and publication-race probes confirm that workers reject changed content before starting the worker target.