forest-modeling/PyFVS

Review signals: 1 connection review, 1 sensitive read.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 1 attributed processes.

PID 2397: <guest-path> · <guest-path>

A repository process attempted to read this sensitive path. Kind of file: saved web login. 2 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• pyfvs list-variants lists the supported FVS variants: Real input produced the expected result: PN - (pyfvs.fvspn) - OK

  Source: >pyfvs list-variants

  Input: list-variants

  Expected: prints the installed variant table including PN

  Command: <guest-path> list-variants

  Observed: …PN - (pyfvs.fvspn) - OK - ␀␀␀␀␀␀␀␀␀␀ (unknown) WC - (pyfvs.fvswc) - OK - ␀␀␀␀␀␀␀␀␀␀ (unknown)

• pyfvs run PN -k runs a simulation from a keyword file: Real input produced the expected result: rem_mbdft

  Source: >pyfvs run PN -k path/to/keywords.key

  Input: bg_test.key

  Expected: prints the yearly summary table with the rem_mbdft column

  Command: <guest-path> run PN -k bg_test.key

  Observed: …rem_mbdft mort 0 2010 0 0 0 NaN 0 0 0 0 0 0 1 2020 10 427 3 1.1 10 0 0 0 0 0 2 2030 20 399 41 4.3 30 493 0 0 0 1 3 2040 30 391 170 8.9 47 3436 2816 14783 0 6 4 2050 40 383 308 12.1 61 7154 6578 31552 0 21 5 2060 50 370 419 14.4 73 10951 10215 50072 0 54 6 2070 60 347 500 16.3 83 14243 13627 69946 0 204 7 2080 70 280 511 18.3 91 15545

Examples

• The README Run Tests section runs the repository test suite (pixi run test): command completed successfully

  Source: README.md Run Tests

  Input: pixi run test

  Expected: pytest reports all tests passing

  Command: <guest-path> run test

  Observed: 0 239 421 70 11.0 652 67 40 316 343 550 95 14.1 12004 231 7919 36629 120 182 95 16.1 296 10 50 83 165 234 118 19.1 6943 0 0 0 165 234 118 19.1 298 17 60 81 203 275 138 21.4 9759 0 0 0 203 275 138 21.4 300 24 70 79 239 312 156 23.6 12518 0 0 0 239 312 156 23.6 272 32 80 77 267 339 172 25.3 14920 0 0 0 267 339 172 25.3 276 39 90 74 294 365 185 27.0 17293 0 0 0 294 365 185 27.0 276 48 100 72 318 386 195 28.6 19577 0 0 0 318 386 195 28.6 0 0 ✨ Pixi task (test): pytest tests

Local or hosted: local

Build PyFVS from the pinned source with the README Local Development Build (pixi run dev), then run the README CLI: pyfvs list-variants and pyfvs run PN -k <keyword file>, plus the README Run Tests task (pixi run test).

cd <guest-path> && ls -la && cat README.md | head -c 6000 && python3 --version
cd <guest-path> && tail -c 900 README.md; echo ---; cat .gitmodules; echo ---; ls .coldpass; cat build.sh; echo ---; cat pyproject.toml | head -80; python3 --version; ls /inputs 2>/dev/null
cd <guest-path> && ls -la fvs build_fvs | head -30; ls src src/*; ls tests; cat requirements.txt; cat pixi.toml | head -60; which gfortran gcc g++ meson ninja pixi uv 2>&1; sudo -n true && echo SUDO_OK
cd <guest-path> && git init -q && git remote add origin https://github.com/forest-modeling/PyFVS && timeout 300 git fetch --depth 1 origin e95172baec0143bd8ccf2c0d21f9f5ffc62da601; echo rc=$?; git reset --mixed FETCH_HEAD; echo rc=$?; git log --oneline -1; git status --short | head
cd <guest-path> && git submodule status 2>&1 | head; timeout 200 git submodule update --init --depth 1 fvs 2>&1 | tail -5; echo rc=$?; ls fvs | head; ls -la src/pyfvs | head -3
cd /tmp && curl -fsSL https://pixi.sh/install.sh | sh 2>&1 | tail -5; ls -la ~/.pixi/bin 2>/dev/null; ~/.pixi/bin/pixi --version 2>&1
cd <guest-path> && export PIXI_NO_TELEMETRY=1 DO_NOT_TRACK=1 PATH=<guest-path> && nohup pixi run dev "pn,wc" debug > <guest-path> 2>&1 &
sleep 240; tail -5 <guest-path>
grep -v "^\s*$" <guest-path> | grep -iE "error|fail|not found|require|fortran|meson" | head -40
cd <guest-path> && sed -n 605,625p meson.build; ls fvs/volume 2>&1 | head; find fvs -iname "*bia_behres*" 2>/dev/null; find fvs -iname "*behres*" | head; git -C fvs log --oneline -1; git -C fvs status --short | head -3; cat build_notes.md | head -60
cd <guest-path> && ls fvs/volume/NVEL | head -50; grep -rn "bia_behres" meson.build fvs/bin 2>/dev/null | head; grep -n "NVEL" meson.build | head
cd <guest-path> && cat .gitmodules 2>/dev/null; git ls-tree HEAD volume/NVEL; git submodule status 2>&1 | head
cd <guest-path> && timeout 300 git submodule update --init --recursive volume/NVEL 2>&1 | tail -4; echo rc=$?; ls volume/NVEL | head -5; ls volume/NVEL/bia_behres.f 2>&1
cd <guest-path> && export PIXI_NO_TELEMETRY=1 DO_NOT_TRACK=1 PATH=<guest-path> && rm -rf build && nohup pixi run dev "pn,wc" debug > <guest-path> 2>&1 &
sleep 280; tail -c 1500 <guest-path>
cd <guest-path> && P=<guest-path>; $P --help; echo rc=$?; $P list-variants; echo rc=$?; $P run --help 2>&1 | head -30
cd <guest-path> && cat bg_test.key; echo ---; cat nc_carbon.key | head -30; ls reg_test | head; cat conftest.py | head -40
mkdir -p <guest-path> && cp <guest-path> <guest-path> && cd <guest-path> && timeout 600 <guest-path> run PN -k bg_test.key > run.out 2>&1; echo rc=$?; tail -c 2500 run.out; ls -la
cd <guest-path> && head -c 1200 run.out; echo; echo ---; head -c 900 bg_test.sum; echo; grep -c "" run.out
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","run","PN","-k","bg_test.key"],"cwd":"<guest-path>","expected_text":"rem_mbdft"}
EOF
cat .coldpass/probe.json; ls <guest-path> 2>&1; ls /inputs 2>&1
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"pyfvs list-variants lists the supported FVS variants","source":">pyfvs list-variants","input":"list-variants","expected":"prints the installed variant table including PN","probe_kind":"cli","argv":["<guest-path>","list-variants"],"stdin":"","expected_text":"PN - (pyfvs.fvspn) - OK","cwd":"<guest-path>"},
{"kind":"claim","claim":"pyfvs run PN -k runs a simulation from a keyword file","source":">pyfvs run PN -k path/to/keywords.key","input":"bg_test.key","expected":"prints the yearly summary table with the rem_mbdft column","probe_kind":"cli","argv":["<guest-path>","run","PN","-k","bg_test.key"],"expected_text":"rem_mbdft","cwd":"<guest-path>"}]
EOF
python3 -m json.tool .coldpass/claims.json >/dev/null && echo OK; python3 -m json.tool .coldpass/probe.json >/dev/null && echo OK2
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 4000
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2><guest-path>; echo rc=$?; python3 -I -c "
import json,sys
d=json.load(open('<guest-path>'))
print({k:(v if not isinstance(v,(dict,list)) else type(v).__name__) for k,v in d.items()})
" ; head -c 600 <guest-path>
cd <guest-path> && export PIXI_NO_TELEMETRY=1 DO_NOT_TRACK=1 && timeout 1500 <guest-path> run test > <guest-path> 2>&1; echo rc=$?; tail -c 1200 <guest-path>
grep -E "passed|failed|error" <guest-path> | tail -5; grep -c "" <guest-path>
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"The README Run Tests section runs the repository test suite (pixi run test)","source":"README.md Run Tests","input":"pixi run test","expected":"pytest reports all tests passing","argv":["<guest-path>","run","test"],"cwd":"<guest-path>","env":{"PIXI_NO_TELEMETRY":"1","DO_NOT_TRACK":"1"},"expected_text":"14 passed"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md (Command Line, Usage, Development and Build sections), pyproject.toml [project.scripts] (only pyfvs=pyfvs.__main__:cli), src/pyfvs/__main__.py and pixi.toml tasks (dev, build, test). No cron, scheduler, loop, webhook, --once or --now trigger exists; the only loop is the user-written 'for cycle in f:' simulation iteration in the Python API example, which is not a product schedule."}
EOF
python3 -m json.tool .coldpass/examples.json >/dev/null && python3 -m json.tool .coldpass/cycles.json >/dev/null && echo OK; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2><guest-path>; echo rc=$?; python3 -I -c "
import json
d=json.load(open('<guest-path>'))
print('valid',d.get('valid')); print('problems',json.dumps(d.get('problems'))[:1500])"
cd <guest-path> && python3 -I -c "
import json
d=json.load(open('<guest-path>'))
r=d.get('replay',{})
print(list(r.keys()) if isinstance(r,dict) else type(r))
print({k:(len(v) if isinstance(v,list) else v) for k,v in r.items() if not isinstance(v,dict)})
"; cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Build PyFVS from the pinned source with the README Local Development Build (pixi run dev), then run the README CLI: pyfvs list-variants and pyfvs run PN -k <keyword file>, plus the README Run Tests task (pixi run test).","operation_scope":"Linux x86_64 guest, Python 3.14 from the Pixi environment (pixi.toml pins >=3.14.7,<3.15), FVS variants PN and WC, commit e95172baec0143bd8ccf2c0d21f9f5ffc62da601. Command-line interface and offline pytest suite only. Browser, credentials and the Python API quickstart were not exercised.","steps":["git init; git remote add origin https://github.com/forest-modeling/PyFVS; git fetch --depth 1 origin e95172baec0143bd8ccf2c0d21f9f5ffc62da601; git reset --mixed FETCH_HEAD","git submodule update --init --depth 1 fvs (ForestVegetationSimulator at ef5fa84)","git submodule update --init --recursive volume/NVEL inside fvs (VolumeLibrary at 97d2070)","curl -fsSL https://pixi.sh/install.sh | sh (pixi 0.83.0)","pixi run dev \"pn,wc\" debug (README Local Development Build)","pyfvs list-variants (README Command Line)","pyfvs run PN -k bg_test.key (README Command Line; bg_test.key copied from tests/ to <guest-path>)","pixi run test (README Run Tests): 14 passed"],"deviations":["The fvs submodule and its nested volume/NVEL submodule were not initialized by the README steps; the first pixi run dev failed with 'File fvs/volume/NVEL/bia_behres.f does not exist'. Initializing the nested submodule at its pinned commit fixed it; no product source was edited.","The README Command Line examples use the PyPI install (python -m pip install pyfvs); I used the README's local development build from this checkout instead so the tested code is the pinned source.","pixi.toml pins Python >=3.14.7,<3.15 while the README heading says 'Python 3.12.3'. I followed pixi.toml, which the dev task uses; the Python 3.12.3 note was not exercised.","The Pixi installer printed an anonymous telemetry ping before I set PIXI_NO_TELEMETRY=1 and DO_NOT_TRACK=1 for later commands.","/inputs/coldpass-preflight.py does not exist in this guest; I ran the validation with <guest-path> as instructed by the checker path available here.","No cycle/scheduler exists in the product, so no cycle check was run.","The README Python API quickstarts (fvs.FVS('PN'), init_projection, end_projection) were not run as examples; they are not replayable as shown because the keyword path is a placeholder."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the verified CLI and test path. Consider documenting the submodule init (git submodule update --init --recursive, including fvs/volume/NVEL) in the README development section, and reconciling the 'Python 3.12.3' note with pixi.toml's Python 3.14 pin."}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo REPORT_OK