Wire production aircraft callbacks and diagnose native prison action selection

tools/headless_input_proof.py

@@ -43,6 +43,22 @@ def option(args, name):
     return args[index + 1]
 
 
+def gate_options(native, args):
+    # Two exact read-only options; a prefix match must never admit an alias,
+    # duplicate, foreign nonce or extra diagnostic in keyboard-only mode.
+    tokens = [value for value in native if value.startswith('-errOrdinaryGate')]
+    if any(value not in {'-errOrdinaryGateObserve', '-errOrdinaryGateChoices'} for value in tokens):
+        raise Refused('Unknown native gate observer option')
+    approach = getattr(args, 'enable_private_approach_proof', False)
+    if approach and '-errOrdinaryGateObserve' not in tokens:
+        raise Refused('Missing native gate observer nonce')
+    if '-errOrdinaryGateChoices' in tokens and not approach:
+        raise Refused('Native gate choices require explicit approach proof')
+    for name in set(tokens):
+        if option(native, name) != args.nonce:
+            raise Refused('Native gate observer nonce mismatch')
+
+
 def game_arguments(owner, args):
     native = display.process(owner['pid'])
     if display.identity(native) != owner['process']:
@@ -51,8 +67,7 @@ def game_arguments(owner, args):
         raise Refused('Native observer nonce mismatch')
     if getattr(args, 'enable_private_look_proof', False) and option(native['args'], '-errOrdinaryLookObserve') != args.nonce:
         raise Refused('Native look observer nonce mismatch')
-    if getattr(args, 'enable_private_approach_proof', False) and option(native['args'], '-errOrdinaryGateObserve') != args.nonce:
-        raise Refused('Native gate observer nonce mismatch')
+    gate_options(native['args'], args)
     if option(native['args'], '-errOrdinaryScenario') not in ('core', 'chat'):
         raise Refused('Not an ordinary successor scenario')
     if option(native['args'], '-profile') != 'Z:' + str(args.profile):
@@ -824,8 +839,7 @@ def wrapper_command(args):
         raise Refused('Wrapped native observer context differs')
     if args.enable_private_look_proof and option(native, '-errOrdinaryLookObserve') != args.nonce:
         raise Refused('Wrapped native look observer context differs')
-    if getattr(args, 'enable_private_approach_proof', False) and option(native, '-errOrdinaryGateObserve') != args.nonce:
-        raise Refused('Wrapped native gate observer context differs')
+    gate_options(native, args)
     return command