From 438844b01a4c370eaeadf2b4e96bf7ee77e147c6 Mon Sep 17 00:00:00 2001 From: AdamWen95 <58934607+AdamWen95@users.noreply.github.com> Date: Wed, 14 Oct 2026 09:38:58 +0800 Subject: [PATCH] feat: initialize XAS test console with native execution --- .dockerignore | 5 + .gitattributes | 2 + .gitignore | 13 + README.md | 33 + catalog/external-sources.json | 10 + catalog/native-profiles.json | 2808 +++++++++++++++++ catalog/test-definitions.json | 574 ++++ console/__init__.py | 1 + console/app.py | 297 ++ console/artifacts.py | 144 + console/catalog.py | 193 ++ console/job_main.py | 115 + console/native_executor.py | 160 + console/native_files.py | 75 + console/native_io.py | 122 + console/native_job.py | 176 ++ console/native_plans.py | 193 ++ console/native_rpc.py | 95 + console/requirements-test.txt | 4 + console/requirements.txt | 16 + console/settings.py | 62 + console/static/app.js | 61 + console/static/core.js | 29 + console/static/index.html | 37 + console/static/native-ui.js | 187 ++ console/static/related-files.js | 63 + console/static/runs.js | 184 ++ console/static/scripts.js | 275 ++ console/static/styles.css | 176 ++ console/static/ui.js | 125 + console/store.py | 216 ++ console/test_catalog.py | 72 + console/worker.py | 270 ++ console/workspace.py | 35 + deploy/Dockerfile | 8 + deploy/console-worker.service | 21 + deploy/console.Dockerfile | 10 + deploy/console.Dockerfile.dockerignore | 10 + deploy/cutover_console.py | 90 + deploy/dedicated.py | 102 + deploy/jaas-loginmodule.conf.template | 5 + deploy/jobs.yaml | 31 + deploy/lan-settings.json | 5 + deploy/lan_config.py | 89 + deploy/migrate_lan.py | 81 + deploy/native_profiles.py | 83 + deploy/operator.aclpolicy | 30 + deploy/realm.disabled.properties | 1 + deploy/start.py | 111 + docs/acceptance-2026-10-13.md | 81 + .../acceptance-behavior-catalog-2026-10-13.md | 35 + docs/acceptance-dedicated-2026-10-13.md | 64 + docs/acceptance-lan-2026-10-13.md | 51 + docs/acceptance-native-2026-10-13.md | 68 + docs/adr/0001-intranet-access.md | 13 + docs/adr/0002-dedicated-console.md | 21 + docs/adr/0003-test-behavior-catalog.md | 29 + docs/adr/0004-native-execution.md | 25 + docs/console-operations.md | 67 + docs/console-plan.md | 52 + docs/design.md | 31 + docs/images/job.png | Bin 0 -> 72945 bytes docs/images/lan-jobs.png | Bin 0 -> 128056 bytes docs/images/lan-logs.png | Bin 0 -> 64450 bytes docs/images/logs.png | Bin 0 -> 62337 bytes docs/implementation-plan.md | 45 + docs/legacy-smoke-plan.md | 35 + docs/native-execution-plan.md | 45 + legacy/dsv41-smoke/SOURCE.md | 14 + legacy/dsv41-smoke/smoke.sh | 17 + scripts/console_example.py | 23 + scripts/run_smoke.py | 175 + scripts/smoke_task.py | 38 + tests/test_console.py | 157 + tests/test_console_outputs.py | 126 + tests/test_console_worker.py | 48 + tests/test_deployment.py | 82 + tests/test_lan_config.py | 36 + tests/test_native_lifecycle.py | 89 + tests/test_native_plans.py | 89 + tests/test_native_rpc.py | 68 + tests/test_runner.py | 102 + tests/test_test_catalog.py | 103 + 83 files changed, 9334 insertions(+) create mode 100644 .dockerignore create mode 100644 .gitattributes create mode 100644 .gitignore create mode 100644 README.md create mode 100644 catalog/external-sources.json create mode 100644 catalog/native-profiles.json create mode 100644 catalog/test-definitions.json create mode 100644 console/__init__.py create mode 100644 console/app.py create mode 100644 console/artifacts.py create mode 100644 console/catalog.py create mode 100644 console/job_main.py create mode 100644 console/native_executor.py create mode 100644 console/native_files.py create mode 100644 console/native_io.py create mode 100644 console/native_job.py create mode 100644 console/native_plans.py create mode 100644 console/native_rpc.py create mode 100644 console/requirements-test.txt create mode 100644 console/requirements.txt create mode 100644 console/settings.py create mode 100644 console/static/app.js create mode 100644 console/static/core.js create mode 100644 console/static/index.html create mode 100644 console/static/native-ui.js create mode 100644 console/static/related-files.js create mode 100644 console/static/runs.js create mode 100644 console/static/scripts.js create mode 100644 console/static/styles.css create mode 100644 console/static/ui.js create mode 100644 console/store.py create mode 100644 console/test_catalog.py create mode 100644 console/worker.py create mode 100644 console/workspace.py create mode 100644 deploy/Dockerfile create mode 100644 deploy/console-worker.service create mode 100644 deploy/console.Dockerfile create mode 100644 deploy/console.Dockerfile.dockerignore create mode 100644 deploy/cutover_console.py create mode 100644 deploy/dedicated.py create mode 100644 deploy/jaas-loginmodule.conf.template create mode 100644 deploy/jobs.yaml create mode 100644 deploy/lan-settings.json create mode 100644 deploy/lan_config.py create mode 100644 deploy/migrate_lan.py create mode 100644 deploy/native_profiles.py create mode 100644 deploy/operator.aclpolicy create mode 100644 deploy/realm.disabled.properties create mode 100644 deploy/start.py create mode 100644 docs/acceptance-2026-10-13.md create mode 100644 docs/acceptance-behavior-catalog-2026-10-13.md create mode 100644 docs/acceptance-dedicated-2026-10-13.md create mode 100644 docs/acceptance-lan-2026-10-13.md create mode 100644 docs/acceptance-native-2026-10-13.md create mode 100644 docs/adr/0001-intranet-access.md create mode 100644 docs/adr/0002-dedicated-console.md create mode 100644 docs/adr/0003-test-behavior-catalog.md create mode 100644 docs/adr/0004-native-execution.md create mode 100644 docs/console-operations.md create mode 100644 docs/console-plan.md create mode 100644 docs/design.md create mode 100644 docs/images/job.png create mode 100644 docs/images/lan-jobs.png create mode 100644 docs/images/lan-logs.png create mode 100644 docs/images/logs.png create mode 100644 docs/implementation-plan.md create mode 100644 docs/legacy-smoke-plan.md create mode 100644 docs/native-execution-plan.md create mode 100644 legacy/dsv41-smoke/SOURCE.md create mode 100644 legacy/dsv41-smoke/smoke.sh create mode 100644 scripts/console_example.py create mode 100644 scripts/run_smoke.py create mode 100644 scripts/smoke_task.py create mode 100644 tests/test_console.py create mode 100644 tests/test_console_outputs.py create mode 100644 tests/test_console_worker.py create mode 100644 tests/test_deployment.py create mode 100644 tests/test_lan_config.py create mode 100644 tests/test_native_lifecycle.py create mode 100644 tests/test_native_plans.py create mode 100644 tests/test_native_rpc.py create mode 100644 tests/test_runner.py create mode 100644 tests/test_test_catalog.py diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 0000000..76c58c3 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,5 @@ +* +!scripts/ +!scripts/*.py +!deploy/ +!deploy/Dockerfile diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..d0d6371 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,2 @@ +* text=auto eol=lf +*.png binary diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..8ba2e08 --- /dev/null +++ b/.gitignore @@ -0,0 +1,13 @@ +.local/ +runtime/ +results/ +__pycache__/ +*.pyc +.env +.env.* +!.env.example +*.pem +*.key +realm.properties +tokens.properties +deploy/console-worker.json diff --git a/README.md b/README.md new file mode 100644 index 0000000..46fd773 --- /dev/null +++ b/README.md @@ -0,0 +1,33 @@ +# XAS 测试脚本控制台 + +核对日期：2026-10-13。当前采用专用网页控制台，替代前期 Rundeck 作为日常入口。 + +访问 [公司内网测试控制台](http://10.88.118.188:14440/)，无需账号密码。 + +- 测试项目：按实际测试行为展示，一套测试为一项，内部脚本放到详情的“相关文件”。 +- 上传：新增 Python/Shell 脚本或上传不可变的新版本，不在线编辑代码。 +- 运行：配置参数后排队执行，查看实时标准输出/错误及登记的 .log 内容。 +- 记录：查看状态、版本、配置快照、历史日志和归档结果，预览或下载报告。 + +当前整理为 23 项业务测试（8 项套件、15 项单项测试），关联原先登记的 307 个源文件。22 项原位置入口已接入原环境执行，保留原目录、解释器、配置和输出行为；普通测试预检通过后提交，资源占用/服务启停测试每次显示影响并确认。两个控制台验收样例默认隐藏，可在“项目用途”中选择查看。原文件、GPU/端口设置和历史记录均保留。 + +2026-10-13 23:27 只读预检：16 个原环境方案满足登记的启动条件，6 个因所需模型端口未监听而被拦截。预检通过不等于业务测试通过，也不预留 GPU。GPU 综合套件支持菜单数字、y/n/q 和回车；需要自由文本的维护功能仍从原维护入口使用。本轮仅用独立短样例验证执行链路，没有运行原 GPU/长稳测试。 + +上传版本保存在服务器 `/adamwen-work-space/xas-test-library/runtime/library/`，日志和结果在 `runtime/runs/`，SQLite 在 `runtime/console-data/`，仅记录元数据、状态与文件引用。外部结果原文件保留，同时可归档本次变更；Git 不参与每次运行时拉取。 + +## 维护入口 + +- [使用、存储、配额及恢复说明](docs/console-operations.md) +- [已确认方案与 API 契约](docs/console-plan.md) +- [本轮验收记录](docs/acceptance-dedicated-2026-10-13.md) +- [按测试行为整理后的验收](docs/acceptance-behavior-catalog-2026-10-13.md) +- [原环境接入与本轮验收](docs/acceptance-native-2026-10-13.md) +- [原环境执行架构决策](docs/adr/0004-native-execution.md) +- [专用控制台架构决策](docs/adr/0002-dedicated-console.md) +- [按测试行为组织目录的规则](docs/adr/0003-test-behavior-catalog.md) + +源码位于 `console/`，部署入口 `deploy/dedicated.py`，原入口切换工具 `deploy/cutover_console.py`。旧 Rundeck 容器与运行数据保留；早期 design.md、implementation-plan.md、legacy-smoke-plan.md 均为历史阶段，不再是当前维护入口。 + +公司仓库：[wenhuadian/xas-test-library](https://code.it.aisuan.cn/wenhuadian/xas-test-library)，主分支为 `main`。Git 管理控制台源码、可信执行方案、部署脚本、测试和维护文档；数据库、结果、上传文件及凭据不纳入 Git。原服务器其他工作区的脚本通过路径引用，不会随本仓库自动上传。 + +提交与推送按用户明确授权执行，服务器部署单独进行，未配置自动发布。首次入库检查日期为 2026-10-14；本地回归 55 项中通过 48 项、因 Windows 平台限制跳过 7 项。此前 Linux 和原环境运行验收保留在各自日期的验收文档中。 diff --git a/catalog/external-sources.json b/catalog/external-sources.json new file mode 100644 index 0000000..eadaf14 --- /dev/null +++ b/catalog/external-sources.json @@ -0,0 +1,10 @@ +{ + "schema_version": 1, + "observed_at": "2026-10-13T17:19:29+08:00", + "evidence": "Dedicated console inventories source files read-only; execution readiness is managed per script in SQLite", + "sources": [ + {"id": "company-gpu-suite", "path": "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0"}, + {"id": "dsv41-trial-20261010", "path": "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts"}, + {"id": "model-trials-20261011", "path": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts"} + ] +} diff --git a/catalog/native-profiles.json b/catalog/native-profiles.json new file mode 100644 index 0000000..c3c5e99 --- /dev/null +++ b/catalog/native-profiles.json @@ -0,0 +1,2808 @@ +{ + "schema_version": 1, + "targets": [ + { + "id": "deepseek-a", + "label": "DeepSeek A（原服务，18100）", + "url": "http://127.0.0.1:18100", + "model": "deepseek-v4.1-flash", + "environment": { + "CT_OFF": "{\"thinking\": false}", + "CT_ON": "{\"thinking\": true}", + "MAX_LEN": "1048576" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/configs/vllm.env" + ] + }, + { + "id": "dsv41cap", + "label": "dsv41cap（配置端口 18110）", + "config_name": "dsv41cap", + "url": "http://127.0.0.1:18110", + "model": "deepseek-v4.1-flash", + "environment": { + "CT_OFF": "{\"thinking\": false}", + "CT_ON": "{\"thinking\": true}", + "MAX_LEN": "1048576" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/dsv41cap.conf" + }, + { + "id": "glm53", + "label": "glm53（配置端口 18102）", + "config_name": "glm53", + "url": "http://127.0.0.1:18102", + "model": "glm-5.3", + "environment": { + "CT_OFF": "{\"reasoning_effort\": \"low\"}", + "CT_ON": "{}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/glm53.conf" + }, + { + "id": "mimo", + "label": "mimo（配置端口 18104）", + "config_name": "mimo", + "url": "http://127.0.0.1:18104", + "model": "mimo-v2.6-pro", + "environment": { + "CT_OFF": "{\"enable_thinking\": false}", + "CT_ON": "{\"enable_thinking\": true}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/mimo.conf" + }, + { + "id": "qwen27b", + "label": "qwen27b（配置端口 18103）", + "config_name": "qwen27b", + "url": "http://127.0.0.1:18103", + "model": "qwen3.5-27b", + "environment": { + "CT_OFF": "{\"enable_thinking\": false}", + "CT_ON": "{\"enable_thinking\": true}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/qwen27b.conf" + }, + { + "id": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）", + "config_name": "qwen27btp8", + "url": "http://127.0.0.1:18103", + "model": "qwen3.5-27b", + "environment": { + "CT_OFF": "{\"enable_thinking\": false}", + "CT_ON": "{\"enable_thinking\": true}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/qwen27btp8.conf" + }, + { + "id": "qwen38cap", + "label": "qwen38cap（配置端口 18107）", + "config_name": "qwen38cap", + "url": "http://127.0.0.1:18107", + "model": "qwen3.8-27b", + "environment": { + "CT_OFF": "{\"enable_thinking\": false}", + "CT_ON": "{\"enable_thinking\": true}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/qwen38cap.conf" + }, + { + "id": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）", + "config_name": "qwen38fp8", + "url": "http://127.0.0.1:18105", + "model": "qwen3.8-27b-fp8", + "environment": { + "CT_OFF": "{\"enable_thinking\": false}", + "CT_ON": "{\"enable_thinking\": true}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/qwen38fp8.conf" + }, + { + "id": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）", + "config_name": "qwen38fp8cap", + "url": "http://127.0.0.1:18108", + "model": "qwen3.8-27b-fp8", + "environment": { + "CT_OFF": "{\"enable_thinking\": false}", + "CT_ON": "{\"enable_thinking\": true}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/qwen38fp8cap.conf" + }, + { + "id": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）", + "config_name": "qwen38fp8mtpcap", + "url": "http://127.0.0.1:18109", + "model": "qwen3.8-27b-fp8", + "environment": { + "CT_OFF": "{\"enable_thinking\": false}", + "CT_ON": "{\"enable_thinking\": true}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/qwen38fp8mtpcap.conf" + }, + { + "id": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）", + "config_name": "qwen38fp8tp8", + "url": "http://127.0.0.1:18110", + "model": "qwen3.8-27b-fp8", + "environment": { + "CT_OFF": "{\"enable_thinking\": false}", + "CT_ON": "{\"enable_thinking\": true}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/qwen38fp8tp8.conf" + }, + { + "id": "sglang38", + "label": "sglang38（配置端口 18106）", + "config_name": "sglang38", + "url": "http://127.0.0.1:18106", + "model": "qwen3.8-27b", + "environment": { + "CT_OFF": "{\"enable_thinking\": false}", + "CT_ON": "{\"enable_thinking\": true}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/sglang38.conf" + }, + { + "id": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）", + "config_name": "sglang38fp8", + "url": "http://127.0.0.1:18106", + "model": "qwen3.8-27b-fp8", + "environment": { + "CT_OFF": "{\"enable_thinking\": false}", + "CT_ON": "{\"enable_thinking\": true}", + "MAX_LEN": "262144" + }, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "config_file": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/sglang38fp8.conf" + } + ], + "profiles": [ + { + "id": "gpu-suite", + "source_group": "company-gpu-suite", + "entry": "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/xas-gpu-test.sh", + "interpreter": "/usr/bin/bash", + "user": "root", + "cwd": "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0", + "arguments": [], + "parameters": [], + "environment": {}, + "credential_files": [], + "impact": { + "level": "service", + "title": "进入 GPU 验收原菜单，可能影响整机与模型服务", + "details": [ + "菜单包含 GPU 压力、驱动/环境安装、模型启停、固件切换和重启相关操作；按所选菜单继续确认影响。", + "原入口会初始化既有数据目录，并可能通过 tmux 创建持久会话；取消控制台不证明菜单产生的容器或 tmux 会话已结束。" + ], + "requires_confirmation": true + }, + "interactive": true, + "timeout_seconds": 259200, + "required_tools": [ + "/usr/bin/bash", + "/usr/bin/python3", + "/usr/bin/nvidia-smi", + "/usr/bin/docker", + "/usr/bin/tmux" + ], + "required_files": [ + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/xas-gpu-test.sh", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/report.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/stress_report.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/detail_export.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/stress_metrics.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/db.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/html_to_pdf.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/ai_bench.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/model_catalog.json", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/report_templates.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/report_template_menu.sh", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/gpu_compat.sh", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/ai_runtime.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/ai_environment.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/ai_environment.sh", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/model_manager.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/model_discovery.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/model_downloads.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/llm_planner.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/llm_batch.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/llm_model_environment.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/llm_report.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/llm_menu.sh", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/token_economics.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/token_prices.json", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/ai_menu.sh", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/display_menu.sh", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/bandwidth_audit.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/bandwidth_ab.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/display_switch.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/display_tool.py", + "/XAS/SH/XAS-GPU-Test/XAS-GPU-Test-v3.5.0/display_probe.py", + "/etc/xas-gpu-test/config.env" + ], + "check_ports": [], + "output_paths": [ + "/XAS/GPUTest/runs", + "/XAS/GPUTest/reports" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "原 config.env 的 DATA_ROOT=/XAS/GPUTest。只打开原菜单，不自动输入或选择任何测试项目。", + "原工具创建的 tmux 持久任务可能脱离本次控制台 cgroup；平台取消后必须核查原工具会话和模型容器，不能承诺全部停止。", + "runs/reports 使用原工具的时间戳产物；只收集本次运行新增或发生变化的文件，不预拷整个历史 runs/reports。" + ], + "available": true + }, + { + "id": "deepseek-suite", + "source_group": "dsv41-trial-20261010", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/run-b-suite.sh", + "interpreter": "/usr/bin/bash", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial", + "arguments": [ + "{run_label}", + "{mode}" + ], + "parameters": [ + { + "key": "mode", + "label": "原测试模式", + "type": "select", + "default": "full", + "options": [ + { + "value": "full", + "label": "完整（原默认）" + }, + { + "value": "quick", + "label": "快速" + } + ], + "required": true + } + ], + "environment": {}, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/configs/vllm.env" + ], + "impact": { + "level": "resource", + "title": "向原有模型服务施加并发负载", + "details": [ + "按原流程运行并发请求、性能采样与临时 benchmark 客户端；可能明显影响目标服务的延迟和吞吐。", + "使用既有服务；此入口不会自动启动目标模型。原 Docker 客户端不属于控制台 cgroup，取消后需核对残留容器。" + ], + "requires_confirmation": true + }, + "interactive": false, + "timeout_seconds": 14400, + "required_tools": [ + "/usr/bin/bash", + "/usr/bin/python3", + "/usr/bin/docker", + "/usr/bin/curl", + "/usr/bin/nvidia-smi", + "/usr/bin/timeout" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/run-b-suite.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/configs/vllm.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/spec_prompts.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/spec_bench.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/bench-serve.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/multiturn_cache.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/toolcall_stress.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/curves.py" + ], + "check_ports": [ + 18101 + ], + "output_paths": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/logs/test-{run_label}-*" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "原入口硬编码 B 服务 18101，不会切到 A 的 18100；B 未运行时预检应阻止启动。" + ], + "available": true + }, + { + "id": "model-suite", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/run-suite.sh", + "interpreter": "/usr/bin/bash", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{target_config}", + "{run_label}", + "{mode}" + ], + "parameters": [ + { + "key": "target", + "label": "原服务配置", + "type": "select", + "default": "sglang38fp8", + "options": [ + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "mode", + "label": "原测试模式", + "type": "select", + "default": "full", + "options": [ + { + "value": "full", + "label": "完整（原默认）" + }, + { + "value": "quick", + "label": "快速" + }, + { + "value": "load", + "label": "仅并发负载" + } + ], + "required": true + } + ], + "environment": {}, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "impact": { + "level": "resource", + "title": "向原有模型服务施加并发负载", + "details": [ + "按原流程运行并发请求、性能采样与临时 benchmark 客户端；可能明显影响目标服务的延迟和吞吐。", + "使用既有服务；此入口不会自动启动目标模型。原 Docker 客户端不属于控制台 cgroup，取消后需核对残留容器。" + ], + "requires_confirmation": true + }, + "interactive": false, + "timeout_seconds": 14400, + "required_tools": [ + "/usr/bin/bash", + "/usr/bin/python3", + "/usr/bin/docker", + "/usr/bin/curl", + "/usr/bin/nvidia-smi", + "/usr/bin/timeout" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/run-suite.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/{target_config}.conf", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/spec_prompts.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/spec_bench.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-serve.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/multiturn_cache.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/toolcall_stress.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/functional_check.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/needle.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/curves.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/{target_config}-{run_label}-*" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "Shell 继续读取 configs/{target_config}.conf 的 SERVED、PORT、GPUS、CT_OFF、CT_ON 等原字段；控制台不覆盖这些配置。" + ], + "available": true + }, + { + "id": "functional", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/functional_check.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{output_file}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/functional_check.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。" + ], + "available": true + }, + { + "id": "curves", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/curves.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{mode}", + "{output_file}", + "{lengths}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "mode", + "label": "曲线类型", + "type": "select", + "default": "context", + "options": [ + { + "value": "context", + "label": "输入长度曲线" + }, + { + "value": "output", + "label": "输出长度曲线" + } + ], + "required": true + }, + { + "key": "lengths", + "label": "输入长度档位", + "type": "select", + "default": "1000,8000,32000,128000,256000", + "options": [ + { + "value": "1000,8000,32000,128000,256000", + "label": "原默认 1千 / 8千 / 3.2万 / 12.8万 / 25.6万" + }, + { + "value": "1000,8000,32000", + "label": "1千 / 8千 / 3.2万" + }, + { + "value": "32000", + "label": "3.2万" + } + ], + "required": true, + "help": "输出曲线固定生成 8192 token；该模式忽略输入长度档位。" + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/curves.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。", + "context 长度默认与原脚本一致；超过服务上下文上限会按原脚本返回错误。" + ], + "available": true + }, + { + "id": "language", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/spec_bench.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/qwen38fp8tp8-01-prompts.json", + "{concurrency}", + "{requests}", + "{output_file}", + "--max-tokens", + "{max_tokens}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "concurrency", + "label": "并发数", + "type": "integer", + "default": 1, + "min": 1, + "max": 512, + "required": true + }, + { + "key": "requests", + "label": "正式请求数", + "type": "integer", + "default": 32, + "min": 1, + "max": 100000, + "required": true, + "help": "另外有原脚本固定的 4 次预热请求。" + }, + { + "key": "max_tokens", + "label": "每次最大生成 token", + "type": "integer", + "default": 768, + "min": 1, + "max": 32768, + "required": true + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/spec_bench.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/qwen38fp8tp8-01-prompts.json" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。", + "复用原 logs/qwen38fp8tp8-01-prompts.json；本轮仅核对路径及文件大小，未读取题目内容。", + "保留原温度 0.6、关闭思考、正常采样流程；原 --greedy / --thinking / --logprobs 未在本方案开放。" + ], + "available": true + }, + { + "id": "conversation-cache", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/multiturn_cache.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{output_file}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/multiturn_cache.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。" + ], + "available": true + }, + { + "id": "needle", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/needle.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{input_tokens}", + "{depth}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "input_tokens", + "label": "目标上下文 token", + "type": "integer", + "default": 32000, + "min": 1000, + "max": 1000000, + "required": true + }, + { + "key": "depth", + "label": "目标信息位置比例", + "type": "number", + "default": 0.5, + "min": 0, + "max": 1, + "required": true + }, + { + "key": "max_tokens", + "label": "最大生成 token", + "type": "integer", + "default": 4096, + "min": 1, + "max": 32768, + "required": true + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}", + "NEEDLE_MAX_TOKENS": "{max_tokens}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/needle.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。", + "原入口只向标准输出打印 JSON，不接受结果路径；结果保存在本次控制台运行日志。" + ], + "available": true + }, + { + "id": "concurrent-input", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/concurrent_prefill.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{concurrency}", + "{input_tokens}", + "{output_file}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "concurrency", + "label": "并发数", + "type": "integer", + "default": 4, + "min": 1, + "max": 256, + "required": true + }, + { + "key": "input_tokens", + "label": "每请求输入 token", + "type": "integer", + "default": 32000, + "min": 1000, + "max": 1000000, + "required": true + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/concurrent_prefill.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。", + "原 CLI 的数字参数为必填；表单初值为控制台建议值，不冒充原脚本默认值。" + ], + "available": true + }, + { + "id": "cache-revisit", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/kv_revisit.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{sessions}", + "{input_tokens}", + "{output_file}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "sessions", + "label": "会话数", + "type": "integer", + "default": 8, + "min": 1, + "max": 256, + "required": true + }, + { + "key": "input_tokens", + "label": "每会话输入 token", + "type": "integer", + "default": 32000, + "min": 1000, + "max": 1000000, + "required": true + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/kv_revisit.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。", + "原 CLI 的数字参数为必填；表单初值为控制台建议值，不冒充原脚本默认值。" + ], + "available": true + }, + { + "id": "interference", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/prefill_interference.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{input_tokens}", + "{output_file}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "input_tokens", + "label": "长输入 token", + "type": "integer", + "default": 128000, + "min": 1000, + "max": 1000000, + "required": true + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/prefill_interference.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。", + "原 CLI 的数字参数为必填；表单初值为控制台建议值，不冒充原脚本默认值。" + ], + "available": true + }, + { + "id": "tool-calls", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/toolcall_stress.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{concurrency}", + "{repeats}", + "{output_file}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "concurrency", + "label": "并发数", + "type": "integer", + "default": 16, + "min": 1, + "max": 256, + "required": true + }, + { + "key": "repeats", + "label": "每题重复次数", + "type": "integer", + "default": 4, + "min": 1, + "max": 1000, + "required": true + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/toolcall_stress.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。", + "原 CLI 的数字参数为必填；表单初值为控制台建议值，不冒充原脚本默认值。" + ], + "available": true + }, + { + "id": "throughput", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-serve.sh", + "interpreter": "/usr/bin/bash", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{target_config}", + "{run_label}-throughput.json", + "--dataset-name", + "random", + "--random-input-len", + "{input_tokens}", + "--random-output-len", + "{output_tokens}", + "--random-range-ratio", + "{range_ratio}", + "--num-prompts", + "{requests}", + "--max-concurrency", + "{concurrency}", + "--seed", + "{seed}" + ], + "parameters": [ + { + "key": "target", + "label": "原服务配置", + "type": "select", + "default": "sglang38fp8", + "options": [ + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "input_tokens", + "label": "平均输入 token", + "type": "integer", + "default": 1024, + "min": 1, + "max": 1000000, + "required": true + }, + { + "key": "output_tokens", + "label": "平均生成 token", + "type": "integer", + "default": 512, + "min": 1, + "max": 32768, + "required": true + }, + { + "key": "range_ratio", + "label": "随机长度浮动比例", + "type": "number", + "default": 0, + "min": 0, + "max": 1, + "required": true + }, + { + "key": "requests", + "label": "请求数", + "type": "integer", + "default": 32, + "min": 1, + "max": 1000000, + "required": true + }, + { + "key": "concurrency", + "label": "最大并发数", + "type": "integer", + "default": 4, + "min": 1, + "max": 2048, + "required": true + }, + { + "key": "seed", + "label": "随机种子", + "type": "integer", + "default": 20261013, + "min": 0, + "max": 2147483647, + "required": true + } + ], + "environment": {}, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "impact": { + "level": "resource", + "title": "向原有模型服务施加并发负载", + "details": [ + "按原流程运行并发请求、性能采样与临时 benchmark 客户端；可能明显影响目标服务的延迟和吞吐。", + "使用既有服务；此入口不会自动启动目标模型。原 Docker 客户端不属于控制台 cgroup，取消后需核对残留容器。" + ], + "requires_confirmation": true + }, + "interactive": false, + "timeout_seconds": 14400, + "required_tools": [ + "/usr/bin/bash", + "/usr/bin/python3", + "/usr/bin/docker", + "/usr/bin/curl", + "/usr/bin/nvidia-smi", + "/usr/bin/timeout" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-serve.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/{target_config}.conf" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/{run_label}-throughput.json" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "Shell 继续读取 configs/{target_config}.conf 的 SERVED、PORT、GPUS、CT_OFF、CT_ON 等原字段；控制台不覆盖这些配置。", + "原 Shell 透传的 vllm bench serve 参数限定为上述登记字段；不接受任意额外参数。表单初值是控制台建议值。" + ], + "available": true + }, + { + "id": "math", + "source_group": "dsv41-trial-20261010", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/math_check.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial", + "arguments": [ + "{concurrency}", + "{samples}", + "{output_file}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "concurrency", + "label": "并发数", + "type": "integer", + "default": 4, + "min": 1, + "max": 256, + "required": true + }, + { + "key": "samples", + "label": "每题采样次数", + "type": "integer", + "default": 1, + "min": 1, + "max": 1000, + "required": true, + "help": "原脚本固定生成 32 道题，总请求数为 32 × 采样次数。" + } + ], + "environment": { + "PYTHONUNBUFFERED": "1" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/math_check.py" + ], + "check_ports": [ + 18100 + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。", + "原 CLI 的数字参数为必填；表单初值为控制台建议值，不冒充原脚本默认值。", + "原脚本硬编码 DeepSeek 模型和 18100 地址；本方案固定目标 A。" + ], + "available": true + }, + { + "id": "vision", + "source_group": "dsv41-trial-20261010", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/vision_check.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial", + "arguments": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/logs/test-34-vision-input.png", + "{output_file}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/vision_check.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/logs/test-34-vision-input.png" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。", + "复用原 run-d7v-d8.sh 引用的 test-34-vision-input.png；本轮仅核对文件名及大小，未读取或复制图像内容。", + "原入口分别发送关闭/开启 thinking 的两次看图请求；目标服务需已启用视觉。未自动修改或重启模型。" + ], + "available": true + }, + { + "id": "robust", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/robust_check.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{output_file}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "storm_n", + "label": "断连并发数", + "type": "integer", + "default": 64, + "min": 1, + "max": 256, + "required": true + }, + { + "key": "storm_rounds", + "label": "断连轮数", + "type": "integer", + "default": 5, + "min": 1, + "max": 100, + "required": true + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}", + "STORM_N": "{storm_n}", + "STORM_ROUNDS": "{storm_rounds}" + }, + "credential_files": [], + "impact": { + "level": "resource", + "title": "执行断连风暴及超长异常请求", + "details": [ + "原默认是 64 路并发、5 轮断连，并发送超过目标上下文上限的输入/输出等异常请求，可能短时影响目标服务。", + "MAX_LEN 来自登记目标的原启动配置，运行前需核对服务实际配置是否仍一致。" + ], + "requires_confirmation": true + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/robust_check.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。" + ], + "available": true + }, + { + "id": "agent", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/agent_sim.py", + "interpreter": "/usr/bin/python3", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{target_url}", + "{target_model}", + "{sessions}", + "{turns}", + "{context_tokens}", + "{new_tokens}", + "{output_tokens}", + "{seed}", + "{output_file}" + ], + "parameters": [ + { + "key": "target", + "label": "目标服务", + "type": "select", + "default": "deepseek-a", + "options": [ + { + "value": "deepseek-a", + "label": "DeepSeek A（原服务，18100）" + }, + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "sessions", + "label": "每地址会话数", + "type": "integer", + "default": 4, + "min": 1, + "max": 512, + "required": true + }, + { + "key": "turns", + "label": "每会话轮数", + "type": "integer", + "default": 4, + "min": 1, + "max": 1000, + "required": true + }, + { + "key": "context_tokens", + "label": "固定上下文 token", + "type": "integer", + "default": 8192, + "min": 0, + "max": 1000000, + "required": true + }, + { + "key": "new_tokens", + "label": "每轮新增 token", + "type": "integer", + "default": 1024, + "min": 0, + "max": 1000000, + "required": true + }, + { + "key": "output_tokens", + "label": "每轮生成 token", + "type": "integer", + "default": 256, + "min": 1, + "max": 32768, + "required": true + }, + { + "key": "seed", + "label": "随机种子", + "type": "integer", + "default": 20261013, + "min": 0, + "max": 2147483647, + "required": true + }, + { + "key": "agent_mode", + "label": "上下文增长方式", + "type": "select", + "default": "replace", + "options": [ + { + "value": "replace", + "label": "替换新增段（原默认）" + }, + { + "value": "append", + "label": "逐轮追加" + } + ], + "required": true + } + ], + "environment": { + "PYTHONUNBUFFERED": "1", + "SPEC_URLS": "{target_url}", + "MODEL": "{target_model}", + "AGENT_MODE": "{agent_mode}" + }, + "credential_files": [], + "impact": { + "level": "standard", + "title": "向已运行服务发送测试请求", + "details": [ + "原脚本按既定用例调用目标接口，可能影响该服务的响应时间。" + ], + "requires_confirmation": false + }, + "interactive": false, + "timeout_seconds": 7200, + "required_tools": [ + "/usr/bin/python3" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/agent_sim.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "{output_file}" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "通过所选目标的原认证文件在运行时加载 VLLM_API_KEY；不在参数或日志中显示值。", + "原 CLI 数字参数全部必填；表单初值是控制台建议值。", + "输入使用原脚本生成的随机 token 编号；append 模式每轮增长，超过目标上下文限制会失败。" + ], + "available": true + }, + { + "id": "replicas", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/run-replicas.sh", + "interpreter": "/usr/bin/bash", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{target_config}", + "{run_label}", + "8" + ], + "parameters": [ + { + "key": "target", + "label": "原实例配置", + "type": "select", + "default": "qwen38fp8cap", + "options": [ + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + } + ], + "required": true, + "help": "请选择当前 18110–18117 上已有 8 份服务对应的原配置。" + } + ], + "environment": {}, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "impact": { + "level": "resource", + "title": "向原有模型服务施加并发负载", + "details": [ + "按原流程运行并发请求、性能采样与临时 benchmark 客户端；可能明显影响目标服务的延迟和吞吐。", + "使用既有服务；此入口不会自动启动目标模型。原 Docker 客户端不属于控制台 cgroup，取消后需核对残留容器。" + ], + "requires_confirmation": true + }, + "interactive": false, + "timeout_seconds": 14400, + "required_tools": [ + "/usr/bin/bash", + "/usr/bin/python3", + "/usr/bin/docker", + "/usr/bin/curl", + "/usr/bin/nvidia-smi", + "/usr/bin/timeout", + "/usr/bin/vmstat" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/run-replicas.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/{target_config}.conf", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/spec_prompts.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/spec_bench.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-replicas.sh" + ], + "check_ports": [ + 18110, + 18111, + 18112, + 18113, + 18114, + 18115, + 18116, + 18117 + ], + "output_paths": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/{target_config}-{run_label}-*" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "Shell 继续读取 configs/{target_config}.conf 的 SERVED、PORT、GPUS、CT_OFF、CT_ON 等原字段；控制台不覆盖这些配置。", + "保留原默认 8 份、GPU_LIST=8 9 10 11 12 13 14 15、端口 18110–18117，以及原 NAT_LEVELS/RAND_LEVELS；控制台本方案固定此组合。", + "只检测并使用已启动的 8 个实例，不调用 serve-replicas.sh。所选配置自身 PORT 不代表此入口的实例端口。" + ], + "available": true + }, + { + "id": "engine-comparison", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/run-compare.sh", + "interpreter": "/usr/bin/bash", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{target_config}", + "{run_label}" + ], + "parameters": [ + { + "key": "target", + "label": "原服务配置", + "type": "select", + "default": "sglang38fp8", + "options": [ + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + } + ], + "environment": {}, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "impact": { + "level": "resource", + "title": "向原有模型服务施加并发负载", + "details": [ + "按原流程运行并发请求、性能采样与临时 benchmark 客户端；可能明显影响目标服务的延迟和吞吐。", + "使用既有服务；此入口不会自动启动目标模型。原 Docker 客户端不属于控制台 cgroup，取消后需核对残留容器。" + ], + "requires_confirmation": true + }, + "interactive": false, + "timeout_seconds": 14400, + "required_tools": [ + "/usr/bin/bash", + "/usr/bin/python3", + "/usr/bin/docker", + "/usr/bin/curl", + "/usr/bin/nvidia-smi", + "/usr/bin/timeout" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/run-compare.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/{target_config}.conf", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/spec_prompts.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/spec_bench.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-serve.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/curves.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/{target_config}-{run_label}-*" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "Shell 继续读取 configs/{target_config}.conf 的 SERVED、PORT、GPUS、CT_OFF、CT_ON 等原字段；控制台不覆盖这些配置。", + "保留原 NAT_LEVELS、THINK_N=16、RAND_LEVELS、LONG=32000、SEED_BASE=5000；本入口测试所选已运行配置，并不自行切换引擎。" + ], + "available": true + }, + { + "id": "soak", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/soak.sh", + "interpreter": "/usr/bin/bash", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [ + "{target_config}", + "{run_label}", + "{concurrency}", + "{requests}", + "{long_inputs}" + ], + "parameters": [ + { + "key": "target", + "label": "原服务配置", + "type": "select", + "default": "sglang38fp8", + "options": [ + { + "value": "dsv41cap", + "label": "dsv41cap（配置端口 18110）" + }, + { + "value": "glm53", + "label": "glm53（配置端口 18102）" + }, + { + "value": "mimo", + "label": "mimo（配置端口 18104）" + }, + { + "value": "qwen27b", + "label": "qwen27b（配置端口 18103）" + }, + { + "value": "qwen27btp8", + "label": "qwen27btp8（配置端口 18103）" + }, + { + "value": "qwen38cap", + "label": "qwen38cap（配置端口 18107）" + }, + { + "value": "qwen38fp8", + "label": "qwen38fp8（配置端口 18105）" + }, + { + "value": "qwen38fp8cap", + "label": "qwen38fp8cap（配置端口 18108）" + }, + { + "value": "qwen38fp8mtpcap", + "label": "qwen38fp8mtpcap（配置端口 18109）" + }, + { + "value": "qwen38fp8tp8", + "label": "qwen38fp8tp8（配置端口 18110）" + }, + { + "value": "sglang38", + "label": "sglang38（配置端口 18106）" + }, + { + "value": "sglang38fp8", + "label": "sglang38fp8（配置端口 18106）" + } + ], + "required": true, + "help": "配置存在不代表服务正在运行；预检仅检查端口，不自动启动模型。" + }, + { + "key": "concurrency", + "label": "并发数", + "type": "integer", + "default": 32, + "min": 1, + "max": 2048, + "required": true + }, + { + "key": "requests", + "label": "主负载请求数", + "type": "integer", + "default": 3200, + "min": 1, + "max": 10000000, + "required": true + }, + { + "key": "long_inputs", + "label": "长输入次数上限", + "type": "integer", + "default": 12, + "min": 0, + "max": 864, + "required": true + } + ], + "environment": {}, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "impact": { + "level": "resource", + "title": "向原有模型服务施加并发负载", + "details": [ + "按原流程运行并发请求、性能采样与临时 benchmark 客户端；可能明显影响目标服务的延迟和吞吐。", + "使用既有服务；此入口不会自动启动目标模型。原 Docker 客户端不属于控制台 cgroup，取消后需核对残留容器。" + ], + "requires_confirmation": true + }, + "interactive": false, + "timeout_seconds": 259200, + "required_tools": [ + "/usr/bin/bash", + "/usr/bin/python3", + "/usr/bin/docker", + "/usr/bin/curl", + "/usr/bin/nvidia-smi", + "/usr/bin/timeout" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/soak.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/{target_config}.conf", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-serve.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/concurrent_prefill.py" + ], + "check_ports": [ + "{target_port}" + ], + "output_paths": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/{target_config}-{run_label}-*" + ], + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "Shell 继续读取 configs/{target_config}.conf 的 SERVED、PORT、GPUS、CT_OFF、CT_ON 等原字段；控制台不覆盖这些配置。", + "32 / 3200 / 12 为原 CLI 默认；按请求数决定时长。原遥测 timeout 固定 14400 秒，延长控制台超时不会延长原遥测覆盖。" + ], + "available": true + }, + { + "id": "capacity", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/cap-8x-chain.sh", + "interpreter": "/usr/bin/bash", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [], + "parameters": [], + "environment": {}, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/configs/vllm.env" + ], + "impact": { + "level": "service", + "title": "停止 DeepSeek A，并进行 16 卡整机满载测试", + "details": [ + "原链先使用 GPU 8–15，随后停止 DeepSeek A，使用 GPU 0–15，启停多套模型及 16 个 Qwen 实例。", + "原 EXIT trap 会尝试按 start-rec.sh 重启 A；失败、超时或取消不能保证恢复原状态。", + "原日志和结果名称固定，可能覆盖已有 dsv41cap、glm53、mimo、qwen38fp8tp8、qwen38fp8cap 结果；需逐次确认并保全历史文件。" + ], + "requires_confirmation": true + }, + "interactive": false, + "timeout_seconds": 259200, + "required_tools": [ + "/usr/bin/bash", + "/usr/bin/python3", + "/usr/bin/docker", + "/usr/bin/curl", + "/usr/bin/nvidia-smi", + "/usr/bin/timeout", + "/usr/bin/pgrep", + "/usr/bin/setsid", + "/usr/bin/vmstat" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/cap-8x-chain.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/configs/vllm.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/serve-sets.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/serve-replicas.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/stop-model.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-multi.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/run-replicas.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/run-compare.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-replicas.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-serve.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/spec_prompts.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/spec_bench.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/curves.py", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/dsv41cap.conf", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/glm53.conf", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/mimo.conf", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/qwen38fp8tp8.conf", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/qwen38fp8cap.conf", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/phaseb-levels.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/start-rec.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/serve.sh" + ], + "check_ports": [], + "output_paths": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/dsv41cap-01-*", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/dsv41cap-02-*", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/glm53-11-*", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/glm53-12-*", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/mimo-11-*", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/mimo-12-*", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/qwen38fp8tp8-01-*", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/qwen38fp8cap-02-*", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/serve-dsv41cap-x01-g8.log", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/serve-dsv41cap-x02-g*.log", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/serve-glm53-x11-g8.log", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/serve-glm53-x12-g*.log", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/serve-mimo-x11-g8.log", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/serve-mimo-x12-g*.log", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/serve-qwen38fp8tp8-a1-g8.log", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/serve-qwen38fp8cap-x16-g*.log", + "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/logs/serve-r7-rec-pin.log" + ], + "preserve_existing_outputs": true, + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "原入口无位置参数；不伪造可配置的编号或输出路径。原链使用固定历史文件名，再次运行可能覆盖同名结果，应在确认前检查并保全相关历史文件。" + ], + "available": true + }, + { + "id": "cost", + "source_group": "model-trials-20261011", + "entry": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/value-chain.sh", + "interpreter": "/usr/bin/bash", + "user": "root", + "cwd": "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials", + "arguments": [], + "parameters": [], + "environment": {}, + "credential_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env" + ], + "impact": { + "level": "service", + "title": "启停 GPU 8–15 上的性能与成本测试模型", + "details": [ + "原链等待 cap-8x-chain.sh 退出，再检查 GPU 8–15 显存并启动/停止 DeepSeek 与 8 份 Qwen 模型。", + "原结果使用固定 dsv41v-*、qwen38v-* 名称，可能覆盖历史结果。", + "该入口产生本机性能证据，成本折算和报告仍按原配套脚本处理；不代表本轮已验证价格口径。" + ], + "requires_confirmation": true + }, + "interactive": false, + "timeout_seconds": 259200, + "required_tools": [ + "/usr/bin/bash", + "/usr/bin/python3", + "/usr/bin/docker", + "/usr/bin/curl", + "/usr/bin/nvidia-smi", + "/usr/bin/timeout", + "/usr/bin/pgrep", + "/usr/bin/setsid", + "/usr/bin/vmstat" + ], + "required_files": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/value-chain.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/vllm.env", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/serve-sets.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/serve-replicas.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/stop-model.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-multi.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/scripts/bench-one.sh", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/dsv41cap.conf", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/configs/qwen38fp8cap.conf" + ], + "check_ports": [], + "output_paths": [ + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/dsv41v-*", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/qwen38v-*", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/serve-dsv41cap-xv-g8.log", + "/dengyuyun-joy-work-space/workpc-claude-code/20261011-model-trials/logs/serve-qwen38fp8cap-xv8-g*.log" + ], + "preserve_existing_outputs": true, + "notes": [ + "2026-10-13 只读核对原源码；启动方案登记不代表本轮业务测试通过。", + "原入口无位置参数；不伪造可配置的编号或输出路径。原链使用固定历史文件名，再次运行可能覆盖同名结果，应在确认前检查并保全相关历史文件。" + ], + "available": true + } + ] +} diff --git a/catalog/test-definitions.json b/catalog/test-definitions.json new file mode 100644 index 0000000..606020e --- /dev/null +++ b/catalog/test-definitions.json @@ -0,0 +1,574 @@ +{ + "schema_version": 1, + "reviewed_at": "2026-10-13", + "basis": "Reviewed README entry points, script purpose comments and call references; registration does not authorize service/GPU actions.", + "example_script_ids": [ + "499b615a7dc7435eb30789b7a7dc090e", + "fe5a2b28c8b4449591ef55bd88299a6d" + ], + "tests": [ + { + "key": "gpu-suite", + "source_group": "company-gpu-suite", + "entry": "xas-gpu-test.sh", + "name": "GPU 综合验收套件", + "description": "公司 XAS GPU Test v3.5.0 的统一入口，包含硬件压力、多卡通信、模型性能及报告。内部模块和套件自身测试统一收在详情中。", + "kind": "suite", + "members": [ + { + "source_group": "company-gpu-suite", + "pattern": "**/*" + } + ] + }, + { + "key": "deepseek-suite", + "source_group": "dsv41-trial-20261010", + "entry": "run-b-suite.sh", + "name": "DeepSeek 综合性能测试", + "description": "在第二套 DeepSeek 服务上完成单路曲线、并发吞吐、自然语言生成、多轮缓存和工具调用的一整轮测试。", + "kind": "suite", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "bench-serve.sh" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "curves.py" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "multiturn_cache.py" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "spec_bench.py" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "spec_prompts.py" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "toolcall_stress.py" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "run-report-phase*.sh", + "role": "variant" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "run-d2.sh", + "role": "variant" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "run-d3.sh", + "role": "variant" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "run-d456.sh", + "role": "variant" + } + ] + }, + { + "key": "model-suite", + "source_group": "model-trials-20261011", + "entry": "run-suite.sh", + "name": "模型综合测试套件", + "description": "面向被测模型的一整轮速度、长上下文、功能与稳定性测试。不同模型的历史调度脚本收在相关文件中。", + "kind": "suite", + "members": [ + { + "source_group": "model-trials-20261011", + "pattern": "bench-serve.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "curves.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "functional_check.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "multiturn_cache.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "needle.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "spec_bench.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "spec_prompts.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "toolcall_stress.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "run-glm-chain.sh", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "run-mimo-chain.sh", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "run-qwen-chain.sh", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "serve-model.sh", + "role": "variant" + } + ] + }, + { + "key": "functional", + "source_group": "model-trials-20261011", + "entry": "functional_check.py", + "name": "模型功能检查", + "description": "检查接口功能、结构化输出、多轮交互等可用性，不等同于答案准确率评测。", + "kind": "test", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "functional_check.py", + "role": "variant" + } + ] + }, + { + "key": "curves", + "source_group": "model-trials-20261011", + "entry": "curves.py", + "name": "单路性能曲线", + "description": "单请求逐项测量生成长度和上下文长度变化时的性能曲线。", + "kind": "test", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "curves.py", + "role": "variant" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "run-curves.sh", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "context_probe.py", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "run-mimo-recheck.sh", + "role": "variant" + } + ] + }, + { + "key": "language", + "source_group": "model-trials-20261011", + "entry": "spec_bench.py", + "name": "自然语言生成速度", + "description": "用固定自然语言题库测量生成速度、并发和不同解码设置的表现。", + "kind": "test", + "members": [ + { + "source_group": "model-trials-20261011", + "pattern": "spec_prompts.py" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "spec_bench.py", + "role": "variant" + } + ] + }, + { + "key": "conversation-cache", + "source_group": "model-trials-20261011", + "entry": "multiturn_cache.py", + "name": "多轮对话缓存效果", + "description": "模拟多轮对话，观察前缀缓存对每轮首字时间的影响。", + "kind": "test", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "multiturn_cache.py", + "role": "variant" + } + ] + }, + { + "key": "needle", + "source_group": "model-trials-20261011", + "entry": "needle.py", + "name": "长上下文检索", + "description": "在指定上下文长度和位置中检索目标信息，检查长上下文能力。", + "kind": "test", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "needle.py", + "role": "variant" + } + ] + }, + { + "key": "concurrent-input", + "source_group": "model-trials-20261011", + "entry": "concurrent_prefill.py", + "name": "并发长输入读入", + "description": "检查多个长输入同时到达时的读入表现。", + "kind": "test", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "concurrent_prefill.py", + "role": "variant" + } + ] + }, + { + "key": "cache-revisit", + "source_group": "model-trials-20261011", + "entry": "kv_revisit.py", + "name": "长会话缓存回访", + "description": "检查长会话缓存被挤出后再次访问时的等待时间。", + "kind": "test", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "kv_revisit.py", + "role": "variant" + } + ] + }, + { + "key": "interference", + "source_group": "model-trials-20261011", + "entry": "prefill_interference.py", + "name": "长输入对聊天延迟的影响", + "description": "测量超长输入进入时，对其他交互请求延迟造成的影响。", + "kind": "test", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "prefill_interference.py", + "role": "variant" + } + ] + }, + { + "key": "tool-calls", + "source_group": "model-trials-20261011", + "entry": "toolcall_stress.py", + "name": "工具调用并发稳定性", + "description": "检查并发工具调用、参数 JSON 和必填字段的稳定性。", + "kind": "test", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "toolcall_stress.py", + "role": "variant" + } + ] + }, + { + "key": "throughput", + "source_group": "model-trials-20261011", + "entry": "bench-serve.sh", + "name": "单服务并发吞吐", + "description": "对一个已部署的模型服务测量不同并发下的吞吐和延迟。", + "kind": "test", + "members": [ + { + "source_group": "model-trials-20261011", + "pattern": "bench-one.sh" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "bench-serve.sh", + "role": "variant" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "bench.py", + "role": "variant" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "run-fresh-seed-dsv41.sh", + "role": "variant" + } + ] + }, + { + "key": "math", + "source_group": "dsv41-trial-20261010", + "entry": "math_check.py", + "name": "数学应用题回归", + "description": "通过可自动判对错的算术应用题检查解码配置变更后是否出现明显退化。", + "kind": "test", + "members": [] + }, + { + "key": "vision", + "source_group": "dsv41-trial-20261010", + "entry": "vision_check.py", + "name": "图片理解功能检查", + "description": "检查模型图片输入功能是否可用，需要准备图片素材。", + "kind": "test", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "run-d7v-d8.sh", + "role": "variant" + } + ] + }, + { + "key": "robust", + "source_group": "model-trials-20261011", + "entry": "robust_check.py", + "name": "异常输入与断连检查", + "description": "检查异常输入、请求中断等情况下的模型服务稳定性。", + "kind": "test", + "members": [] + }, + { + "key": "agent", + "source_group": "model-trials-20261011", + "entry": "agent_sim.py", + "name": "Agent 多轮场景测试", + "description": "用多轮 Agent 场景请求测量运行表现和 token 消耗，汇总脚本和历史调度链作为配套文件。", + "kind": "test", + "members": [ + { + "source_group": "model-trials-20261011", + "pattern": "agent_summary.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "agent-chain.sh" + } + ] + }, + { + "key": "replicas", + "source_group": "model-trials-20261011", + "entry": "run-replicas.sh", + "name": "多实例并行吞吐", + "description": "测量多个模型实例同时运行时的合计能力；实例数、GPU 和端口仍由原配置确定。", + "kind": "suite", + "members": [ + { + "source_group": "model-trials-20261011", + "pattern": "bench-replicas.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "bench-multi.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "spec_bench.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "spec_prompts.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "serve-replicas.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "serve-sets.sh" + } + ] + }, + { + "key": "engine-comparison", + "source_group": "model-trials-20261011", + "entry": "run-compare.sh", + "name": "推理引擎与解码配置对比", + "description": "比较推理引擎、权重精度和解码配置的速度表现；同类历史对照脚本不再单独平铺。", + "kind": "suite", + "members": [ + { + "source_group": "model-trials-20261011", + "pattern": "bench-serve.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "curves.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "spec_bench.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "spec_prompts.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "qwen38-compare-chain.sh", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "qwen38-fast-chain.sh", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "qwen38-sglang-track.sh", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "run-glm-mtp-retry.sh", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "run-qwen-pin-check.sh", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "run-qwen-shm-check.sh", + "role": "variant" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "run-spec-compare.sh", + "role": "variant" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "run-dspark-tests.sh", + "role": "variant" + } + ] + }, + { + "key": "soak", + "source_group": "model-trials-20261011", + "entry": "soak.sh", + "name": "长时间稳定性测试", + "description": "持续施加并发和长输入负载，观察失败、吞吐和资源变化。", + "kind": "suite", + "members": [ + { + "source_group": "model-trials-20261011", + "pattern": "bench-serve.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "concurrent_prefill.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "soak24-chain.sh", + "role": "variant" + }, + { + "source_group": "dsv41-trial-20261010", + "pattern": "run-d8.sh", + "role": "variant" + } + ] + }, + { + "key": "capacity", + "source_group": "model-trials-20261011", + "entry": "cap-8x-chain.sh", + "name": "单卡与整机并发上限", + "description": "测量单卡或单套服务的并发上限，以及多实例整机满载表现。", + "kind": "suite", + "members": [ + { + "source_group": "model-trials-20261011", + "pattern": "bench-multi.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "serve-replicas.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "serve-sets.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "qwen38-cap-chain.sh", + "role": "variant" + }, + { + "source_group": "model-trials-20261011", + "pattern": "x16-chain.sh", + "role": "variant" + } + ] + }, + { + "key": "cost", + "source_group": "model-trials-20261011", + "entry": "value-chain.sh", + "name": "性能与成本评估", + "description": "按聊天、检索和代码生成场景测量性能，结合既定价格口径汇总成本。", + "kind": "suite", + "members": [ + { + "source_group": "model-trials-20261011", + "pattern": "bench-multi.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "bench-one.sh" + }, + { + "source_group": "model-trials-20261011", + "pattern": "value_ladder.py" + }, + { + "source_group": "model-trials-20261011", + "pattern": "value2-chain.sh", + "role": "variant" + } + ] + }, + { + "key": "light-smoke", + "managed_profile": "legacy_smoke", + "kind": "test", + "members": [ + { + "source_group": "dsv41-trial-20261010", + "pattern": "smoke.sh", + "role": "variant" + } + ] + } + ] +} diff --git a/console/__init__.py b/console/__init__.py new file mode 100644 index 0000000..5ec2b6a --- /dev/null +++ b/console/__init__.py @@ -0,0 +1 @@ +"""XAS dedicated script console.""" diff --git a/console/app.py b/console/app.py new file mode 100644 index 0000000..2a3ed69 --- /dev/null +++ b/console/app.py @@ -0,0 +1,297 @@ +"""LAN-only HTTP interface; does not spawn processes or access Docker.""" +import hashlib +import ipaddress +from pathlib import Path +from typing import Annotated +from urllib.parse import urlsplit +import uuid +from fastapi import FastAPI, File, Form, HTTPException, Query, Request, UploadFile +from fastapi.responses import FileResponse, JSONResponse, RedirectResponse +from fastapi.staticfiles import StaticFiles +from pydantic import BaseModel, ConfigDict, Field +from . import catalog +from . import test_catalog +from . import native_plans, native_io +from .settings import Settings +from .store import Store, TERMINAL, now + + +class ConfigPatch(BaseModel): + model_config = ConfigDict(extra="forbid") + args: list[str] | None = None + cwd: str | None = None + output_paths: list[str] | None = None + timeout_seconds: Annotated[int, Field(strict=True)] | None = None + native_options: dict[str, str | int | float | bool] | None = None + + +class ScriptPatch(BaseModel): + model_config = ConfigDict(extra="forbid") + name: str | None = Field(default=None, min_length=1, max_length=120) + description: str | None = Field(default=None, max_length=4000) + enabled: bool | None = None + config: ConfigPatch | None = None + + +class RunRequest(BaseModel): + model_config = ConfigDict(extra="forbid") + request_id: uuid.UUID + plan_token: str | None = Field(default=None, max_length=64) + impact_acknowledged: bool = False + + +class NativeInput(BaseModel): + model_config = ConfigDict(extra="forbid") + text: str = Field(max_length=1024) + + +def create_app(settings=None): + settings = settings or Settings.from_env() + store = Store(settings) + app = FastAPI(title="XAS 测试控制台", docs_url=None, redoc_url=None, openapi_url=None) + app.state.store = store + static = Path(__file__).parent / "static" + + @app.middleware("http") + async def boundaries(request, call_next): + host = request.headers.get("host", "") + try: + address = ipaddress.ip_address(request.client.host) + allowed = any(address in ipaddress.ip_network(n) for n in settings.allowed_networks) + except ValueError: + allowed = False + if host not in settings.allowed_hosts or not allowed: + return JSONResponse({"detail": "仅允许公司内网访问"}, status_code=403) + if request.method not in {"GET", "HEAD", "OPTIONS"}: + origin = request.headers.get("origin") + valid_origin = not origin or origin == f"{request.url.scheme}://{host}" + if (not valid_origin or request.headers.get("x-xas-console") != "1" + or request.headers.get("sec-fetch-site") == "cross-site"): + return JSONResponse({"detail": "请求来源校验失败，请从控制台页面操作"}, status_code=403) + try: + size = int(request.headers.get("content-length", "0")) + except ValueError: + size = -1 + if size < 0 or size > settings.max_upload + 65536 or "transfer-encoding" in request.headers: + return JSONResponse({"detail": "请求超过大小限制"}, status_code=413) + response = await call_next(request) + response.headers["Cache-Control"] = "no-store" + response.headers["X-Content-Type-Options"] = "nosniff" + response.headers["Referrer-Policy"] = "same-origin" + response.headers["Content-Security-Policy"] = "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'" + return response + + @app.exception_handler(ValueError) + async def value_error(request, exc): + return JSONResponse({"detail": str(exc)}, status_code=400) + + @app.exception_handler(KeyError) + async def missing(request, exc): + return JSONResponse({"detail": str(exc.args[0])}, status_code=404) + + @app.get("/api/summary") + def summary(): + inventory, runs = store.scripts(), store.runs(limit=10000) + scripts = test_catalog.tests(settings, inventory) + # No directory recursion on every page refresh; size derives from recorded artifacts. + size = sum(a["size"] for r in runs for a in r.get("artifacts", [])) + return {"scripts": len(scripts), "source_files": len(inventory), + "examples": len(test_catalog.tests(settings, inventory, True)) - len(scripts), + "ready": sum(s["enabled"] for s in scripts), "runs": len(runs), + "active": sum(r["state"] in {"queued", "running"} for r in runs), "worker": store.health(), + "storage": {"run_bytes": size}, "limits": {"upload_bytes": settings.max_upload, + "log_bytes": settings.max_log, "concurrency": 1, "timeout_seconds": 7200}} + + @app.get("/api/scripts") + def scripts(include_examples: bool = False): + return {"items": test_catalog.tests(settings, store.scripts(), include_examples)} + + @app.post("/api/scripts/upload") + async def new_script(file: UploadFile, name: Annotated[str, Form()] = "", description: Annotated[str, Form()] = ""): + try: + item = catalog.upload(store, await file.read(settings.max_upload + 1), file.filename, name, description) + return store.script(item["id"], versions=True) + finally: + await file.close() + + @app.get("/api/scripts/{identity}") + def script(identity: str): + return test_catalog.describe(settings, store.script(identity, versions=True), store.scripts()) + + @app.get("/api/scripts/{identity}/files") + def script_files(identity: str): + return {"items": test_catalog.members(settings, store.script(identity), store.scripts())} + + @app.post("/api/scripts/{identity}/versions") + async def new_version(identity: str, file: UploadFile): + try: + catalog.upload(store, await file.read(settings.max_upload + 1), file.filename, identity=identity) + return store.script(identity, versions=True) + finally: + await file.close() + + def source_version(identity, version): + item = store.script(identity) + if item["kind"] == "managed" and version: + v = store.version(identity, version) + item.update(source_path=v["path"], sha256=v["sha256"]) + elif version and version != item["version"]: + raise ValueError("原位置脚本仅展示当前文件，历史运行请查看运行归档") + return item + + @app.get("/api/scripts/{identity}/code") + def code(identity: str, version: int | None = None): + return catalog.read_code(settings, source_version(identity, version)) + + @app.get("/api/scripts/{identity}/download") + def download_source(identity: str, version: int | None = None): + item = source_version(identity, version) + source = catalog.read_code(settings, item) + if source["redacted"]: + raise ValueError("包含疑似凭据的原文件不能下载") + return FileResponse(catalog.script_path(settings, item), filename=source["filename"], media_type="text/plain") + + @app.patch("/api/scripts/{identity}") + def update_script(identity: str, patch: ScriptPatch): + # Serialize with version uploads to avoid restoring an obsolete current-version pointer. + import json + with store.connect(write=True) as db: + row = db.execute("SELECT data FROM scripts WHERE id=?", (identity,)).fetchone() + if not row: + raise KeyError("脚本不存在") + item = json.loads(row[0]) + if not test_catalog.is_entry(settings, item): + raise ValueError("此文件属于内部源码，请从测试项目入口配置和运行") + values = patch.model_dump(exclude_none=True) + if "config" in values: + config_patch = values.pop("config") + if native_plans.profile_for(settings, item) and set(config_patch) - {"native_options", "timeout_seconds"}: + raise ValueError("原环境入口、目录和输出规则由已登记方案管理") + item["config"] = catalog.validate_config(settings, item, {**item["config"], **config_patch}) + if values.get("enabled"): + native = native_plans.profile_for(settings, item) + blocked = not native.get("available", True) if native else item.get("blocked") + if blocked or item["status"] == "missing": + raise ValueError(item["reason"] or "此脚本暂不能启用") + catalog.script_path(settings, item) + item["config"] = catalog.validate_config(settings, item, item["config"]) + item.update(values, updated_at=now()) + item["status"] = "ready" if item["enabled"] else "needs_configuration" + item["reason"] = "" if item["enabled"] else (item.get("reason") or "已停用") + db.execute("UPDATE scripts SET data=? WHERE id=?", (json.dumps(item), identity)) + return store.script(identity, versions=True) + + @app.post("/api/discover") + def discover(): + result = catalog.discover(store) + result["tests"] = len(test_catalog.tests(settings, store.scripts())) + return result + + @app.post("/api/scripts/{identity}/runs") + def run_script(identity: str, body: RunRequest, request: Request): + script = test_catalog.describe(settings, store.script(identity), store.scripts()) + if not script["is_test"]: + raise ValueError("此文件属于内部源码，不能作为独立测试运行") + if not script["enabled"] or script["status"] != "ready": + raise ValueError(script["reason"] or "请先配置并启用脚本") + if native_plans.profile_for(settings, script): + return native_io.request(settings, {"op": "queue", "script_id": identity, + "request_id": str(body.request_id), "plan_token": body.plan_token, + "impact_acknowledged": body.impact_acknowledged, "source_ip": request.client.host}) + source = catalog.script_path(settings, script).read_bytes() + if hashlib.sha256(source).hexdigest() != script["sha256"]: + raise ValueError("原脚本已变动，请刷新目录并重新确认配置") + if catalog.SECRET.search(catalog.clean_source(source)): + raise ValueError("源文件包含疑似凭据，暂不执行") + return store.queue(script, str(body.request_id), request.client.host) + + @app.post("/api/scripts/{identity}/preflight") + def preflight(identity: str): + item = store.script(identity) + if not native_plans.profile_for(settings, item): + raise ValueError("此项目使用隔离容器，无原环境启动方案") + return native_io.request(settings, {"op": "preflight", "script_id": identity}) + + @app.post("/api/runs/{identity}/input") + def native_input(identity: str, body: NativeInput): + return native_io.request(settings, {"op": "input", "run_id": identity, "text": body.text}) + + @app.get("/api/runs") + def runs(script_id: str | None = None, limit: int = Query(default=100, ge=1, le=500)): + return {"items": store.runs(script_id, limit)} + + @app.get("/api/runs/{identity}") + def run(identity: str): + return store.run(identity) + + @app.post("/api/runs/{identity}/cancel") + def cancel(identity: str): + return store.cancel(identity) + + def run_path(identity, filename): + store.run(identity) + root = catalog.safe_path(settings.runs / identity, settings.runs, must_exist=False) + return catalog.safe_path(root / filename, root, must_exist=False) + + @app.get("/api/runs/{identity}/log") + def log(identity: str, offset: int = Query(default=0, ge=0)): + item = store.run(identity) + path = run_path(identity, "console.log") + data = b"" + at_eof = True + if path.exists(): + with path.open("rb") as handle: + handle.seek(min(offset, path.stat().st_size)) + offset = handle.tell() + data = handle.read(65536) + at_eof = offset + len(data) >= path.stat().st_size + # Keep any incomplete UTF-8 tail for the next poll. + import codecs + decoder = codecs.getincrementaldecoder("utf-8")("replace") + text = decoder.decode(data, final=item["state"] in TERMINAL and at_eof) + pending = len(decoder.getstate()[0]) + else: + text, pending = "", 0 + return {"text": text, "next_offset": offset + len(data) - pending, + "done": item["state"] in TERMINAL and len(data) < 65536, + "truncated": path.exists() and path.stat().st_size >= settings.max_log} + + @app.get("/api/runs/{identity}/log/download") + def log_download(identity: str): + path = run_path(identity, "console.log") + if not path.is_file(): + raise KeyError("日志尚未生成") + return FileResponse(path, filename=f"{identity}.log", media_type="text/plain") + + def artifact_path(identity, artifact_id): + item = store.run(identity) + artifact = next((a for a in item.get("artifacts", []) if a["id"] == artifact_id), None) + if not artifact: + raise KeyError("结果文件不存在") + return run_path(identity, "artifacts/" + artifact["id"]), artifact + + @app.get("/api/runs/{identity}/artifacts/{artifact_id}/preview") + def artifact_preview(identity: str, artifact_id: str): + path, artifact = artifact_path(identity, artifact_id) + if artifact["kind"] not in {"text", "json"}: + raise ValueError("此文件只支持下载") + with path.open("rb") as handle: + data = handle.read(262145) + return {"text": data[:262144].decode("utf-8", errors="replace"), "truncated": len(data) > 262144} + + @app.get("/api/runs/{identity}/artifacts/{artifact_id}") + def artifact_download(identity: str, artifact_id: str): + path, artifact = artifact_path(identity, artifact_id) + return FileResponse(path, filename=artifact["name"], media_type="application/octet-stream") + + @app.get("/") + def index(): + return FileResponse(static / "index.html") + + @app.get("/project/xas-test-library/{legacy_path:path}") + def old_bookmark(legacy_path: str): + return RedirectResponse("/#/scripts", status_code=307) + + if static.exists(): + app.mount("/static", StaticFiles(directory=static), name="static") + return app diff --git a/console/artifacts.py b/console/artifacts.py new file mode 100644 index 0000000..74c8091 --- /dev/null +++ b/console/artifacts.py @@ -0,0 +1,144 @@ +"""Bounded log following and result snapshots; never modify original outputs.""" +import hashlib +import codecs +import os +from pathlib import Path +import time +from .catalog import safe_path, SECRET + + +def files_under(paths, limit=256): + items = [] + deadline = time.monotonic() + 2 + for root in map(Path, paths): + if root.is_symlink(): + continue + if root.is_file(): + items.append(root) + elif root.is_dir(): + for directory, dirs, files in os.walk(root, followlinks=False): + dirs[:] = sorted(d for d in dirs if not (Path(directory) / d).is_symlink()) + for name in sorted(files): + path = Path(directory) / name + if not path.is_symlink() and path.is_file(): + items.append(path) + if len(items) >= limit or time.monotonic() > deadline: + return items[:limit] + return items[:limit] + + +def signature(path): + try: + stat = path.stat() + return (stat.st_ino, stat.st_size, stat.st_mtime_ns) + except OSError: + return None + + +class Collector: + def __init__(self, settings, directory, output_paths, redactor=None, stream_filter_factory=None, file_limit=256): + self.settings, self.directory = settings, directory + self.file_limit = file_limit + self.output_provider = output_paths if callable(output_paths) else lambda: [Path(p) for p in output_paths] + self.redactor = redactor + self.stream_filter_factory = stream_filter_factory + self.log_filters = {} + self.before = {str(p): signature(p) for p in files_under(self.outputs, self.file_limit)} + self.positions = {str(p): p.stat().st_size for p in files_under(self.outputs, self.file_limit) if p.suffix == ".log"} + self.notices = [] + self.decoders = {} + self.last_file = None + + @property + def outputs(self): + return self.output_provider() + + def follow(self, emit): + total = 0 + for path in files_under([*self.outputs, self.directory / "work"], self.file_limit): + if path.suffix != ".log": + continue + try: + start = self.positions.get(str(path), 0) + if path.stat().st_size < start: + start = 0 + self.decoders.pop(str(path), None) + with path.open("rb") as handle: + handle.seek(start) + data = handle.read(32768) + self.positions[str(path)] = handle.tell() + if data: + total += len(data) + if self.stream_filter_factory: + log_filter = self.log_filters.setdefault(str(path), self.stream_filter_factory()) + data = log_filter.feed(data) + decoder = self.decoders.setdefault(str(path), codecs.getincrementaldecoder("utf-8")("replace")) + text = decoder.decode(data) + prefix = f"\n[文件日志 {path.name}]\n" if self.last_file != str(path) else "" + emit((prefix + text).encode("utf-8")) + self.last_file = str(path) + except OSError: + self.notices.append(f"日志读取失败：{path.name}") + return total + + def finish_follow(self, emit): + total = 0 + while total < self.settings.max_log: + count = self.follow(emit) + if count == 0: + break + total += count + for name, decoder in self.decoders.items(): + extra = self.log_filters[name].finish() if name in self.log_filters else b"" + tail = decoder.decode(extra, final=True) + if tail: + emit(tail.encode("utf-8")) + self.decoders.clear() + self.log_filters.clear() + + def external_growth(self): + growth = 0 + for path in files_under(self.outputs, limit=1025): + stat = signature(path) + before = self.before.get(str(path)) + if stat: + growth += max(0, stat[1] - (before[1] if before and before[0] == stat[0] else 0)) + return growth + + def collect(self): + destination = self.directory / "artifacts" + destination.mkdir(exist_ok=True) + local = files_under([self.directory / "work"]) + changed = [p for p in files_under(self.outputs, self.file_limit) if signature(p) != self.before.get(str(p))] + sources = [self.directory / "source" / "script.txt", *local, *changed] + items, total = [], 0 + for path in sources[:self.settings.max_run_files - 1]: + try: + if not path.is_file() or path.is_symlink(): + continue + if path.stat().st_size > self.settings.max_artifact: + retention = "临时文件将在收尾时释放" if path in local else "原位置文件保留" + self.notices.append(f"未归档 {path.name}：超过单文件 32 MiB 上限，{retention}") + continue + data = path.read_bytes() + if len(data) > self.settings.max_artifact or total + len(data) > 64 * 1024 * 1024: + self.notices.append("结果超过归档容量限制：原目录文件保留，未归档的临时结果将在收尾时释放") + continue + suffix = path.suffix.lower() + kind = "json" if suffix == ".json" else ("text" if suffix in {".log", ".txt", ".py", ".sh", ".csv", ".md", ".jsonl"} else "file") + if kind != "file": + text = data.decode("utf-8", errors="replace") + data = SECRET.sub("[已隐藏疑似凭据]", text).encode("utf-8") + if self.redactor: + data = self.redactor(data) + identity = hashlib.sha256(str(path).encode()).hexdigest()[:24] + target = destination / identity + with target.open("xb") as handle: + handle.write(data) + items.append({"id": identity, "name": path.name, "size": len(data), "kind": kind}) + total += len(data) + except OSError: + self.notices.append(f"未能归档：{path.name}") + if len(sources) > self.settings.max_run_files - 1: + self.notices.append("结果超过文件数上限：保留 63 个文件及运行摘要，未归档临时结果将释放") + return items diff --git a/console/catalog.py b/console/catalog.py new file mode 100644 index 0000000..09dcb11 --- /dev/null +++ b/console/catalog.py @@ -0,0 +1,193 @@ +"""Source registration and filesystem boundaries shared by API and worker.""" +import hashlib +import os +from pathlib import Path +import re +import uuid +from .store import now + +SECRET = re.compile(r"(?im)(?:[\w-]*(?:api[_-]?key|password|token|secret)[\w-]*)\s*[:=]\s*['\"][^'\"\r\n]{8,}['\"]|-----BEGIN [A-Z ]*PRIVATE KEY-----|Bearer\s+[A-Za-z0-9._-]{16,}") +SERVICE = re.compile(r"(?im)\b(?:docker|podman|systemctl|sudo|pkill|killall|shutdown|reboot|nvidia-smi)\b|\brm\s+-[\w]*r|\bkill\s+-") +SMOKE_HASH = "be858e914d87454240791da773578cb3f80f380e740f919546db347b7715a13d" + + +def clean_source(content): + try: + text = content.decode("utf-8-sig") + except UnicodeDecodeError as exc: + raise ValueError("脚本必须使用 UTF-8 编码") from exc + if "\x00" in text: + raise ValueError("不支持二进制脚本") + return text + + +def safe_path(path, root, must_exist=True): + candidate, base = Path(path), Path(root) + if not candidate.is_absolute(): + raise ValueError("路径必须为绝对路径") + # Never follow a symlink, including symlink ancestors under the allowed root. + resolved_base = base.resolve() + resolved = candidate.resolve() + if not resolved.is_relative_to(resolved_base): + raise ValueError("路径超出允许目录") + for component in [candidate, *candidate.parents]: + if component.is_symlink(): + raise ValueError("不允许符号链接") + if component == base: + break + if must_exist and not candidate.exists(): + raise ValueError("文件或目录不存在") + return candidate + + +def source_for(settings, group): + for source in settings.sources: + if source["id"] == group: + return Path(source["path"]) + raise ValueError("未知来源目录") + + +def validate_config(settings, item, config): + from . import native_plans + if native_plans.profile_for(settings, item): + return native_plans.validate_config(settings, item, config) + if config.get("native_options"): + raise ValueError("此项目不支持原环境参数") + defaults = {"args": [], "cwd": "", "output_paths": [], "timeout_seconds": 300, "profile": "standard"} + config = {**defaults, **config} + if config["profile"] not in {"standard", "legacy_smoke"}: + raise ValueError("未知执行环境") + if not isinstance(config["args"], list) or len(config["args"]) > 40 or any( + not isinstance(a, str) or len(a) > 2048 or "\x00" in a for a in config["args"]): + raise ValueError("参数需为最多 40 项的字符串数组") + if SECRET.search("\n".join(config["args"])): + raise ValueError("参数不能包含明文凭据") + if config["profile"] == "legacy_smoke" and config["args"]: + raise ValueError("轻量模型兼容环境使用已核对的固定参数，请新建脚本以配置其他测试") + if type(config["timeout_seconds"]) is not int or not 5 <= config["timeout_seconds"] <= 7200: + raise ValueError("运行时限须为 5 至 7200 秒") + if not isinstance(config["output_paths"], list) or len(config["output_paths"]) > 8: + raise ValueError("最多登记 8 个日志或结果路径") + if not isinstance(config["cwd"], str): + raise ValueError("工作目录格式错误") + if item["kind"] == "managed": + if config["cwd"] or config["output_paths"]: + raise ValueError("上传脚本使用本次独立运行目录；通过 XAS_RUN_DIR 写入结果") + else: + source = source_for(settings, item["source_group"]) + base = source.parent if source.name == "scripts" else source + cwd = safe_path(config["cwd"] or str(base), base) + if not cwd.is_dir(): + raise ValueError("工作目录不存在") + config["cwd"] = str(cwd) + for raw in config["output_paths"]: + if not isinstance(raw, str): + raise ValueError("输出路径格式错误") + # Only logs/results directories in that script family may become writable. + if not any(Path(raw).resolve().is_relative_to((base / name).resolve()) for name in ("logs", "results")): + raise ValueError("原目录输出只允许该来源的 logs/ 或 results/ 下路径") + safe_path(raw, base) + return config + + +def script_path(settings, item): + root = settings.library if item["kind"] == "managed" else source_for(settings, item["source_group"]) + path = safe_path(item["source_path"], root) + if not path.is_file() or path.suffix not in {".py", ".sh"} or path.stat().st_size > settings.max_upload: + raise ValueError("脚本缺失、类型不支持或大于 1 MiB") + return path + + +def read_code(settings, item): + data = script_path(settings, item).read_bytes() + text = clean_source(data) + redacted = bool(SECRET.search(text)) + if redacted: + text = SECRET.sub("[已隐藏疑似凭据]", text) + return {"code": text, "filename": Path(item["source_path"]).name, + "sha256": hashlib.sha256(data).hexdigest(), "redacted": redacted, "truncated": False} + + +def upload(store, data, filename, name="", description="", identity=None): + if not filename or Path(filename).name != filename or "/" in filename or "\\" in filename or not re.fullmatch(r"[\w.\- ]{1,120}\.(py|sh)", filename): + raise ValueError("只支持文件名安全的 .py 或 .sh 脚本") + if len(data) > store.settings.max_upload: + raise ValueError("脚本不能超过 1 MiB") + if not data: + raise ValueError("脚本不能为空") + text = clean_source(data) + if SECRET.search(text): + raise ValueError("脚本包含疑似明文凭据，请移除后上传") + if identity: + item = store.script(identity) + if item["kind"] != "managed": + raise ValueError("原位置脚本不支持上传覆盖，请新建脚本") + if item["config"]["profile"] == "legacy_smoke" and hashlib.sha256(data).hexdigest() != SMOKE_HASH: + raise ValueError("此兼容环境绑定已核对的原脚本；修改代码请新建脚本并另行配置认证") + if (Path(filename).suffix == ".py") != (item["language"] == "python"): + raise ValueError("新版本的语言必须与原脚本一致") + else: + item = {"id": uuid.uuid4().hex, "name": (name or filename)[:120], "description": description[:4000], + "kind": "managed", "language": "python" if filename.endswith(".py") else "shell", + "source_group": "uploaded", "source_path": "", "status": "ready", "enabled": True, + "reason": "", "version": 0, "sha256": "", "updated_at": now(), "synthetic": False, + "config": {"args": [], "cwd": "", "output_paths": [], "timeout_seconds": 300, "profile": "standard"}} + return store.upload_version(item, data, filename) + + +def discover(store): + existing = {s["id"]: s for s in store.scripts() if s["kind"] == "external"} + found, registered = set(), 0 + for source in store.settings.sources: + root = Path(source["path"]) + if not root.is_dir(): + continue + count = 0 + for directory, dirs, files in os.walk(root, followlinks=False): + dirs[:] = [d for d in dirs if d not in {".git", "__pycache__", ".venv", "node_modules", "logs", "results"} + and not (Path(directory) / d).is_symlink()] + for filename in sorted(files): + path = Path(directory) / filename + if path.suffix not in {".py", ".sh"} or path.is_symlink(): + continue + count += 1 + if count > 2000: + raise ValueError("来源脚本超过扫描上限 2000，请收窄来源目录") + identity = hashlib.sha256(str(path).encode()).hexdigest()[:32] + found.add(identity) + before = existing.get(identity) + try: + if path.stat().st_size > store.settings.max_upload: + raise ValueError("大于 1 MiB，仅登记") + raw = path.read_bytes() + code = clean_source(raw) + digest = hashlib.sha256(raw).hexdigest() + blocked = bool(SERVICE.search(code) or SECRET.search(code)) + reason = "涉及服务、设备管理或疑似凭据，需管理员审查后接入" if blocked else "请确认参数、依赖和输出路径后启用" + except (OSError, ValueError): + digest, blocked, reason = "", True, "文件不可读取或格式不支持" + item = before or {"id": identity, "name": filename, "description": "", + "kind": "external", "language": "python" if path.suffix == ".py" else "shell", + "source_group": source["id"], "source_path": str(path), "version": 1, "enabled": False, + "config": {"args": [], "cwd": str(root.parent if root.name == "scripts" else root), + "output_paths": [], "timeout_seconds": 300, "profile": "standard"}} + from .native_plans import profile_for + native = profile_for(store.settings, item) + if native: + blocked = not native.get("available", True) + reason = native.get("unavailable_reason", "原环境方案已登记，请确认参数后启用") + if before and before["sha256"] != digest: + item["version"] += 1 + item["enabled"] = False + reason = "源文件已变动，请重新确认配置并启用" + if blocked: + item["enabled"] = False + item.update(sha256=digest, blocked=blocked, reason="" if item["enabled"] else reason, + status="ready" if item["enabled"] else "needs_configuration", updated_at=now()) + store.save_script(item) + registered += int(before is None) + for identity, item in existing.items(): + if identity not in found: + item.update(status="missing", enabled=False, reason="原脚本当前不存在或来源不可访问", updated_at=now()) + store.save_script(item) + return {"registered": registered, "missing": len(set(existing) - found), "total": len(found)} diff --git a/console/job_main.py b/console/job_main.py new file mode 100644 index 0000000..73056bf --- /dev/null +++ b/console/job_main.py @@ -0,0 +1,115 @@ +"""In-container bootstrap. Input contains optional credentials; never persist it.""" +from http.server import BaseHTTPRequestHandler, HTTPServer +import json +import os +from pathlib import Path +import subprocess +import sys +import threading +import time +import urllib.error +import urllib.request + + +class NoRedirect(urllib.request.HTTPRedirectHandler): + def redirect_request(self, request, fp, code, msg, headers, newurl): + return None + + +class BudgetRelay(HTTPServer): + def __init__(self, address, upstream, key): + super().__init__(address, RelayHandler) + self.upstream, self.key = upstream, key + self.gets, self.posts = 0, 0 + self.records = [] + + +class RelayHandler(BaseHTTPRequestHandler): + def log_message(self, *args): + pass + + def do_GET(self): + if self.path != "/v1/models" or self.server.gets >= 1: + self.send_error(403, "Request outside run budget") + return + self.server.gets += 1 + self.forward(None, 10) + + def do_POST(self): + if self.path != "/v1/chat/completions" or self.server.posts >= 3: + self.send_error(403, "Request outside run budget") + return + try: + length = int(self.headers.get("Content-Length", "0")) + if not 0 < length <= 8192: + raise ValueError() + data = self.rfile.read(length) + body = json.loads(data) + if body.get("model") != "deepseek-v4.1-flash" or body.get("max_tokens") != 512 or body.get("stream"): + raise ValueError() + except (ValueError, json.JSONDecodeError): + self.send_error(400, "Unexpected smoke request") + return + self.server.posts += 1 # Count before I/O: timeouts never replenish the budget. + self.forward(data, 600) + + def forward(self, data, timeout): + started = time.monotonic() + record = {"path": self.path, "status": None} + try: + req = urllib.request.Request(self.server.upstream + self.path, data=data, headers={ + "Content-Type": "application/json", "Authorization": "Bearer " + self.server.key}) + opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), NoRedirect()) + with opener.open(req, timeout=timeout) as response: + status, payload = response.status, response.read(2 * 1024 * 1024 + 1) + if len(payload) > 2 * 1024 * 1024: + raise ValueError("Response exceeded limit") + record["status"] = status + decoded = json.loads(payload) + if self.path.endswith("completions"): + record["response"] = decoded + self.send_response(status) + self.send_header("Content-Type", "application/json") + self.send_header("Content-Length", str(len(payload))) + self.end_headers() + self.wfile.write(payload) + except urllib.error.HTTPError as exc: + record["status"] = exc.code + self.send_error(exc.code, "Upstream request failed") + except (OSError, ValueError) as exc: + record["error"] = type(exc).__name__ + try: + self.send_error(502, "Upstream outcome uncertain; no retry") + except OSError: + pass + finally: + record["seconds"] = round(time.monotonic() - started, 3) + self.server.records.append(record) + print(json.dumps({"event": "model_request", **{k: v for k, v in record.items() if k != "response"}}), flush=True) + + +def main(): + payload = json.loads(sys.stdin.buffer.readline(16384)) + relay = None + if payload.get("profile") == "legacy_smoke": + relay = BudgetRelay(("127.0.0.1", 18100), payload.pop("upstream"), payload.pop("key")) + threading.Thread(target=relay.serve_forever, daemon=True).start() + command = (["python3", "-u"] if payload["language"] == "python" else ["/bin/bash"]) + [payload["script"]] + payload["args"] + print("[控制台] 测试进程已启动，输出将持续显示。", flush=True) + status = subprocess.call(command, stdin=subprocess.DEVNULL) + if relay: + report = {"synthetic": False, "scope": "接口冒烟检查，非模型质量评测", "get_attempts": relay.gets, + "completion_attempts": relay.posts, "records": relay.records, "script_exit_code": status} + valid = len(relay.records) == 4 and all(r.get("status") == 200 for r in relay.records) + report["requests_completed"] = valid + report["message"] = "请求均返回成功；请结合实际回答与 finish_reason 判断内容" if valid else "存在失败或未完成请求；未自动重试" + Path(os.environ["XAS_RUN_DIR"], "smoke-response.json").write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8") + if not valid: + status = status or 1 + relay.shutdown() + print(f"[控制台] 测试进程结束，退出码 {status}。", flush=True) + return status + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/console/native_executor.py b/console/native_executor.py new file mode 100644 index 0000000..068001f --- /dev/null +++ b/console/native_executor.py @@ -0,0 +1,160 @@ +"""Manage only this console's transient units; reattach after worker restarts.""" +import hashlib +import json +from pathlib import Path +import re +import subprocess +import time +from .native_plans import build_plan, public_plan +from .store import now + + +def unit_name(identity): + if not re.fullmatch(r"[a-f0-9]{32}", identity):raise ValueError("运行编号不合法") + return "adamwen-native-" + identity + ".service" + + +def inspect(identity): + unit = unit_name(identity) + result = subprocess.run(["/usr/bin/systemctl", "show", unit, "--property=Id,LoadState,ActiveState,SubState,Description,Result,ExecMainStatus,MainPID,TasksCurrent"], + capture_output=True, timeout=8, text=True) + values = dict(line.split("=", 1) for line in result.stdout.splitlines() if "=" in line) + if values.get("LoadState") == "not-found":return None + if result.returncode or not values.get("LoadState"): + raise OSError("systemd 状态查询失败，任务状态未知") + if values.get("Id") != unit or values.get("Description") != "XAS native " + identity: + raise ValueError("原环境服务归属核验失败") + return values + + +def stop_unit(identity): + if inspect(identity): + subprocess.run(["/usr/bin/systemctl", "--no-block", "stop", unit_name(identity)], check=True, capture_output=True, timeout=8) + + +class NativeExecutor: + def __init__(self, worker): + self.worker, self.store, self.settings = worker, worker.store, worker.settings + + def execute(self, run): + if self.store.run(run["id"])["cancel_requested"]: + self.store.finish(run["id"], "cancelled", message="启动前已取消，原脚本未执行") + return + directory = self.settings.runs / run["id"] + directory.mkdir(mode=0o750, exist_ok=False) + try: + script = {**run, "id": run["script_id"]} + plan = build_plan(self.settings, script, run_id=run["id"]) + if plan["plan_token"] != run["execution"]["plan_token"] or not plan["ready"]: + raise ValueError("执行前原入口或环境已变化，请重新预检；未启动原测试") + if plan["impact"]["requires_confirmation"] and not run["execution"].get("impact_acknowledged"): + raise ValueError("缺少本次运行影响确认") + if inspect(run["id"]):raise ValueError("本次原环境服务已存在，拒绝重复启动") + run = self.store.update_execution(run["id"], {**public_plan(plan), "unit": unit_name(run["id"])}) + project = Path(self.worker.config["project"]) + log = directory / "console.log" + log.touch(mode=0o600) + with (directory / "native-permit").open("x") as permit: + permit.write(run["execution"]["plan_token"]) + command = ["/usr/bin/systemd-run", "--unit=" + unit_name(run["id"]), "--description=XAS native " + run["id"], + "--service-type=exec", "--property=RemainAfterExit=yes", "--property=KillMode=control-group", + "--property=TimeoutStopSec=120", "--property=RuntimeMaxSec=" + str(plan["timeout_seconds"]), + "--property=WorkingDirectory=" + str(project), "--property=User=root", "--property=UMask=0022", + "--property=StandardOutput=append:" + str(log), "--property=StandardError=append:" + str(log), + "--setenv=XAS_CONSOLE_ROOT=" + str(self.settings.root), "--setenv=PYTHONDONTWRITEBYTECODE=1", + "--", "/usr/bin/python3", "-m", "console.native_job", run["id"]] + if self.store.run(run["id"])["cancel_requested"]: + (directory / "native-permit").unlink(missing_ok=True) + self.store.finish(run["id"], "cancelled", message="启动前已取消，原脚本未执行") + return + result = subprocess.run(command, capture_output=True, timeout=15, text=True) + if result.returncode: + raise ValueError("systemd 未接受原环境任务，原脚本未启动") + except Exception as exc: + message = str(exc) if isinstance(exc, ValueError) else "原环境启动失败，未自动重试" + # A timeout can leave a submitted unit; inspect it instead of submitting again. + if inspect(run["id"]): + return self.monitor(run) + (directory / "native-permit").unlink(missing_ok=True) + if (directory / "native-started").exists(): + self.worker.stopping = True + self.store.finish(run["id"], "interrupted", message="原入口可能已启动但服务状态未知，执行器停止接单；请核对后再操作") + return + (directory / "console.log").write_text(message + "\n", encoding="utf-8") + self.store.finish(run["id"], "failed", message=message) + return + self.monitor(run) + + def monitor(self, run): + requested = False + failures = 0 + while not self.worker.stopping: + self.store.heartbeat() + try: + state = inspect(run["id"]) + failures = 0 + except (OSError, ValueError, subprocess.TimeoutExpired): + failures += 1 + self.store.running_message(run["id"], "无法确认原环境服务状态，保留运行占位，不启动下一项") + if failures >= 10:self.worker.stopping = True + time.sleep(1) + continue + if state is None or state.get("SubState") in {"exited", "dead", "failed"}: + return self.finish(run, state) + if self.store.run(run["id"])["cancel_requested"] and not requested: + stop_unit(run["id"]) + requested = True + time.sleep(.5) + # The independent unit keeps running. The next worker attaches without replaying it. + + def finish(self, run, unit): + directory = self.settings.runs / run["id"] + directory.mkdir(mode=0o750, exist_ok=True) + outcome_file = directory / "unit-outcome.json" + outcome = unit + if outcome_file.exists():outcome = json.loads(outcome_file.read_text()) + elif unit:outcome_file.write_text(json.dumps(unit)) + result_file = directory / "native-result.json" + result = json.loads(result_file.read_text()) if result_file.is_file() else {} + current = self.store.run(run["id"]) + code = result.get("exit_code") + if current["cancel_requested"]:state, message = "cancelled", "已取消本次宿主入口；请核对原脚本启动的 Docker/tmux 任务和模型恢复情况" + elif outcome and outcome.get("Result") == "timeout":state, message = "timed_out", "原环境运行超过时限；原服务是否恢复需结合收尾记录核对" + elif not result:state, message = "interrupted", "原环境任务结束但完整结果未取得；未自动重跑，请查看日志和原服务状态" + elif result.get("stopped"):state, message = "interrupted", "原环境入口收到外部停止信号，服务恢复情况未确认" + elif code == 0:state, message = "succeeded", "原入口正常退出；业务结论和共享资源状态请查看报告" + else:state, message = "failed", f"原入口退出码 {code}，请查看日志" + sessions = result.get("runtime_changes", {}).get("new_tmux_sessions", []) + if sessions and state == "succeeded": + state, message = "interrupted", "原入口已退出，但检测到新增 tmux 会话；后台任务完成状态未确认，请核对原工具" + artifacts = result.get("artifacts", []) + summary = {"run_id": run["id"], "state": state, "exit_code": code, "message": message, + "finished_at": now(), "source_sha256": run["sha256"], "execution": run["execution"], + "runtime_changes": result.get("runtime_changes"), "archive_notices": result.get("archive_notices", []), + "log_truncated": result.get("log_truncated", False)} + directory.mkdir(mode=0o750, exist_ok=True) + (directory / "artifacts").mkdir(exist_ok=True) + data = json.dumps(summary, ensure_ascii=False, indent=2).encode() + identity = hashlib.sha256((str(directory) + "/summary.json").encode()).hexdigest()[:24] + (directory / "artifacts" / identity).write_bytes(data) + artifacts.append({"id": identity, "name": "summary.json", "kind": "json", "size": len(data)}) + if unit: + if not self.wait_stopped(run):return + subprocess.run(["/usr/bin/systemctl", "reset-failed", unit_name(run["id"])], capture_output=True, timeout=8) + self.store.finish(run["id"], state, message=message, exit_code=code, artifacts=artifacts) + + def wait_stopped(self, run): + try: + stop_unit(run["id"]) + deadline = time.monotonic() + 130 + while time.monotonic() < deadline and not self.worker.stopping: + self.store.heartbeat() + current = inspect(run["id"]) + if current is None:return True + if current.get("ActiveState") in {"inactive", "failed"} and current.get("MainPID", "0") == "0" and current.get("TasksCurrent", "0") in {"0", "[not set]"}: + return True + time.sleep(.5) + except (OSError, ValueError, subprocess.TimeoutExpired, subprocess.CalledProcessError):pass + self.store.running_message(run["id"], "本次进程收尾未确认，保留运行占位，执行器停止接单") + self.worker.stopping = True + return False diff --git a/console/native_files.py b/console/native_files.py new file mode 100644 index 0000000..6d9600c --- /dev/null +++ b/console/native_files.py @@ -0,0 +1,75 @@ +"""Read-only output discovery, history preservation and small runtime snapshots.""" +import glob +import hashlib +import json +import os +from pathlib import Path +import shutil +import subprocess +from .artifacts import files_under + + +def outputs(patterns): + paths = [] + for pattern in patterns: + expanded = glob.iglob(pattern) if glob.has_magic(pattern) else [pattern] + for name in expanded: + path = Path(name) + if path.is_symlink(): + continue + if path.is_file():paths.append(path) + elif path.is_dir():paths.extend(files_under([path], limit=4097)) + if len(paths) > 4096: + raise ValueError("原输出文件超过 4096 项，请收窄登记输出范围") + return sorted(set(paths)) + + +def preserve(paths, directory, maximum=64 * 1024**3): + sizes = [path.stat().st_size for path in paths] + total = sum(sizes) + if total > maximum or shutil.disk_usage(directory).free < total + 10 * 1024**3: + raise ValueError("保护原有同名结果所需空间不足或超过 64 GiB，本次未启动") + destination = directory / "previous-outputs" + destination.mkdir(mode=0o700) + manifest = [] + for path in paths: + identity = hashlib.sha256(str(path).encode()).hexdigest() + target = destination / identity + before = path.stat() + with path.open("rb") as source, target.open("xb") as output: + shutil.copyfileobj(source, output, length=1024 * 1024) + after = path.stat() + if (before.st_size, before.st_mtime_ns) != (after.st_size, after.st_mtime_ns): + raise ValueError("原输出仍被其他任务写入，请等待后再试") + manifest.append({"path": str(path), "backup": identity, "size": before.st_size}) + (destination / "manifest.json").write_text(json.dumps(manifest, ensure_ascii=False, indent=2), encoding="utf-8") + return len(manifest) + + +def runtime_snapshot(): + result = {"containers": [], "tmux_sessions": [], "errors": []} + try: + raw = subprocess.run(["/usr/bin/docker", "ps", "-a", "--format", "{{json .}}"], capture_output=True, timeout=10, text=True) + if raw.returncode == 0: + for line in raw.stdout.splitlines(): + value = json.loads(line) + result["containers"].append({key: value.get(key) for key in ("ID", "Names", "Image", "State", "Status")}) + else:result["errors"].append("容器状态读取失败") + except (OSError, ValueError, subprocess.TimeoutExpired):result["errors"].append("容器状态不可用") + try: + raw = subprocess.run(["/usr/bin/tmux", "list-sessions", "-F", "#{session_id}\t#{session_name}"], capture_output=True, timeout=5, text=True) + if raw.returncode == 0: + result["tmux_sessions"] = [dict(zip(("id", "name"), line.split("\t", 1))) for line in raw.stdout.splitlines() if "\t" in line] + except (OSError, subprocess.TimeoutExpired):result["errors"].append("tmux 状态不可用") + return result + + +def differences(before, after): + old = {v["ID"]: v for v in before["containers"]} + new = {v["ID"]: v for v in after["containers"]} + sessions = {v["id"] for v in before["tmux_sessions"]} + return {"created_containers": [v for k, v in new.items() if k not in old], + "removed_containers": [v for k, v in old.items() if k not in new], + "changed_containers": [v for k, v in new.items() if k in old and v["State"] != old[k]["State"]], + "new_tmux_sessions": [v for v in after["tmux_sessions"] if v["id"] not in sessions], + "note": "共享宿主前后快照差异不等于资源归属证明；不会自动删除这些容器或会话。"} diff --git a/console/native_io.py b/console/native_io.py new file mode 100644 index 0000000..46675b2 --- /dev/null +++ b/console/native_io.py @@ -0,0 +1,122 @@ +"""Bounded IPC and streaming redaction for original-environment runs.""" +import json +import os +from pathlib import Path +import re +import shlex +import socket +import subprocess + +ANSI = re.compile(rb"\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07\x1b]*(?:\x07|\x1b\\)|[()][0-2A-Z]|[@-_])") +SENSITIVE_NAME = re.compile(r"(?i)(?:api_?key|password|passwd|secret|access_token|auth_token|credential)") + + +def strip_terminal(data, state="text"): + output = bytearray() + for value in data: + if state == "text": + if value == 27:state = "escape" + else:output.append(value) + elif state == "escape": + state = "csi" if value == 91 else "osc" if value == 93 else "charset" if value in (40, 41) else "text" + elif state == "csi": + if 64 <= value <= 126:state = "text" + elif value == 27:state = "escape" + elif state == "osc": + if value == 7:state = "text" + elif value == 27:state = "osc_escape" + elif state == "osc_escape": + state = "text" if value in (92, 7) else "osc" + else:state = "text" + return bytes(output), state + + +class SecretFilter: + def __init__(self, secrets): + values = set() + for value in secrets: + values.update(v.encode() for v in [value, *value.splitlines()] if len(v) >= 4) + self.secrets = sorted(values, key=len, reverse=True) + self.keep = max([256, *[len(v) for v in self.secrets]]) + self.pending = b"" + self.terminal_state = "text" + + def clean(self, data): + data, _ = strip_terminal(data) + for secret in self.secrets: + data = data.replace(secret, b"[REDACTED]") + return data + + def feed(self, data): + plain, self.terminal_state = strip_terminal(data, self.terminal_state) + self.pending += plain + for secret in self.secrets:self.pending = self.pending.replace(secret, b"[REDACTED]") + # Emit prompts without requiring a newline, retaining only a possible secret prefix. + hold = 0 + for secret in self.secrets: + for size in range(min(len(secret) - 1, len(self.pending)), hold, -1): + if self.pending.endswith(secret[:size]): + hold = size + break + cut = len(self.pending) - hold + result, self.pending = self.pending[:cut], self.pending[cut:] + return result + + def finish(self): + partial = len(self.pending) >= 4 and any(s.startswith(self.pending) for s in self.secrets) + result = b"[REDACTED]" if partial else self.clean(self.pending) + self.pending = b"" + self.terminal_state = "text" + return result + + +def load_environment(plan): + import pwd + account = pwd.getpwnam(plan["user"]) + env = {"PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "HOME": account.pw_dir, + "USER": account.pw_name, "LOGNAME": account.pw_name, "LANG": "C.UTF-8", "TERM": "xterm", + "PYTHONUNBUFFERED": "1", "PYTHONDONTWRITEBYTECODE": "1"} + secrets = [] + for path in plan.get("env_setup_files", []): + # Only server-owned recipe paths reach this command; output stays in private process memory. + command = ["/bin/bash", "-c", 'set -a; source "$1" >/dev/null; /usr/bin/env -0', "xas-env", path] + result = subprocess.run(command, env=env, cwd=plan["cwd"], capture_output=True, timeout=10) + if result.returncode: + raise ValueError("原环境配置加载失败") + env.update(dict(v.decode().split("=", 1) for v in result.stdout.split(b"\0") if b"=" in v)) + secrets.extend(v for k, v in env.items() if SENSITIVE_NAME.search(k) and v) + for path in plan.get("credential_files", []): + for line in Path(path).read_text().splitlines(): + if not line.strip() or line.lstrip().startswith("#"): + continue + match = re.match(r"^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$", line.strip()) + if not match: + raise ValueError("原认证配置格式不支持") + parts = shlex.split(match[2], comments=True) + if len(parts) > 1: + raise ValueError("原认证配置格式不支持") + env[match[1]] = parts[0] if parts else "" + if SENSITIVE_NAME.search(match[1]) and env[match[1]]:secrets.append(env[match[1]]) + env.update(plan.get("environment", {})) + secrets.extend(v for k, v in env.items() if SENSITIVE_NAME.search(k) and v) + return env, secrets + + +def request(settings, payload): + if not hasattr(socket, "AF_UNIX"): + raise ValueError("原环境执行器仅在 Linux 服务器可用") + try: + with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as connection: + connection.settimeout(15) + connection.connect(str(settings.native_socket)) + connection.sendall(json.dumps(payload).encode() + b"\n") + stream = connection.makefile("rb") + data = stream.readline(131073) + if len(data) > 131072: + raise ValueError("原环境执行器响应过大") + result = json.loads(data) + except (OSError, json.JSONDecodeError) as exc: + raise ValueError("原环境执行器暂不可用，请稍后重试") from exc + if "error" in result: + raise ValueError(result["error"]) + return result diff --git a/console/native_job.py b/console/native_job.py new file mode 100644 index 0000000..137ceba --- /dev/null +++ b/console/native_job.py @@ -0,0 +1,176 @@ +"""Original-environment launcher, supervised by a per-run systemd service.""" +import errno +import fcntl +import hashlib +import json +import os +from pathlib import Path +import pty +import pwd +import selectors +import signal +import stat +import struct +import subprocess +import sys +import termios +import time +from .artifacts import Collector +from .native_files import differences, outputs, preserve, runtime_snapshot +from .native_io import SecretFilter, load_environment +from .native_plans import build_plan, profile_for +from .settings import Settings +from .store import Store, now + + +def acquire_terminal(): + # Popen has already created the session and duplicated the slave onto stdin. + # The original tmux/menu tools need a controlling terminal, not just isatty(). + fcntl.ioctl(0, termios.TIOCSCTTY, 0) + + +def execute(settings, run): + script = {**run, "id": run["script_id"]} + plan = build_plan(settings, script, run_id=run["id"]) + if plan["plan_token"] != run["execution"]["plan_token"] or not plan["ready"]: + raise ValueError("执行前环境或参数发生变化，未启动原测试") + if plan["impact"]["requires_confirmation"] and not run["execution"].get("impact_acknowledged"): + raise ValueError("缺少本次影响确认") + directory = settings.runs / run["id"] + (directory / "work").mkdir(mode=0o700, exist_ok=True) + env, secrets = load_environment(plan) + redactor = SecretFilter(secrets) + file_redactor = SecretFilter(secrets) + limit, written, truncated = settings.max_log, 0, False + def emit(data): + nonlocal written, truncated + remaining = limit - written + if len(data) > remaining:truncated = True + if remaining > 0: + sys.stdout.buffer.write(data[:remaining]);sys.stdout.buffer.flush() + written += min(len(data), remaining) + def message(text):emit(("[原环境] " + text + "\n").encode()) + collector = Collector(settings, directory, lambda: outputs(plan["output_paths"]), redactor=file_redactor.clean, + stream_filter_factory=lambda: SecretFilter(secrets), file_limit=4096) + profile = profile_for(settings, script) + if profile.get("preserve_existing_outputs"): + message("正在备份原有同名结果，原测试尚未开始。") + count = preserve(collector.outputs, directory) + message(f"已保护 {count} 个原有结果文件。") + before = runtime_snapshot() + (directory / "runtime-before.json").write_text(json.dumps(before, ensure_ascii=False), encoding="utf-8") + stopped = False + def stop(signum, frame): + nonlocal stopped + stopped = True # systemd sends the same signal to the full cgroup and enforces the grace period. + signal.signal(signal.SIGTERM, stop) + signal.signal(signal.SIGINT, stop) + fifo = settings.native_socket.parent / ("input-" + run["id"]) + master = slave = input_fd = None + selector = selectors.DefaultSelector() + process = None + code = 1 + try: + account = pwd.getpwnam(plan["user"]) + options = {"cwd": plan["cwd"], "env": env, "start_new_session": True, + "user": account.pw_uid, "group": account.pw_gid, "extra_groups": []} + if stopped or Store(settings).run(run["id"])["cancel_requested"]: + message("已在创建原入口前取消，原测试未启动。") + return 1 + if plan["interactive"]: + master, slave = pty.openpty() + attributes = termios.tcgetattr(slave) + attributes[3] &= ~(termios.ECHO | termios.ECHONL) + termios.tcsetattr(slave, termios.TCSANOW, attributes) + fcntl.ioctl(slave, termios.TIOCSWINSZ, struct.pack("HHHH", 36, 120, 0, 0)) + process = subprocess.Popen(plan["argv"], stdin=slave, stdout=slave, stderr=slave, + preexec_fn=acquire_terminal, **options) + os.close(slave);slave = None + os.mkfifo(fifo, 0o600) + input_fd = os.open(fifo, os.O_RDWR | os.O_NONBLOCK) + selector.register(input_fd, selectors.EVENT_READ, "input") + output_fd = master + else: + process = subprocess.Popen(plan["argv"], stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, **options) + output_fd = process.stdout.fileno() + os.set_blocking(output_fd, False) + selector.register(output_fd, selectors.EVENT_READ, "output") + message("已在原目录启动登记入口。取消仅处理本次宿主进程，Docker/tmux 或远端推理需结合收尾记录核对。") + last_follow = time.monotonic() + while selector.get_map(): + for key, _ in selector.select(.3): + try:data = os.read(key.fd, 4096) + except OSError as exc: + if exc.errno in (errno.EIO, errno.EBADF):data = b"" + elif exc.errno == errno.EAGAIN:continue + else:raise + if key.data == "input": + if data and process.poll() is None: + os.write(master, data) + elif data:emit(redactor.feed(data)) + else:selector.unregister(key.fd) + if time.monotonic() - last_follow > 1: + collector.follow(lambda data: emit(file_redactor.clean(data))) + last_follow = time.monotonic() + if process.poll() is not None: + if input_fd is not None: + try:selector.unregister(input_fd) + except KeyError:pass + if not any(k.data == "output" for k in selector.get_map().values()):break + code = process.wait() + emit(redactor.finish()) + finally: + selector.close() + if process and process.poll() is None: + os.killpg(process.pid, signal.SIGTERM) + try:process.wait(timeout=5) + except subprocess.TimeoutExpired:os.killpg(process.pid, signal.SIGKILL);process.wait(timeout=5) + for descriptor in (input_fd, master, slave): + if descriptor is not None: + try:os.close(descriptor) + except OSError:pass + if process and process.stdout:process.stdout.close() + if fifo.exists() and stat.S_ISFIFO(fifo.lstat().st_mode):fifo.unlink() + after = runtime_snapshot() + changes = differences(before, after) + if plan["interactive"] and code == 0 and changes["new_tmux_sessions"] and not stopped: + sessions = {item["id"] for item in changes["new_tmux_sessions"]} + message("原菜单已退出，观察到新增 tmux 会话；继续跟踪其结束，不把入口退出当作后台测试完成。") + while sessions and not stopped: + collector.follow(lambda data: emit(file_redactor.clean(data))) + time.sleep(2) + current = runtime_snapshot() + sessions &= {item["id"] for item in current["tmux_sessions"]} + after = runtime_snapshot() + changes = differences(before, after) + (directory / "work/runtime-changes.json").write_text(json.dumps(changes, ensure_ascii=False, indent=2), encoding="utf-8") + collector.finish_follow(lambda data: emit(file_redactor.clean(data))) + artifacts = collector.collect() + result = {"exit_code": code, "stopped": stopped, "finished_at": now(), "artifacts": artifacts, + "log_truncated": truncated, "archive_notices": list(dict.fromkeys(collector.notices))[:32], + "runtime_changes": changes, "command_preview": plan["command_preview"]} + tmp = directory / "native-result.tmp" + tmp.write_text(json.dumps(result, ensure_ascii=False), encoding="utf-8") + os.replace(tmp, directory / "native-result.json") + message(f"原入口进程退出，退出码 {code}。共享资源前后变化已记录；不代表原模型已恢复。") + return code + + +def main(): + identity = sys.argv[1] + import re + if not re.fullmatch(r"[a-f0-9]{32}", identity):return 2 + settings = Settings.from_env() + run = Store(settings).run(identity) + if run["state"] != "running" or run.get("execution", {}).get("mode") != "native":return 2 + directory = settings.runs / identity + try:os.rename(directory / "native-permit", directory / "native-started") + except OSError:return 2 + try:return execute(settings, run) + except Exception as exc: + print(f"[原环境] 启动或收尾失败：{type(exc).__name__}。未自动重试。", flush=True) + return 1 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/console/native_plans.py b/console/native_plans.py new file mode 100644 index 0000000..22fa0fe --- /dev/null +++ b/console/native_plans.py @@ -0,0 +1,193 @@ +"""Trusted original-environment recipes; user input never supplies executable code.""" +import hashlib +import json +import math +import os +from pathlib import Path +import re +import shlex +import socket +from urllib.parse import urlsplit +from .catalog import script_path, safe_path + +MAX_TIMEOUT = 72 * 3600 +PLACEHOLDER = re.compile(r"\{([a-zA-Z_][a-zA-Z0-9_]*)\}") + + +def profile_for(settings, script): + if script["kind"] != "external": + return None + source = next((s for s in settings.sources if s["id"] == script["source_group"]), None) + if not source: + return None + expected = Path(script["source_path"]) + for profile in settings.native_catalog.get("profiles", []): + if profile["source_group"] == source["id"] and Path(source["path"]) / profile["entry"] == expected: + return profile + return None + + +def validate_options(profile, options): + if not isinstance(options, dict): + raise ValueError("原环境参数必须是对象") + fields = {f["key"]: f for f in profile.get("parameters", [])} + if set(options) - set(fields): + raise ValueError("包含启动方案未登记的参数") + result = {} + for key, field in fields.items(): + value = options.get(key, field.get("default")) + label = field.get("label", key) + if value is None or value == "": + if field.get("required", True): + raise ValueError(f"请填写{label}") + result[key] = "" + continue + kind = field["type"] + if kind in {"integer", "number"}: + valid = type(value) is int if kind == "integer" else type(value) in (int, float) + if not valid or not math.isfinite(value) or value < field.get("min", 0) or value > field.get("max", 10000000): + raise ValueError(f"{label}超出允许范围或类型不正确") + elif kind == "select": + if value not in [o["value"] for o in field["options"]]: + raise ValueError(f"{label}必须从登记选项中选择") + elif kind == "text": + if not isinstance(value, str) or len(value) > 1024 or re.search(r"[\x00-\x1f;$`|&<>\\]", value): + raise ValueError(f"{label}格式不正确") + if "pattern" in field and not re.fullmatch(field["pattern"], value): + raise ValueError(f"{label}格式不正确") + else: + raise ValueError("启动方案包含未知参数类型") + result[key] = value + return result + + +def resolve_target(target): + target = {**target, "environment": dict(target.get("environment", {}))} + path = target.get("config_file") + if not path: + return target + values = {} + for line in Path(path).read_text().splitlines(): + match = re.match(r"^(PORT|SERVED|CT_OFF|CT_ON)=(.*)$", line.strip()) + if not match:continue + parts = shlex.split(match[2], comments=True) + if len(parts) != 1 or "$" in parts[0] or "`" in parts[0]: + raise ValueError("原配置的模型/端口包含动态表达式，需管理员核对") + values[match[1]] = parts[0] + if "PORT" in values: + port = int(values["PORT"]) + if not 1 <= port <= 65535:raise ValueError("原模型端口不合法") + target["url"] = "http://127.0.0.1:" + str(port) + if "SERVED" in values:target["model"] = values["SERVED"] + for key in ("CT_OFF", "CT_ON"): + if key in values:target["environment"][key] = values[key] + return target + + +def public_execution(settings, script): + profile = profile_for(settings, script) + if profile is None: + return {"mode": "container", "interactive": False, "max_timeout_seconds": 7200} + return {"mode": "native", "profile_id": profile["id"], "interpreter": profile["interpreter"], + "user": profile["user"], "cwd": profile["cwd"], "description": "使用服务器原有环境和原始入口，不迁移依赖或修改源文件。", + "impact": profile["impact"], "parameters": profile.get("parameters", []), + "interactive": profile.get("interactive", False), "max_timeout_seconds": MAX_TIMEOUT, + "notes": profile.get("notes", []), "verification": "启动方案已接入，未完成本轮 GPU/长稳业务验收"} + + +def validate_config(settings, script, values): + profile = profile_for(settings, script) + if not profile: + raise ValueError("未登记原环境方案") + config = dict(values) + config["native_options"] = validate_options(profile, config.get("native_options", {})) + timeout = config.get("timeout_seconds", profile.get("timeout_seconds", 3600)) + if type(timeout) is not int or not 5 <= timeout <= MAX_TIMEOUT: + raise ValueError("原环境时限须为 5 秒至 72 小时") + config.update(timeout_seconds=timeout, cwd=profile["cwd"], args=[], output_paths=[], profile="native") + return config + + +def build_plan(settings, script, run_id=None, check_host=True): + profile = profile_for(settings, script) + if not profile: + raise ValueError("该入口未登记原环境方案") + source = script_path(settings, script) + source_hash = hashlib.sha256(source.read_bytes()).hexdigest() + if source_hash != script["sha256"]: + raise ValueError("原入口已变更，请刷新来源并重新确认后运行") + options = validate_options(profile, script["config"].get("native_options", {})) + target_id = options.get("target") + target = next((t for t in settings.native_catalog.get("targets", []) if t["id"] == target_id), {}) + if target_id and not target: + raise ValueError("目标服务未登记") + if target: + target = resolve_target(target) + if run_id and not re.fullmatch(r"[a-f0-9]{32}", run_id): + raise ValueError("运行编号格式错误") + identity = run_id or "{run_id}" + directory = settings.runs / identity + variables = {**options, "run_id": identity, "run_label": "console-" + identity, + "run_dir": str(directory), "output_file": str(Path(profile["cwd"]) / "logs" / f"console-{identity}-{profile['id']}.json"), + "target_url": target.get("url", ""), "target_model": target.get("model", ""), + "target_port": urlsplit(target.get("url", "")).port or "", "target_config": target.get("config_name", "")} + def render(value): + def replace(match): + if match[1] not in variables: + raise ValueError("原环境方案包含未定义的占位参数") + return str(variables[match[1]]) + return PLACEHOLDER.sub(replace, str(value)) + argv = [profile["interpreter"], str(source), *[render(a) for a in profile.get("arguments", [])]] + environment = {**target.get("environment", {}), **{k: render(v) for k, v in profile.get("environment", {}).items()}} + credential_files = list(dict.fromkeys(profile.get("credential_files", []) + target.get("credential_files", []))) + setup_files = [render(p) for p in profile.get("env_setup_files", [])] + required_files = [render(p) for p in profile.get("required_files", [])] + if target.get("config_file"): + required_files.append(target["config_file"]) + timeout = script["config"].get("timeout_seconds", profile.get("timeout_seconds", 3600)) + if type(timeout) is not int or not 5 <= timeout <= MAX_TIMEOUT: + raise ValueError("原环境时限不合法") + checks = [] + def check(name, ok, message): + checks.append({"name": name, "ok": bool(ok), "message": message}) + check("启动方案", profile.get("available", True), profile.get("unavailable_reason", "已登记原环境入口")) + if check_host: + check("原工作目录", Path(profile["cwd"]).is_dir(), profile["cwd"]) + tools = list(dict.fromkeys([profile["interpreter"], "/usr/bin/systemd-run", *profile.get("required_tools", [])])) + for tool in tools: + check("工具", Path(tool).is_file() and os.access(tool, os.X_OK), tool) + for path in required_files + credential_files + setup_files: + check("原配置或素材", Path(path).is_file(), path) + for value in profile.get("check_ports", []): + port = int(render(value)) + if not 1 <= port <= 65535: + raise ValueError("原服务端口不合法") + try: + with socket.create_connection(("127.0.0.1", port), timeout=.3):pass + available = True + except OSError:available = False + check("目标服务端口", available, f"127.0.0.1:{port}" + (" 可连接" if available else " 未监听，请先准备原服务")) + # Binds acknowledgment to saved configuration, source and recipe, not to a mutable browser flag. + dependency_hashes = {} + for name in required_files + setup_files: + path = Path(name) + if name not in credential_files and path.is_file() and path.stat().st_size <= 16 * 1024**2: + dependency_hashes[name] = hashlib.sha256(path.read_bytes()).hexdigest() + fingerprint = {"profile": profile, "target": target, "options": options, "source": source_hash, + "dependencies": dependency_hashes, + "script_id": script["id"], "timeout_seconds": timeout} + token = hashlib.sha256(json.dumps(fingerprint, sort_keys=True, ensure_ascii=False).encode()).hexdigest() + return {"mode": "native", "profile_id": profile["id"], "plan_token": token, + "ready": all(c["ok"] for c in checks), "checks": checks, "argv": argv, "command_preview": shlex.join(argv), + "cwd": profile["cwd"], "user": profile["user"], "environment": environment, + "credential_files": credential_files, "env_setup_files": setup_files, + "impact": profile["impact"], "interactive": profile.get("interactive", False), + "timeout_seconds": timeout, "source_sha256": source_hash, "dependency_hashes": dependency_hashes, + "output_paths": [render(p) for p in profile.get("output_paths", [])], + "notes": profile.get("notes", []) + ([f"目标服务：{target['url']}；模型：{target['model']}（原配置已复核）"] if target else [])} + + +def public_plan(plan): + keys = ("mode", "profile_id", "plan_token", "ready", "checks", "command_preview", "cwd", "user", + "impact", "interactive", "output_paths", "notes", "timeout_seconds", "source_sha256") + return {key: plan[key] for key in keys} diff --git a/console/native_rpc.py b/console/native_rpc.py new file mode 100644 index 0000000..7d33139 --- /dev/null +++ b/console/native_rpc.py @@ -0,0 +1,95 @@ +"""Private, bounded worker RPC. It exposes registered plans, never shell commands.""" +import json +import os +from pathlib import Path +import re +import socket +import socketserver +import stat +import threading +import uuid +from . import native_plans, test_catalog +from .catalog import safe_path +from .store import Store + + +def handle(settings, store, data): + operation = data.get("op") + if operation == "input": + identity, text = data.get("run_id", ""), data.get("text") + if not re.fullmatch(r"[a-f0-9]{32}", identity) or not isinstance(text, str) or "\x00" in text or len(text.encode()) > 1024: + raise ValueError("菜单输入格式不正确") + if not re.fullmatch(r"(?:[0-9 ,:./+\-]*|[yYnNqQ])", text): + raise ValueError("菜单通道仅接受数字选项、数字列表或 y/n/q；不接受命令、控制键或凭据") + run = store.run(identity) + execution = run.get("execution", {}) + if run["state"] != "running" or execution.get("mode") != "native" or not execution.get("interactive"): + raise ValueError("当前任务不接受菜单输入") + path = safe_path(settings.native_socket.parent / ("input-" + identity), settings.native_socket.parent) + if not stat.S_ISFIFO(path.lstat().st_mode): + raise ValueError("菜单输入通道不可用") + try: + descriptor = os.open(path, os.O_WRONLY | os.O_NONBLOCK | os.O_NOFOLLOW) + try: + payload = (text.rstrip("\r\n") + "\n").encode() + if os.write(descriptor, payload) != len(payload): + raise ValueError("菜单输入未完整送达") + finally:os.close(descriptor) + except OSError as exc: + raise ValueError("菜单暂未就绪或已结束") from exc + return {"accepted": True} + if operation not in {"preflight", "queue"}: + raise ValueError("未知原环境操作") + identity = data.get("script_id", "") + if not re.fullmatch(r"[a-f0-9]{32}", identity): + raise ValueError("测试项目编号不合法") + if operation == "queue": + request_id = str(uuid.UUID(data.get("request_id", ""))) + previous = store.run_for_request(request_id) + if previous: + if previous["script_id"] != identity: + raise ValueError("请求编号已被其他测试使用") + return previous + script = test_catalog.describe(settings, store.script(identity), store.scripts()) + plan = native_plans.build_plan(settings, script) + if operation == "preflight": + return native_plans.public_plan(plan) + if not script["enabled"] or script["status"] != "ready": + raise ValueError("请先配置并启用测试项目") + if not plan["ready"]: + raise ValueError("原环境预检未通过，请查看缺失条件") + if data.get("plan_token") != plan["plan_token"]: + raise ValueError("原入口、参数或配置已变化，请重新预检并确认") + acknowledged = data.get("impact_acknowledged") is True + if plan["impact"]["requires_confirmation"] and not acknowledged: + raise ValueError("此测试会使用共享资源或切换服务，需要本次运行的明确确认") + execution = native_plans.public_plan(plan) + execution.update(impact_acknowledged=acknowledged, verification="启动方案已核对；本次结果以真实运行记录为准") + return store.queue(script, request_id, data.get("source_ip", "unknown"), execution=execution) + + +def start(settings, store): + folder = settings.native_socket.parent + safe_path(folder, settings.root, must_exist=False).mkdir(mode=0o750, exist_ok=True) + if settings.native_socket.exists(): + if not stat.S_ISSOCK(settings.native_socket.lstat().st_mode): + raise ValueError("原环境 IPC 路径不是 socket") + settings.native_socket.unlink() + class Handler(socketserver.StreamRequestHandler): + def handle(self): + self.connection.settimeout(15) + try: + raw = self.rfile.readline(8193) + if len(raw) > 8192: + raise ValueError("原环境请求过大") + result = handle(settings, store, json.loads(raw)) + except (ValueError, KeyError) as exc: + result = {"error": str(exc.args[0])} + except Exception: + result = {"error": "原环境操作失败，请检查执行器状态"} + try:self.wfile.write(json.dumps(result).encode() + b"\n") + except OSError:pass + server = socketserver.UnixStreamServer(str(settings.native_socket), Handler) + os.chmod(settings.native_socket, 0o600) + threading.Thread(target=server.serve_forever, daemon=True).start() + return server diff --git a/console/requirements-test.txt b/console/requirements-test.txt new file mode 100644 index 0000000..a6f6b37 --- /dev/null +++ b/console/requirements-test.txt @@ -0,0 +1,4 @@ +-r requirements.txt +certifi==2026.7.22 +httpcore==1.0.9 +httpx==0.28.1 diff --git a/console/requirements.txt b/console/requirements.txt new file mode 100644 index 0000000..b1f8a53 --- /dev/null +++ b/console/requirements.txt @@ -0,0 +1,16 @@ +# Resolved and verified in the isolated project environment on 2026-10-13. +annotated-doc==0.0.5 +annotated-types==0.8.0 +anyio==4.15.1 +click==8.5.0 +fastapi==0.143.0 +h11==0.16.0 +idna==3.20 +opentelemetry-api==1.45.1 +pydantic==2.14.1 +pydantic_core==2.50.1 +python-multipart==0.0.32 +starlette==1.8.0 +typing-inspection==0.4.4 +typing_extensions==4.16.0 +uvicorn==0.54.0 diff --git a/console/settings.py b/console/settings.py new file mode 100644 index 0000000..531fd1e --- /dev/null +++ b/console/settings.py @@ -0,0 +1,62 @@ +from dataclasses import dataclass, field +import json +import os +from pathlib import Path + + +@dataclass +class Settings: + root: Path + sources: list + allowed_hosts: list = field(default_factory=lambda: ["10.88.118.188:14442", "10.88.118.188:14440"]) + allowed_networks: list = field(default_factory=lambda: ["10.88.0.0/17", "10.20.0.0/21"]) + test_mode: bool = False + max_upload: int = 1024 * 1024 + max_log: int = 16 * 1024 * 1024 + max_artifact: int = 32 * 1024 * 1024 + max_run_files: int = 64 + test_definitions: list = field(default_factory=list) + example_script_ids: list = field(default_factory=list) + native_catalog: dict = field(default_factory=lambda: {"profiles": [], "targets": []}) + + @property + def native_socket(self): + return self.root / "native-ipc" / "control.sock" + + @property + def library(self): + return self.root / "library" + + @property + def runs(self): + return self.root / "runs" + + @property + def db(self): + return self.root / "console-data" / "console.sqlite3" + + def prepare(self): + self.validate_paths() + for directory in (self.root, self.library, self.runs, self.db.parent): + directory.mkdir(parents=True, exist_ok=True) + + def validate_paths(self): + for directory in (self.root, self.library, self.runs, self.db.parent): + if not directory.is_absolute(): + raise ValueError("Runtime must be an absolute path") + for part in (directory, *directory.parents): + if part.is_symlink(): + raise ValueError("Runtime paths must not contain symlinks") + for path in (self.db, Path(str(self.db) + "-wal"), Path(str(self.db) + "-shm")): + if path.is_symlink(): + raise ValueError("Database symlinks are not supported") + + @classmethod + def from_env(cls): + project = Path(__file__).resolve().parents[1] + catalog = json.loads((project / "catalog/external-sources.json").read_text(encoding="utf-8")) + tests = json.loads((project / "catalog/test-definitions.json").read_text(encoding="utf-8")) + native_file = project / "catalog/native-profiles.json" + native = json.loads(native_file.read_text(encoding="utf-8")) if native_file.exists() else {"profiles": [], "targets": []} + return cls(Path(os.environ.get("XAS_CONSOLE_ROOT", str(project / "runtime"))), catalog["sources"], + test_definitions=tests["tests"], example_script_ids=tests.get("example_script_ids", []), native_catalog=native) diff --git a/console/static/app.js b/console/static/app.js new file mode 100644 index 0000000..4ecdf8d --- /dev/null +++ b/console/static/app.js @@ -0,0 +1,61 @@ +import {api, el, note, heading, errorBox, pageContext, bytes, date} from './ui.js'; +import {scriptList, scriptDetail} from './scripts.js'; +import {runList, runDetail} from './runs.js'; + +const main = document.querySelector('#main'); +let context; +let summaryBusy = false; + +async function summary() { + if (summaryBusy || document.visibilityState !== 'visible') return; + summaryBusy = true; + const health = document.querySelector('#worker-status'); + const notice = document.querySelector('#global-notice'); + try { + const data = await api('/api/summary'); + document.querySelector('#nav-count').textContent = data.scripts; + document.querySelector('#summary').replaceChildren(...[ + ['测试项目', data.scripts, '按测试行为统计', ''], ['可运行', data.ready, '业务测试已就绪', 'accent'], + ['进行中', data.active, '排队 / 执行', ''], ['运行记录', data.runs, `归档 ${bytes(data.storage.run_bytes)}`, ''] + ].map(([label, value, hint, style]) => el('div', {class: `stat ${style}`}, el('span', {class: 'stat-label'}, label), el('strong', {class: 'stat-value'}, value), el('span', {class: 'stat-foot'}, hint)))); + health.replaceChildren(el('span', {class: `worker-light ${data.worker.online ? '' : 'offline'}`, 'aria-hidden': 'true'}), data.worker.online ? '执行器在线 · 单任务队列' : '执行器离线'); + health.title = `最近心跳：${date(data.worker.last_seen)}`; + notice.hidden = data.worker.online; + notice.textContent = data.worker.online ? '' : `执行器当前离线，排队任务需要等待执行器恢复。最近心跳：${date(data.worker.last_seen)}。`; + } catch (error) { + health.replaceChildren(el('span', {class: 'worker-light offline', 'aria-hidden': 'true'}), '连接状态未知'); + notice.hidden = false; + notice.textContent = `工作台状态更新失败：${error.message} 显示的数据可能已过期。`; + } finally { summaryBusy = false; } +} + +async function route() { + context?.dispose(); + context = pageContext(main); + main.setAttribute('aria-busy', 'true'); + const value = location.hash.slice(1) || '/scripts'; + const [path, query = ''] = value.split('?'); + const segments = path.split('/').filter(Boolean); + const current = segments[0] || 'scripts'; + document.querySelectorAll('[data-nav]').forEach(nav => { + if (nav.dataset.nav === current) nav.setAttribute('aria-current', 'page'); + else nav.removeAttribute('aria-current'); + }); + document.title = `${current === 'runs' ? '运行记录' : '测试项目'} · XAS 测试控制台`; + const ctx = context; + summary(); + try { + if (segments.length > 2) throw new Error('页面地址无效。'); + const id = segments[1] ? decodeURIComponent(segments[1]) : null; + if (current === 'scripts') await (id ? scriptDetail(ctx, id) : scriptList(ctx)); + else if (current === 'runs') await (id ? runDetail(ctx, id) : runList(ctx, new URLSearchParams(query).get('script_id') || '')); + else ctx.show(heading('找不到此页面', '请选择左侧的测试项目或运行记录。'), note('页面地址不存在。')); + } catch (error) { if (ctx.alive) ctx.show(errorBox(error, route)); } +} + +document.querySelector('.skip-link').addEventListener('click', event => { event.preventDefault(); main.focus(); }); +window.addEventListener('hashchange', route); +window.addEventListener('pagehide', () => context?.dispose()); +document.addEventListener('visibilitychange', () => { if (document.visibilityState === 'visible') summary(); }); +setInterval(summary, 15000); +route(); diff --git a/console/static/core.js b/console/static/core.js new file mode 100644 index 0000000..a4c37e3 --- /dev/null +++ b/console/static/core.js @@ -0,0 +1,29 @@ +export function parseLines(value) { + return value.split(/\r?\n/).map(line => line.trim()).filter(Boolean); +} + +export function parseArgs(value) { + if (!value.trim().startsWith('[')) return parseLines(value); + let args; + try { args = JSON.parse(value); } + catch { throw new Error('参数 JSON 格式不正确，请填写字符串数组。'); } + if (!Array.isArray(args) || args.some(arg => typeof arg !== 'string')) { + throw new Error('参数必须是 JSON 字符串数组，或每行一个参数。'); + } + return args; +} + +export function appendLog(previous, incoming, limit = 240000) { + const all = previous + incoming; + return {text: all.slice(-limit), trimmed: all.length > limit}; +} + +export function requestId() { + if (typeof crypto.randomUUID === 'function') return crypto.randomUUID(); + // LAN HTTP can lack randomUUID; getRandomValues remains available there. + const bytes = crypto.getRandomValues(new Uint8Array(16)); + bytes[6] = (bytes[6] & 15) | 64; + bytes[8] = (bytes[8] & 63) | 128; + const hex = Array.from(bytes, byte => byte.toString(16).padStart(2, '0')).join(''); + return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`; +} diff --git a/console/static/index.html b/console/static/index.html new file mode 100644 index 0000000..287d320 --- /dev/null +++ b/console/static/index.html @@ -0,0 +1,37 @@ + + + + + + + + XAS · 测试控制台 + + + + + + +
+
ENGINEERING /测试控制台
正在连接执行器…
+
+ +
正在加载工作台…
+ +
+ + + + diff --git a/console/static/native-ui.js b/console/static/native-ui.js new file mode 100644 index 0000000..ff0d915 --- /dev/null +++ b/console/static/native-ui.js @@ -0,0 +1,187 @@ +import {api, el, button, badge, note, loading, field, input, select, kv, errorBox, dialog, scriptUrl, runUrl} from './ui.js'; + +export const isNative = record => record.execution?.mode === 'native'; +export function maxTimeout(script) { + if (!isNative(script)) return 7200; + const limit = Number(script.execution.max_timeout_seconds); + return Number.isSafeInteger(limit) && limit >= 5 ? Math.min(limit, 259200) : 259200; +} + +export function nativeOptions(parameters, values) { + const entries = []; + for (const parameter of parameters) { + const {key, label, type, required, min, max} = parameter; + const raw = values[key]; + const blank = raw === undefined || raw === null || String(raw).trim() === ''; + if (required && blank) throw new Error(`请填写${label}。`); + if (!['integer', 'number', 'select', 'text'].includes(type)) throw new Error(`${label}的参数类型不支持。`); + if (blank && type !== 'text') continue; + let value = raw ?? ''; + if (type === 'integer' || type === 'number') { + value = Number(raw); + if (!Number.isFinite(value)) throw new Error(`${label}必须是有效数字。`); + if (type === 'integer' && !Number.isSafeInteger(value)) throw new Error(`${label}必须是整数。`); + if ((min !== undefined && value < min) || (max !== undefined && value > max)) throw new Error(`${label}超出允许范围。`); + } else if (type === 'select') { + const option = (parameter.options || []).find(item => String(item.value) === String(raw)); + if (!option) throw new Error(`请选择有效的${label}。`); + value = option.value; + } else value = String(value); + entries.push([key, value]); + } + return Object.fromEntries(entries); +} + +export function nativeParameterForm(script) { + const parameters = script.execution.parameters || []; + const saved = script.config.native_options || {}; + const controls = new Map(); + const node = el('div', {class: 'native-parameters'}); + for (const parameter of parameters) { + const value = Object.hasOwn(saved, parameter.key) ? saved[parameter.key] : parameter.default; + let control; + if (parameter.type === 'select') { + const options = (parameter.options || []).map(item => [item.value, item.label]); + if (value === undefined || value === null || value === '' || !options.some(([id]) => String(id) === String(value))) options.unshift(['', '请选择…']); + control = select(parameter.label, options, value ?? ''); + } else { + const numeric = ['integer', 'number'].includes(parameter.type); + control = input({type: numeric ? 'number' : 'text', value: value ?? '', + min: numeric ? parameter.min : undefined, max: numeric ? parameter.max : undefined, + step: parameter.type === 'integer' ? '1' : numeric ? 'any' : undefined, + autocomplete: 'off', spellcheck: 'false'}); + } + if (parameter.required) control.required = true; + controls.set(parameter.key, control); + const bounds = parameter.min !== undefined || parameter.max !== undefined + ? `允许范围：${parameter.min ?? '不限'} 至 ${parameter.max ?? '不限'}。` : ''; + node.append(field(parameter.label, control, [parameter.help, bounds].filter(Boolean).join(' '))); + } + if (!parameters.length) node.append(note('此原环境方案使用固定参数。')); + return {node, read: () => nativeOptions(parameters, Object.fromEntries(Array.from(controls, ([key, control]) => [key, control.value])))}; +} + +function impactView(impact) { + if (!impact) return null; + return el('div', {class: `native-impact ${impact.requires_confirmation ? 'attention' : ''}`}, + el('h3', {}, impact.title || '运行影响'), + (impact.details || []).length ? el('ul', {}, impact.details.map(detail => el('li', {}, detail))) : null, + el('p', {class: 'muted'}, impact.requires_confirmation ? '每次启动前须确认本次影响。' : '普通测试，无额外影响确认。')); +} + +export function nativeScriptInfo(script) { + if (!isNative(script)) return null; + const execution = script.execution; + return el('section', {class: 'panel native-plan'}, el('div', {class: 'panel-header'}, el('h2', {}, '原环境执行方案'), badge('running', '原环境')), + kv([['运行账号', execution.user], ['原工作目录', execution.cwd], ['解释器', execution.interpreter], ['方案编号', execution.profile_id], + ['交互方式', execution.interactive ? '原菜单 · 可发送菜单选项' : '自动执行']]), + execution.description ? el('p', {class: 'native-description'}, execution.description) : null, + impactView(execution.impact), note('启动方案已接入，未完成本轮业务验收。', 'info')); +} + +export async function preflightNativeRun(ctx, script) { + const content = el('div', {}, loading('正在只读预检原环境…')); + const panel = dialog('原环境运行预检', content); + panel.classList.add('native-dialog'); + let plan; + try { + plan = await api(`${scriptUrl(script.id)}/preflight`, {method: 'POST', body: {}}, ctx.signal); + if (!ctx.alive || !panel.open) return null; + const command = el('pre', {class: 'native-command mono', tabindex: '0', 'aria-label': '本次启动命令'}, plan.command_preview || '未生成启动命令'); + content.replaceChildren(...[note(plan.ready ? '只读预检通过，原脚本尚未执行。' : '预检未通过，本次不会执行。', plan.ready ? 'success' : 'danger'), + kv([['执行模式', plan.mode === 'native' ? '原环境' : plan.mode], ['运行账号', plan.user], ['原工作目录', plan.cwd]]), + el('h3', {class: 'native-subtitle'}, '本次启动命令'), command, + el('ul', {class: 'preflight-checks'}, (plan.checks || []).map(check => el('li', {}, + badge(check.ok ? 'ready' : 'failed', check.ok ? '通过' : '未通过'), el('div', {}, el('strong', {}, check.name), el('p', {}, check.message || ''))))), + impactView(plan.impact), + (plan.output_paths || []).length ? el('details', {class: 'disclosure'}, el('summary', {}, '查看原输出规则'), el('pre', {}, plan.output_paths.join('\n'))) : null, + ...(plan.notes || []).map(text => note(text, 'info'))].filter(node => node !== null)); + if (!plan.ready) return null; + if (plan.mode !== 'native' || typeof plan.plan_token !== 'string' || !plan.plan_token) throw new Error('预检未返回有效的原环境计划，请关闭窗口后重新预检。'); + if (!plan.impact?.requires_confirmation) { + content.append(note('正在创建本次运行记录…', 'info')); + return {payload: {plan_token: plan.plan_token}, close: () => panel.close()}; + } + } catch (error) { + if (ctx.alive && panel.open) content.replaceChildren(errorBox(error), note('本次没有提交运行。关闭窗口后可重新预检。')); + return null; + } + return new Promise(resolve => { + let acknowledged = false; + const confirm = button('确认影响并开始本次运行', () => { + if (!ctx.alive || !panel.open || acknowledged) return; + acknowledged = true; + confirm.disabled = true; + panel.close(); + resolve({payload: {plan_token: plan.plan_token, impact_acknowledged: true}, close: () => {}}); + }, 'primary'); + panel.addEventListener('close', () => { if (!acknowledged) resolve(null); }, {once: true}); + content.append(note('确认仅适用于上面显示的源码、参数和方案；每次重新启动都会重新预检。'), + el('div', {class: 'form-footer'}, button('暂不运行', () => panel.close()), confirm)); + }); +} + +export function validateMenuInput(text) { + if (text.includes('\0')) throw new Error('菜单输入不能包含 NUL 字符。'); + if (new TextEncoder().encode(text).length > 1024) throw new Error('单次菜单输入不能超过 1024 UTF-8 字节。'); + if (!/^(?:[0-9 ,:./+\-]*|[yYnNqQ])$/.test(text)) throw new Error('仅支持数字选项、数字列表或 y/n/q；不接受命令、控制键或凭据。'); +} + +export function nativeRunPanel(ctx, initialRun) { + let current = initialRun; + let blocked = false; + let sending = false; + let executionKey = ''; + const details = el('div'); + const control = input({type: 'text', autocomplete: 'off', spellcheck: 'false', maxlength: '1024', placeholder: '输入原菜单选项后发送'}); + const feedback = el('div', {'aria-live': 'polite'}); + const submit = el('button', {type: 'submit', class: 'button primary'}, '发送菜单选项'); + const menu = el('form', {class: 'native-menu', autocomplete: 'off', hidden: true}, + el('h3', {}, '原菜单输入'), note('仅支持数字选项、数字列表或 y/n/q，不接受命令和控制键。不要输入密码或令牌；发送后清空，不保存输入历史。'), + field('菜单选项', control, '留空发送回车以接受原菜单默认值；单次最多 1024 UTF-8 字节。'), + feedback, el('div', {class: 'form-footer'}, submit)); + const node = el('section', {class: 'panel native-plan'}, details, menu); + const eligible = () => isNative(current) && current.execution.interactive && current.state === 'running'; + function update(run, options = {}) { + current = run; + blocked = Boolean(options.blocked); + const execution = run.execution || {mode: 'container'}; + const key = JSON.stringify(execution); + if (key !== executionKey) { + executionKey = key; + details.replaceChildren(el('div', {class: 'panel-header'}, el('h2', {}, '执行环境'), badge('running', isNative(run) ? '原环境' : '隔离容器'))); + if (isNative(run)) details.append(...[ + kv([['运行账号', execution.user], ['原工作目录', execution.cwd], ['方案编号', execution.profile_id], + ['影响确认', execution.impact?.requires_confirmation ? execution.impact_acknowledged ? '已确认本次影响' : '未记录确认' : '无需额外确认']]), + el('h3', {class: 'native-subtitle'}, '实际启动命令'), el('pre', {class: 'native-command mono', tabindex: '0'}, execution.command_preview || '尚未记录启动命令'), + impactView(execution.impact), + execution.verification ? el('details', {class: 'disclosure'}, el('summary', {}, '查看执行核对信息'), el('pre', {}, JSON.stringify(execution.verification, null, 2))) : null].filter(node => node !== null)); + else details.append(el('p', {class: 'muted'}, '本次运行使用隔离容器。')); + } + menu.hidden = !eligible(); + if (!eligible()) control.value = ''; + control.disabled = blocked || sending || !eligible(); + submit.disabled = control.disabled; + } + menu.addEventListener('submit', async event => { + event.preventDefault(); + if (!ctx.alive || sending || blocked || !eligible()) return; + let text = control.value; + control.value = ''; + feedback.replaceChildren(); + try { validateMenuInput(text); } + catch (error) { feedback.replaceChildren(errorBox(error)); return; } + sending = true; + update(current, {blocked}); + try { + const response = api(`${runUrl(current.id)}/input`, {method: 'POST', body: {text}}, ctx.signal); + text = ''; + const result = await response; + if (ctx.alive) feedback.replaceChildren(note(result.accepted === true ? '输入已送达本次运行。' : '输入结果未确认，请先核对当前状态和日志。', result.accepted === true ? 'success' : '')); + } catch { + if (ctx.alive) feedback.replaceChildren(note('输入未送达或结果尚未确认。请核对运行状态和最新日志，再决定是否重新输入。', 'danger')); + } finally { text = ''; sending = false; if (ctx.alive) update(current, {blocked}); } + }); + update(initialRun); + return {node, update}; +} diff --git a/console/static/related-files.js b/console/static/related-files.js new file mode 100644 index 0000000..7e29740 --- /dev/null +++ b/console/static/related-files.js @@ -0,0 +1,63 @@ +import {api, el, select, input, loading, note, errorBox, link, scriptUrl} from './ui.js'; + +const roles = {entry: '执行入口', support: '配套文件', self_test: '套件内部验证', variant: '相关实现 / 场景'}; + +export function relatedFiles(ctx, script) { + const content = el('div', {class: 'related-files'}); + const panel = el('details', {class: 'panel disclosure'}, + el('summary', {}, `相关文件 · ${script.file_count || 1} 个`), content); + let loaded = false; + let busy = false; + async function load() { + if (busy || loaded || !panel.open) return; + busy = true; + content.replaceChildren(loading('正在读取项目文件…')); + try { + const {items} = await api(`${scriptUrl(script.id)}/files`, {}, ctx.signal); + if (!ctx.alive) return; + const search = input({type: 'search', placeholder: '按文件名或路径查找', 'aria-label': '搜索相关文件'}); + const choice = select('查看相关文件', []); + const info = el('p', {class: 'source-info mono'}); + const feedback = el('div'); + const download = link('下载此文件', '', 'button small'); + const code = el('pre', {class: 'code', tabindex: '0', 'aria-label': '相关文件源代码，只读'}); + content.replaceChildren(note('这里展示测试入口、配套模块和相关实现。查看文件不会改变本次测试的执行入口。'), + search, choice, info, download, feedback, code); + let generation = 0; + async function show() { + const ticket = ++generation; + const file = items.find(item => item.id === choice.value); + download.hidden = true; + feedback.replaceChildren(); + info.textContent = file ? `${roles[file.role] || '配套文件'} · ${file.source_path}` : ''; + code.textContent = file ? '正在读取…' : '没有匹配的文件。'; + if (!file) return; + try { + const data = await api(`${scriptUrl(file.id)}/code`, {}, ctx.signal); + if (!ctx.alive || ticket !== generation) return; + code.textContent = data.code || '（空文件）'; + download.href = `${scriptUrl(file.id)}/download`; + download.hidden = Boolean(data.redacted); + if (data.redacted) feedback.append(note('疑似凭据已隐藏，该文件不可下载。')); + } catch (error) { + if (ctx.alive && ticket === generation) { code.textContent = ''; feedback.replaceChildren(errorBox(error, show)); } + } + } + function filter() { + const term = search.value.toLowerCase(); + const selected = choice.value; + const matching = items.filter(file => (file.name + file.source_path).toLowerCase().includes(term)); + choice.replaceChildren(...matching.map(file => el('option', {value: file.id}, `${roles[file.role]} · ${file.relative_path}`))); + if (matching.some(file => file.id === selected)) choice.value = selected; + show(); + } + choice.addEventListener('change', show); + search.addEventListener('input', filter); + loaded = true; + filter(); + } catch (error) { if (ctx.alive) content.replaceChildren(errorBox(error, load)); } + finally { busy = false; } + } + panel.addEventListener('toggle', load); + return panel; +} diff --git a/console/static/runs.js b/console/static/runs.js new file mode 100644 index 0000000..c77f59b --- /dev/null +++ b/console/static/runs.js @@ -0,0 +1,184 @@ +import {api, el, button, link, badge, note, empty, loading, select, heading, kv, errorBox, dialog, date, bytes, enc, runUrl, active} from './ui.js'; +import {appendLog} from './core.js'; +import {isNative, nativeRunPanel} from './native-ui.js'; + +export function runTable(items) { + return el('div', {class: 'table-wrap'}, el('table', {}, + el('thead', {}, el('tr', {}, ['脚本 / 运行编号', '状态', '版本', '创建时间', '退出码', ''].map(title => el('th', {scope: 'col'}, title)))), + el('tbody', {}, items.map(run => el('tr', {class: 'run-row'}, + el('td', {}, el('span', {class: 'run-name'}, run.script_name), el('div', {class: 'source-info mono'}, run.id)), + el('td', {}, badge(run.state), run.synthetic ? badge('synthetic', '模拟验收') : null), + el('td', {class: 'mono'}, `v${run.version}`), el('td', {}, date(run.created_at)), + el('td', {class: 'mono'}, run.exit_code ?? '—'), el('td', {}, el('a', { + href: `#/runs/${enc(run.id)}`, class: 'button detail-link run-open', + 'aria-label': `查看运行详情：${run.script_name}，${run.id}`}, '查看详情 →'))))))); +} + +export async function runList(ctx, scriptId = '') { + const status = select('运行状态', [['', '全部状态'], ['running', '运行中'], ['queued', '排队中'], ['succeeded', '进程成功'], ['failed', '失败'], ['cancelled', '已取消'], ['timed_out', '已超时'], ['interrupted', '已中断']]); + const origin = select('记录类型', [['', '全部记录'], ['real', '普通脚本运行'], ['synthetic', '模拟验收']]); + const results = el('div', {}, loading('正在读取运行记录…')); + const feedback = el('div', {'aria-live': 'polite'}); + const updated = el('span', {class: 'muted'}); + let items = []; + let busy = false; + const refresh = button('↻ 刷新', () => update()); + ctx.show(heading('运行记录', scriptId ? '查看此脚本最近 100 次运行的状态、日志与结果。' : '查看最近 100 次运行。每次执行使用固定版本和独立结果目录。', + [scriptId ? link('查看全部记录', '#/runs', 'button') : null, refresh]), + el('div', {class: 'filters'}, status, origin, scriptId ? link('返回脚本', `#/scripts/${enc(scriptId)}`, 'button small') : null), + el('div', {class: 'section-title'}, el('span', {class: 'muted'}, '退出码 0 表示进程正常结束；业务结论以脚本报告为准。'), updated), feedback, results); + const render = () => { + const filtered = items.filter(run => (!status.value || run.state === status.value) + && (!origin.value || Boolean(run.synthetic) === (origin.value === 'synthetic'))); + results.replaceChildren(filtered.length ? runTable(filtered) : empty('没有符合条件的运行记录', '调整筛选条件，或从脚本详情开始一次运行。')); + }; + async function update() { + if (busy) return; + busy = true; + refresh.disabled = true; + try { + const data = await api(`/api/runs?limit=100${scriptId ? `&script_id=${enc(scriptId)}` : ''}`, {}, ctx.signal); + if (!ctx.alive) return; + items = data.items; + render(); + feedback.replaceChildren(); + updated.textContent = `更新于 ${new Date().toLocaleTimeString('zh-CN', {hour12: false})}`; + } catch (error) { + if (ctx.alive) { feedback.replaceChildren(errorBox(error, update)); if (!items.length) results.replaceChildren(); } + } finally { busy = false; refresh.disabled = false; } + } + [status, origin].forEach(control => control.addEventListener('change', render)); + ctx.repeat(update, 6000); +} + +export async function runDetail(ctx, id) { + const navigation = () => el('div', {class: 'detail-navigation'}, link('← 返回运行记录', '#/runs', 'button back-button')); + ctx.show(navigation(), loading('正在读取运行状态…')); + let run; + try { run = await api(runUrl(id), {}, ctx.signal); } + catch (error) { if (ctx.alive) ctx.show(navigation(), heading('运行详情', '运行记录读取失败。'), errorBox(error, () => runDetail(ctx, id))); return; } + if (!ctx.alive) return; + let offset = 0; + let logText = ''; + let retainedTrimmed = false; + let serverTruncated = false; + let busy = false; + let logDone = false; + let cancelling = false; + let cancelRequested = false; + let mutation = 0; + let artifactsKey = ''; + const feedback = el('div', {'aria-live': 'polite'}); + const execution = nativeRunPanel(ctx, run); + const status = el('div', {class: 'actions'}); + const metadata = el('div', {class: 'run-summary'}); + const message = el('div'); + const log = el('pre', {class: 'log', tabindex: '0', 'aria-label': '运行标准输出与错误日志'}, '正在读取日志…'); + const logStatus = el('span', {}, '等待日志'); + const logHint = el('span', {}, '标准输出 / 标准错误'); + const follow = el('input', {type: 'checkbox', checked: true}); + const files = el('div', {class: 'artifact-list'}); + const retry = button('立即刷新', () => tick(), 'small'); + const cancel = button('取消运行', async () => { + if (cancelling || !active(run)) return; + cancelling = true; + execution.update(run, {blocked: true}); + mutation++; + cancel.disabled = true; + cancel.textContent = '正在取消…'; + try { + run = await api(`${runUrl(id)}/cancel`, {method: 'POST'}, ctx.signal); + cancelRequested = true; + if (ctx.alive) { feedback.replaceChildren(); renderRun(); } + } catch (error) { if (ctx.alive) feedback.replaceChildren(errorBox(error)); } + finally { cancelling = false; if (ctx.alive) { cancel.textContent = '取消运行'; cancel.disabled = !active(run); execution.update(run, {blocked: cancelRequested}); } } + }, 'danger'); + ctx.show(navigation(), el('div', {class: 'breadcrumbs'}, link('运行记录', '#/runs'), ' / ', id), + heading(run.script_name, `运行 ${id}`, [link('查看测试项目', `#/scripts/${enc(run.script_id)}`, 'button back-button'), cancel]), + feedback, el('section', {class: 'panel'}, el('div', {class: 'panel-header'}, el('h2', {}, '运行概况'), status), metadata, message, + kv([['脚本版本', `v${run.version}`], ['源码摘要', run.sha256], ['创建时间', date(run.created_at)], ['请求来源', run.source_ip || '—']]), + el('details', {class: 'disclosure'}, el('summary', {}, '查看本次运行配置快照'), el('pre', {}, JSON.stringify(run.config, null, 2)))), + execution.node, + el('section', {class: 'panel log-panel'}, el('div', {class: 'log-toolbar'}, el('h2', {}, '实时日志'), + el('div', {class: 'actions'}, el('label', {}, follow, '跟随最新日志'), retry, link('下载完整日志', `${runUrl(id)}/log/download`, 'button small'))), + log, el('div', {class: 'log-hint'}, logStatus, logHint)), + el('section', {class: 'panel'}, el('div', {class: 'panel-header'}, el('h2', {}, '结果文件')), files), + note(isNative(run) ? '取消与超时仅处理本次原环境任务的本机进程。原脚本通过 Docker/tmux 启动的任务可能仍在运行；请核对收尾记录，不能据此认定原模型已恢复。' + : '取消与超时只终止本次执行容器，不能证明外部模型服务已停止推理。')); + + function renderRun() { + execution.update(run, {blocked: cancelling || cancelRequested}); + status.replaceChildren(badge(run.state)); + if (run.synthetic) status.append(badge('synthetic', '模拟验收')); + cancel.hidden = !active(run); + cancel.disabled = cancelling || !active(run); + metadata.replaceChildren(...[ + ['开始时间', date(run.started_at)], ['结束时间', date(run.finished_at)], + ['退出码', run.exit_code ?? '—'], ['执行类型', run.synthetic ? '模拟验收' : '脚本测试'] + ].map(([label, value]) => el('div', {}, el('small', {}, label), el('strong', {}, value)))); + message.replaceChildren(); + if (run.message) message.append(note(run.message, ['failed', 'timed_out', 'interrupted'].includes(run.state) ? 'danger' : 'info')); + if (run.state === 'succeeded') message.append(note('进程正常结束。是否达到测试目标，请查看脚本产生的报告。', 'success')); + if (run.synthetic) message.append(note('这是模拟验收记录，不代表真实模型服务或测试业务通过。', 'info')); + const key = JSON.stringify([run.state, run.artifacts]); + if (key !== artifactsKey) { + artifactsKey = key; + files.replaceChildren(...((run.artifacts || []).length ? run.artifacts.map(artifact => artifactRow(ctx, run, artifact)) : + [empty(active(run) ? '结果文件等待归档' : '本次运行没有归档文件', active(run) ? '执行结束后，登记的结果文件会出现在这里。' : '脚本可能没有生成文件，或输出路径未登记；请查看日志和运行配置。')])); + } + } + + async function tick() { + if (busy || cancelling) return; + if (!active(run) && logDone) return false; + busy = true; + retry.disabled = true; + const ticket = mutation; + try { + const [current, chunk] = await Promise.all([ + api(runUrl(id), {}, ctx.signal), api(`${runUrl(id)}/log?offset=${offset}`, {}, ctx.signal) + ]); + if (!ctx.alive) return; + if (ticket !== mutation) return true; + run = current; + if (!Number.isSafeInteger(chunk.next_offset) || chunk.next_offset < offset) throw new Error('日志游标异常，请重新打开此运行。'); + if (chunk.next_offset > offset) { + const retained = appendLog(logText, chunk.text); + logText = retained.text; + retainedTrimmed ||= retained.trimmed; + } + offset = chunk.next_offset; + logDone = chunk.done; + serverTruncated ||= chunk.truncated; + log.textContent = logText || (active(run) ? '等待脚本输出…' : '本次运行没有标准输出或标准错误。'); + if (follow.checked) log.scrollTop = log.scrollHeight; + logStatus.textContent = active(run) ? (run.state === 'queued' ? '已排队 · 等待执行器' : '持续更新中 · 每 2.5 秒刷新') : logDone ? '日志读取完成' : '正在读取剩余日志…'; + logHint.textContent = serverTruncated ? '日志达到服务端限制，后续输出可能未保留。' : retainedTrimmed ? '页面仅显示最近 240,000 字符；完整内容请下载日志。' : `已读取 ${bytes(offset)}`; + feedback.replaceChildren(); + renderRun(); + return active(run) || !logDone; + } catch (error) { + if (ctx.alive) { execution.update(run, {blocked: true}); feedback.replaceChildren(errorBox(error, tick)); logStatus.textContent = '连接暂时中断，保留已读取日志并继续重试'; } + } finally { busy = false; retry.disabled = false; } + } + follow.addEventListener('change', () => { if (follow.checked) log.scrollTop = log.scrollHeight; }); + renderRun(); + ctx.repeat(tick); +} + +function artifactRow(ctx, run, artifact) { + const url = `${runUrl(run.id)}/artifacts/${enc(artifact.id)}`; + const actions = [link('下载', url, 'button small')]; + if (['text', 'json'].includes(artifact.kind)) actions.unshift(button('预览', async () => { + const content = el('div', {}, loading('正在读取文件…')); + const panel = dialog(artifact.name, content); + try { + const preview = await api(`${url}/preview`, {}, ctx.signal); + if (!ctx.alive || !panel.open) return; + content.replaceChildren(el('pre', {class: 'code', tabindex: '0'}, preview.text || '（空文件）')); + if (preview.truncated) content.prepend(note('仅显示文件开头部分，请下载查看完整内容。')); + } catch (error) { if (ctx.alive && panel.open) content.replaceChildren(errorBox(error)); } + }, 'small')); + return el('div', {class: 'artifact'}, el('div', {class: 'artifact-name'}, artifact.name, + el('small', {}, `${bytes(artifact.size)} · ${artifact.kind === 'json' ? 'JSON' : artifact.kind === 'text' ? '文本' : '文件'}`)), el('div', {class: 'actions'}, actions)); +} diff --git a/console/static/scripts.js b/console/static/scripts.js new file mode 100644 index 0000000..b2ce3db --- /dev/null +++ b/console/static/scripts.js @@ -0,0 +1,275 @@ +import {api, el, button, link, badge, note, empty, loading, field, input, textarea, select, heading, kv, errorBox, toast, dialog, date, enc, scriptUrl} from './ui.js'; +import {parseArgs, parseLines, requestId} from './core.js'; +import {runTable} from './runs.js'; +import {relatedFiles} from './related-files.js'; +import {isNative, maxTimeout, nativeParameterForm, nativeScriptInfo, preflightNativeRun} from './native-ui.js'; + +const pendingRuns = new Map(); +function pendingRequest(id) { + if (pendingRuns.has(id)) return pendingRuns.get(id); + let value; + try { value = sessionStorage.getItem(`xas.pending-run.${id}`); } catch { /* Private browser settings can disable storage. */ } + if (!value || !/^[0-9a-f-]{36}$/.test(value)) value = requestId(); + pendingRuns.set(id, value); + try { sessionStorage.setItem(`xas.pending-run.${id}`, value); } catch { /* The in-memory request still supports safe retry. */ } + return value; +} +function clearRequest(id) { + pendingRuns.delete(id); + try { sessionStorage.removeItem(`xas.pending-run.${id}`); } catch { /* Storage may be unavailable. */ } +} +const scriptState = script => !script.enabled && script.status === 'ready' ? 'disabled' : script.status; +const scriptBadge = script => badge(scriptState(script), scriptState(script) === 'disabled' ? '未启用' : undefined); +const sourceLabel = script => script.kind === 'managed' ? '托管脚本' : '外部原文件'; +const profileLabel = script => isNative(script) ? '服务器原环境' : script.config.profile === 'legacy_smoke' ? '旧版 Smoke 兼容环境' : '标准运行环境'; +const typeLabel = script => script.category === 'example' ? '验收示例' : script.test_kind === 'suite' ? '测试套件' : '单项测试'; +const groupLabels = new Map([ + ['uploaded', '上传的脚本'], ['company-gpu-suite', '公司 GPU 测试套件'], + ['dsv41-trial-20261010', 'DeepSeek 试验脚本（10/10）'], ['model-trials-20261011', '模型试验脚本（10/11）'] +]); + +export async function scriptList(ctx) { + ctx.show(heading('测试项目', '按实际测试行为管理，一项对应一次完整测试。'), loading()); + try { + const {items} = await api('/api/scripts?include_examples=true', {}, ctx.signal); + if (!ctx.alive) return; + const search = input({type: 'search', placeholder: '搜索测试名称、用途或入口', 'aria-label': '搜索测试'}); + const group = select('来源目录', [['', '全部来源'], ...Array.from(new Set(items.map(item => item.source_group || '未分组'))).sort().map(name => [name, groupLabels.get(name) || name])]); + const status = select('脚本状态', [['', '全部状态'], ['ready', '可运行'], ['needs_configuration', '待配置'], ['missing', '源文件缺失'], ['disabled', '未启用']]); + const kind = select('测试类型', [['', '全部类型'], ['suite', '测试套件'], ['test', '单项测试']]); + const purpose = select('项目用途', [['test', '业务测试'], ['example', '验收示例'], ['', '全部项目']], 'test'); + const results = el('div'); + const count = el('span', {class: 'muted', role: 'status'}); + const discover = button('↻ 刷新来源', async () => { + discover.disabled = true; + try { + const result = await api('/api/discover', {method: 'POST'}, ctx.signal); + if (ctx.alive) { + toast(`目录已刷新：${result.tests} 项测试。内部文件更新不会自动新增测试项目。`); + await scriptList(ctx); + } + } catch (error) { if (ctx.alive) { toast(error.message); discover.disabled = false; } } + }); + ctx.show(heading('测试项目', '一项对应一次测试；套件内部的多个脚本统一在详情中查看。', [discover, button('＋ 新增测试', () => uploadDialog(ctx), 'primary')]), + el('div', {class: 'filters'}, el('div', {class: 'search'}, search), purpose, kind, status, group), + el('div', {class: 'section-title'}, el('span', {class: 'muted'}, '按测试行为组织 · 验收示例默认隐藏'), count), results); + const render = () => { + const term = search.value.trim().toLowerCase(); + const filtered = items.filter(item => (!group.value || (item.source_group || '未分组') === group.value) + && (!status.value || scriptState(item) === status.value) && (!kind.value || item.test_kind === kind.value) + && (!purpose.value || item.category === purpose.value) + && (!term || [item.name, item.description, item.source_path].some(value => (value || '').toLowerCase().includes(term)))); + count.textContent = `${filtered.length} 项测试`; + results.replaceChildren(); + if (!filtered.length) { results.append(empty(items.length ? '没有匹配的测试项目' : '从第一个测试开始', items.length ? '调整关键词或筛选条件。' : '上传一个测试的入口脚本，创建测试项目。')); return; } + const groups = new Map(); + for (const item of filtered) { + const name = item.category === 'example' ? '控制台验收示例' : item.test_kind === 'suite' ? '测试套件' : '单项测试'; + if (!groups.has(name)) groups.set(name, []); + groups.get(name).push(item); + } + for (const [name, scripts] of groups) results.append(el('section', {}, + el('div', {class: 'section-title'}, el('h2', {}, name, el('span', {class: 'count'}, `${scripts.length} 项`))), + el('div', {class: 'catalog-grid'}, scripts.map(scriptCard)))); + }; + [search, group, status, kind, purpose].forEach(control => control.addEventListener('input', render)); + render(); + } catch (error) { if (ctx.alive) ctx.show(heading('测试项目', '查看、配置与运行测试。'), errorBox(error, () => scriptList(ctx))); } +} + +function scriptCard(script) { + return el('a', {class: 'script-card', href: `#/scripts/${enc(script.id)}`, 'aria-label': script.name}, + el('div', {class: 'card-top'}, el('span', {class: `language ${script.language}`}, typeLabel(script)), scriptBadge(script)), + el('h3', {}, script.name), + el('p', {class: 'script-description'}, script.description || '尚未填写说明。'), + el('p', {class: 'card-source', title: script.source_path}, script.source_path), + script.reason ? el('p', {class: 'card-reason'}, script.reason) : null, + el('div', {class: 'card-bottom'}, el('span', {}, `${script.file_count} 个相关文件 · v${script.version}`), el('span', {class: 'button detail-link'}, '查看项目详情 →'))); +} + +function uploadDialog(ctx, script) { + const file = input({type: 'file', accept: '.py,.sh', required: '', name: 'file'}); + const name = input({name: 'name', required: '', maxlength: 120, placeholder: '例如：模型接口连通性检查'}); + const description = textarea({name: 'description', placeholder: '说明测试目标、运行条件和输出结果'}); + const feedback = el('div', {'aria-live': 'polite'}); + const submit = el('button', {class: 'button primary', type: 'submit'}, script ? '上传新版本' : '创建脚本'); + const form = el('form', {}, note(script ? '新版本单独保存，不覆盖历史源码。后续运行使用最新版本，已有运行记录保持原版本。' : '支持 Python 和 Shell。脚本代码只读；后续修改请上传新版本。'), + field('脚本文件', file, '选择 .py 或 .sh 文件。'), + script ? null : field('脚本名称', name), script ? null : field('说明', description), feedback, + el('div', {class: 'form-footer'}, submit)); + const panel = dialog(script ? `上传新版本 · ${script.name}` : '上传新脚本', form); + form.addEventListener('submit', async event => { + event.preventDefault(); + if (submit.disabled || !form.reportValidity()) return; + const data = new FormData(form); + submit.disabled = true; + submit.textContent = '正在上传…'; + feedback.replaceChildren(); + try { + const saved = await api(script ? `${scriptUrl(script.id)}/versions` : '/api/scripts/upload', {method: 'POST', body: data}, ctx.signal); + if (!ctx.alive) return; + panel.close(); + toast(script ? '新版本已保存。' : '脚本已创建。'); + if (location.hash === `#/scripts/${enc(saved.id)}`) await scriptDetail(ctx, saved.id); + else location.hash = `/scripts/${enc(saved.id)}`; + } catch (error) { + if (ctx.alive) feedback.replaceChildren(errorBox(error), note('如果连接中断，请先关闭窗口并刷新脚本库，核对是否已保存，再决定重新上传。')); + } finally { submit.disabled = false; submit.textContent = script ? '上传新版本' : '创建脚本'; } + }); +} + +export async function scriptDetail(ctx, id) { + const navigation = () => el('div', {class: 'detail-navigation'}, link('← 返回测试项目', '#/scripts', 'button back-button')); + ctx.show(navigation(), loading('正在读取脚本与版本…')); + try { + const script = await api(scriptUrl(id), {}, ctx.signal); + if (!ctx.alive) return; + if (!script.is_test) { + const source = el('section', {class: 'panel'}); + ctx.show(navigation(), heading(script.name, '这是测试内部的源码文件。'), note('请从测试项目的执行入口配置和运行。'), source); + sourcePanel(ctx, source, script); + return; + } + let dirty = false; + const feedback = el('div', {'aria-live': 'polite'}); + const start = button('▶ 开始运行', async () => { + if (start.disabled) return; + start.disabled = true; + start.textContent = '正在提交…'; + feedback.replaceChildren(); + let prepared; + try { + if (isNative(script)) { + start.textContent = '正在预检…'; + prepared = await preflightNativeRun(ctx, script); + if (!prepared || !ctx.alive || dirty) return; + start.textContent = '正在提交…'; + } + const run = await api(`${scriptUrl(id)}/runs`, {method: 'POST', body: {request_id: pendingRequest(id), ...prepared?.payload}}, ctx.signal); + clearRequest(id); + if (ctx.alive) location.hash = `/runs/${enc(run.id)}`; + } catch (error) { + if (ctx.alive) feedback.replaceChildren(errorBox(error), note(isNative(script) + ? '再次点击会重新预检并重新确认影响，同时复用本次请求编号核对原记录，避免重复排队。' + : '再次点击会复用本次请求编号，核对原运行记录，避免重复排队。')); + } finally { + prepared?.close(); + if (ctx.alive) { start.disabled = dirty || !script.enabled || script.status !== 'ready'; start.textContent = '▶ 开始运行'; } + } + }, 'primary'); + start.disabled = !script.enabled || script.status !== 'ready'; + const actions = [link('运行记录', `#/runs?script_id=${enc(id)}`, 'button')]; + if (script.kind === 'managed') actions.push(button('上传新版本', () => uploadDialog(ctx, script))); + actions.push(start); + const source = el('section', {class: 'panel'}); + const history = el('section', {class: 'panel'}, el('div', {class: 'panel-header'}, el('h2', {}, '近期运行')), loading()); + ctx.show(navigation(), el('div', {class: 'breadcrumbs'}, link('测试项目', '#/scripts'), ' / ', script.name), + heading(script.name, script.description || '查看源代码、配置参数并开始一次独立运行。', actions), + feedback, + script.reason ? note(script.reason, script.status === 'missing' ? 'danger' : '') : null, + !script.enabled ? note('当前脚本未启用。确认运行参数和环境要求后，在配置中启用并保存。') : null, + nativeScriptInfo(script), + el('div', {class: 'detail-grid'}, source, configForm(ctx, script, () => { + dirty = true; + start.disabled = true; + start.title = '请先保存修改后的运行配置。'; + })), + relatedFiles(ctx, script), el('div', {class: 'section-title'}, el('h2', {}, '执行记录')), history); + sourcePanel(ctx, source, script); + const loadHistory = async () => { + try { + const {items} = await api(`/api/runs?script_id=${enc(id)}&limit=10`, {}, ctx.signal); + if (ctx.alive) history.replaceChildren(items.length ? runTable(items) : empty('还没有运行记录', '首次运行后，可在这里回看状态、日志和结果文件。')); + } catch (error) { if (ctx.alive) history.replaceChildren(errorBox(error, loadHistory)); } + }; + await loadHistory(); + } catch (error) { if (ctx.alive) ctx.show(navigation(), heading('脚本详情', '读取脚本信息失败。'), errorBox(error, () => scriptDetail(ctx, id))); } +} + +function sourcePanel(ctx, target, script) { + const versions = script.versions?.length ? script.versions : [{version: script.version}]; + const version = select('查看源码版本', versions.map(item => [item.version, `版本 ${item.version}${String(item.version) === String(script.version) ? ' · 当前' : ''}`]), script.version); + const download = link('下载源码', '', 'button small'); + const code = el('pre', {class: 'code', tabindex: '0', 'aria-label': '脚本源代码，只读'}, '正在读取源码…'); + const info = el('div', {class: 'source-info mono'}); + const feedback = el('div'); + target.append(el('div', {class: 'panel-header'}, el('h2', {}, script.is_test ? '执行入口（代码只读）' : '内部源码（只读）'), scriptBadge(script)), + kv([['来源类型', sourceLabel(script)], ['源文件', script.source_path], ['运行环境', profileLabel(script)], ['更新时间', date(script.updated_at)]]), + el('div', {class: 'source-header'}, version, download), info, feedback, code, + el('p', {class: 'source-info'}, '代码只读。查看历史版本不改变运行版本；“开始运行”使用当前已保存版本与配置。')); + let generation = 0; + const load = async () => { + const ticket = ++generation; + code.textContent = '正在读取源码…'; + download.hidden = true; + info.textContent = ''; + feedback.replaceChildren(); + try { + const data = await api(`${scriptUrl(script.id)}/code?version=${enc(version.value)}`, {}, ctx.signal); + if (!ctx.alive || ticket !== generation) return; + code.textContent = data.code || '（空文件）'; + info.textContent = `${data.filename} · v${version.value}\nSHA-256 ${data.sha256}`; + download.href = `${scriptUrl(script.id)}/download?version=${enc(version.value)}`; + download.hidden = Boolean(data.redacted); + if (data.redacted) feedback.append(note('源码中包含敏感内容，预览已脱敏，下载不可用。')); + if (data.truncated) feedback.append(note(data.redacted ? '文件较大，当前仅显示部分已脱敏源码。' : '文件较大，当前仅显示部分源码。可下载完整文件。')); + } catch (error) { + if (ctx.alive && ticket === generation) { code.textContent = ''; feedback.replaceChildren(errorBox(error, load)); } + } + }; + version.addEventListener('change', load); + load(); +} + +function configForm(ctx, script, onDirty) { + const config = script.config; + const native = isNative(script); + const limit = maxTimeout(script); + const parameters = native ? nativeParameterForm(script) : null; + const name = input({value: script.name, required: '', maxlength: 120}); + const description = textarea({value: script.description || ''}); + const args = textarea({value: JSON.stringify(config.args, null, 2), rows: 4, class: 'input mono', spellcheck: 'false'}); + const cwd = input({value: native ? script.execution.cwd || config.cwd || '' : config.cwd || '', placeholder: script.kind === 'managed' ? '留空：使用本次运行目录' : '原脚本工作目录'}); + const outputs = textarea({value: (config.output_paths || []).join('\n'), class: 'input mono', spellcheck: 'false', placeholder: '每行一个日志或结果路径'}); + if (native) [args, cwd, outputs].forEach(control => control.setAttribute('readonly', '')); + const timeout = input({type: 'number', value: config.timeout_seconds, required: '', min: '5', max: String(limit), step: '1'}); + const enabled = input({type: 'checkbox', checked: script.enabled}); + const feedback = el('div', {'aria-live': 'polite'}); + const submit = el('button', {type: 'submit', class: 'button primary'}, '保存配置'); + const form = el('form', {class: 'panel'}, el('div', {class: 'panel-header'}, el('h2', {}, '运行配置')), + field('脚本名称', name), field('说明', description), parameters?.node, + field(native ? '原入口参数（只读）' : '参数', args, native ? '参数由原环境方案计算；可调整的选项在上方填写，实际命令以本次预检为准。' : 'JSON 字符串数组，或每行一个参数；不会交给 shell 拼接。'), + field(native ? '原工作目录（只读）' : '工作目录', cwd, native ? '固定使用登记的原目录。' : script.kind === 'managed' ? '托管脚本留空。可通过 XAS_RUN_DIR 获取本次结果目录。' : '必须位于已登记的来源目录内。'), + field(native ? '原输出规则（只读）' : '归档输出路径', outputs, native ? '由固定方案管理；运行前预检显示本次输出规则，保留原脚本的输出行为。' : script.kind === 'managed' ? '托管脚本留空；本次结果目录统一归档，.log 文件的新增内容进入实时日志。' : '登记该来源 logs/ 或 results/ 内已存在的文件或目录，每行一项。.log 新增内容进入实时日志，其他结果结束后归档。'), + field('超时时间（秒）', timeout, `填写 5–${limit} 秒之间的整数。${native ? '原环境方案最长支持 72 小时。' : ''}`), el('label', {class: 'checkbox'}, enabled, '启用此脚本'), + native ? note('复用原账号、解释器、目录与已有配置，不修改原项目文件。实际运行按原脚本逻辑产生输出与影响。') + : note(`${profileLabel(script)}。提供 Python 标准库、Bash 和 curl；额外依赖不会自动安装。`), + !native && script.config.profile === 'legacy_smoke' ? note('兼容配置由服务端管理，只读。代理请求有固定上限，不能在此调整服务或模型。', 'info') : null, + feedback, el('div', {class: 'form-footer'}, submit)); + form.addEventListener('input', () => { + onDirty(); + feedback.replaceChildren(note('配置有未保存的修改。保存后才能开始运行。')); + }); + form.addEventListener('submit', async event => { + event.preventDefault(); + if (submit.disabled || !form.reportValidity()) return; + feedback.replaceChildren(); + let payload; + try { + const seconds = Number(timeout.value); + if (!Number.isSafeInteger(seconds) || seconds < 5 || seconds > limit) throw new Error(`超时时间必须是 5–${limit} 秒之间的整数。`); + if (!name.value.trim()) throw new Error('请填写脚本名称。'); + payload = {name: name.value.trim(), description: description.value, enabled: enabled.checked, + config: native ? {native_options: parameters.read(), timeout_seconds: seconds} + : {args: parseArgs(args.value), cwd: cwd.value.trim(), output_paths: parseLines(outputs.value), timeout_seconds: seconds}}; + } catch (error) { feedback.replaceChildren(errorBox(error)); return; } + submit.disabled = true; + submit.textContent = '正在保存…'; + try { + await api(scriptUrl(script.id), {method: 'PATCH', body: payload}, ctx.signal); + if (ctx.alive) { toast('配置已保存，后续运行将使用新配置。'); await scriptDetail(ctx, script.id); } + } catch (error) { if (ctx.alive) feedback.replaceChildren(errorBox(error)); } + finally { submit.disabled = false; submit.textContent = '保存配置'; } + }); + return form; +} diff --git a/console/static/styles.css b/console/static/styles.css new file mode 100644 index 0000000..56c99b6 --- /dev/null +++ b/console/static/styles.css @@ -0,0 +1,176 @@ +@charset "UTF-8"; +:root{font-family:Inter,"Segoe UI","Microsoft YaHei",sans-serif;color:#22332c;background:#f4f6f3;font-synthesis:none;--ink:#22332c;--muted:#748079;--line:#e3e8e1;--green:#237349;--light:#ecf4ec;--danger:#b43d35;--radius:12px} +*{box-sizing:border-box} +body{margin:0;font-size:14px;line-height:1.55} +button,input,textarea,select{font:inherit} +button,a,input,textarea,select{touch-action:manipulation} +a{color:var(--green);text-decoration:none} +a:hover{text-decoration:underline} +button{cursor:pointer} +button:disabled{opacity:.5;cursor:not-allowed} +:focus-visible{outline:3px solid #73b48a;outline-offset:3px} +[hidden]{display:none!important} +h1,h2,h3,p{margin:0} +h1{font-size:28px;letter-spacing:-.8px;line-height:1.25;font-weight:650;overflow-wrap:anywhere} +h2{font-size:17px;font-weight:650} +h3{font-size:15px;font-weight:600} +.sidebar{position:fixed;inset:0 auto 0 0;width:220px;background:#14231e;color:#b4c0b8;padding:31px 20px;display:flex;flex-direction:column;z-index:5} +.brand{display:flex;align-items:center;gap:12px;color:#f6faf4;padding:0 12px;text-decoration:none!important;margin-bottom:60px} +.brand-mark{display:grid;place-items:center;background:#b9db91;color:#173522;width:37px;height:39px;border-radius:10px;font-size:25px;font-weight:800;transform:rotate(-5deg)} +.brand strong{font-size:25px;letter-spacing:3px;line-height:1;display:block} +.brand small{font-size:9px;letter-spacing:1.6px;color:#a2b5a7;display:block;margin-top:5px} +.sidebar-label{font-size:11px;padding:0 15px;margin-bottom:12px;color:#7e9487;letter-spacing:2px} +nav{display:grid;gap:8px} +nav a{border:1px solid transparent;display:flex;align-items:center;gap:13px;color:#bac8bf;padding:12px 14px;border-radius:8px;font-weight:550} +nav a:hover{background:#1e342a;text-decoration:none} +nav a[aria-current=page]{background:#2b4334;color:#d4edb1;border-color:#3b5642} +nav a>span:first-child{font-size:20px;line-height:1;opacity:.85} +.nav-count{font-size:11px;border-radius:4px;background:#3e5844;min-width:24px;padding:0 5px;text-align:center;margin-left:auto} +.sidebar-note{font-size:11px;border-top:1px solid #304034;padding:21px 12px 0;margin-top:auto;color:#becdbf} +.sidebar-note p{font-size:11px;color:#7d9383;margin-top:9px;line-height:1.9} +.dot{display:inline-block;width:6px;height:6px;border-radius:50%;background:#adc888;margin-right:7px;vertical-align:2px} +.sidebar-bottom{padding:29px 12px 0;color:#879e8d;font-size:12px} +.sidebar-bottom span{font-size:10px;margin-left:7px;color:#617a69} +.workspace{margin-left:220px;min-height:100vh;display:flex;flex-direction:column} +.topbar{height:73px;border-bottom:1px solid var(--line);background:#fbfcf9;display:flex;align-items:center;justify-content:space-between;padding:0 38px;font-size:12px} +.topbar>div:first-child{display:flex;align-items:center;gap:14px} +.eyebrow{font-size:10px;letter-spacing:1.5px;color:#98a298} +#worker-status{display:flex;align-items:center;gap:8px;color:#748477} +.worker-light{width:7px;height:7px;display:inline-block;border-radius:100%;background:#2e955d} +.worker-light.offline{background:#cd8b36} +.summary{padding:26px 38px 0;display:grid;grid-template-columns:repeat(4,1fr);gap:16px} +.stat{background:#fff;border:1px solid var(--line);border-radius:var(--radius);padding:16px 20px;position:relative} +.stat-label{font-size:12px;color:var(--muted)} +.stat-value{font-size:27px;font-weight:620;letter-spacing:-1px;line-height:1.2;margin-top:6px;display:block} +.stat-foot{font-size:10px;color:#859286;position:absolute;bottom:19px;right:18px} +.stat.accent{background:#edf4e7;border-color:#dce9d3} +.stat.accent .stat-value{color:#477129} +main{padding:30px 38px 36px;flex:1;min-width:0} +.page-heading{display:flex;justify-content:space-between;align-items:center;gap:20px;margin-bottom:26px} +.page-heading p{color:var(--muted);font-size:12px;margin-top:9px;max-width:650px} +.actions{display:flex;gap:9px;align-items:center;flex-wrap:wrap} +.button{border:1px solid #dbe3d8;background:#fff;color:var(--ink);border-radius:7px;padding:9px 15px;min-height:38px;display:inline-flex;justify-content:center;align-items:center;gap:7px;white-space:nowrap;font-size:12px;font-weight:550;text-decoration:none!important;line-height:1.4} +.button:hover:enabled{background:#f1f5ed;border-color:#b8cbb8} +.button.primary{background:#2b703d;border-color:#2b703d;color:white;box-shadow:0 2px 3px #234d2710} +.button.primary:hover:enabled{background:#235e32} +.button.danger{color:#a64236;border-color:#e8c7bf} +.button.small{padding:5px 10px;min-height:29px;font-size:11px} +.button.ghost{border-color:transparent;background:transparent;color:#618063} +.button.detail-link{min-height:46px;min-width:112px;padding:11px 18px;font-size:14px;font-weight:600;color:var(--green);border-color:#bed5c4;background:#f2f8f2} +.button.detail-link:hover,.button.back-button:hover{background:#e6f1e7;border-color:#79a586} +.button.back-button{min-height:44px;padding:10px 17px;font-size:14px;border-color:#b8cdbb;color:var(--green);box-shadow:0 2px 8px #1839230c} +.detail-navigation{position:sticky;top:12px;z-index:3;display:flex;width:fit-content;margin-bottom:20px} +.filters{display:flex;gap:11px;align-items:center;flex-wrap:wrap;background:#fff;border:1px solid var(--line);padding:15px 17px;border-radius:var(--radius);margin-bottom:22px} +.input{border:1px solid #dce3d9;border-radius:7px;padding:9px 11px;background:#fff;color:var(--ink);min-height:38px;min-width:0;width:100%;font-size:12px;transition:border-color .15s} +.input:hover{border-color:#acbfaa} +.input:focus{border-color:#55905e} +.input::placeholder{color:#9aa69a} +textarea.input{resize:vertical;line-height:1.7} +.search{flex:1;min-width:200px;position:relative} +.search .input{padding-left:34px;background:#f8faf6} +.search:before{content:'⌕';position:absolute;left:13px;top:6px;font-size:20px;color:#8b9c89} +.filters select{width:auto;max-width:220px} +.section-title{display:flex;justify-content:space-between;align-items:center;gap:16px;margin:23px 0 13px;font-size:12px} +.section-title h2{font-size:14px;overflow-wrap:anywhere} +.section-title .count{font-size:11px;font-weight:400;color:#8c9b8b;margin-left:9px} +.muted{color:var(--muted);font-size:12px} +.catalog-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(275px,1fr));gap:16px} +.script-card{min-width:0;background:#fff;border:1px solid var(--line);border-radius:var(--radius);padding:19px 20px 16px;display:flex;flex-direction:column;transition:box-shadow .15s,border-color .15s;text-decoration:none!important;color:inherit} +.script-card:hover{border-color:#b5caae;box-shadow:0 5px 18px #233c2910} +.card-top{display:flex;justify-content:space-between;gap:14px;align-items:center;margin-bottom:16px} +.language{font-family:Consolas,monospace;font-size:11px;font-weight:bold;padding:5px 8px;border-radius:6px;color:#557b34;background:#f0f5e6;letter-spacing:.4px} +.language.shell{background:#eef1f7;color:#607087} +.script-card h3{color:#263c2b;font-size:15px;overflow-wrap:anywhere} +.script-description{color:#7a877b;line-height:1.8;font-size:12px;margin:9px 0 14px;min-height:43px;overflow-wrap:anywhere} +.card-source{color:#93a090;font-family:Consolas,monospace;font-size:10px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;margin-bottom:14px} +.card-bottom{border-top:1px solid #ecf0e8;padding-top:12px;display:flex;flex-wrap:wrap;gap:12px;justify-content:space-between;align-items:center;margin-top:auto;font-size:10px;color:#879481} +.card-bottom .detail-link{width:100%}.script-card:hover .detail-link{background:#e6f1e7;border-color:#79a586} +.card-reason{color:#9c7737;font-size:11px;line-height:1.7;margin:-1px 0 14px} +.badge{font-size:10px;white-space:nowrap;display:inline-flex;align-items:center;border-radius:5px;padding:3px 7px;line-height:1.5;background:#eef0ed;color:#69786a;font-weight:500} +.badge:before{content:'';width:5px;height:5px;border-radius:50%;background:currentColor;margin-right:5px} +.badge.ready,.badge.succeeded{color:#458344;background:#edf6e9} +.badge.running{color:#3472a3;background:#eaf3fa} +.badge.queued,.badge.needs_configuration,.badge.timed_out{color:#a17a26;background:#fcf4df} +.badge.failed,.badge.missing,.badge.interrupted{color:#b55248;background:#fbeeea} +.badge.synthetic{color:#7f648e;background:#f2edf7} +.badge.disabled,.badge.cancelled{color:#7b867a;background:#f0f2ee} +.panel{border:1px solid var(--line);border-radius:var(--radius);background:white;padding:22px;margin-bottom:20px;min-width:0} +.panel-header{display:flex;align-items:center;justify-content:space-between;gap:15px;margin-bottom:20px} +.detail-grid{display:grid;grid-template-columns:minmax(0,1.55fr) minmax(310px,1fr);gap:22px;align-items:start} +.detail-grid>.panel{margin-bottom:0} +.breadcrumbs{display:flex;flex-wrap:wrap;align-items:center;gap:10px;font-size:11px;color:#8d9c89;margin:-4px 0 17px;overflow-wrap:anywhere} +.metadata{display:grid;grid-template-columns:90px minmax(0,1fr);column-gap:16px;row-gap:10px;font-size:11px;margin:0} +.metadata dt{color:#8c9a87} +.metadata dd{margin:0;overflow-wrap:anywhere;color:#475840} +.metadata dd.mono,.mono{font-family:"Cascadia Code",Consolas,monospace} +.source-header{display:flex;gap:10px;flex-wrap:wrap;align-items:center;margin:18px 0 11px} +.source-header select{width:auto;min-width:160px;flex:1} +.source-info{font-size:10px;color:#82917d;overflow-wrap:anywhere;line-height:1.9;margin:12px 0} +pre{white-space:pre;tab-size:4;overflow:auto;margin:0;font-family:"Cascadia Code",Consolas,monospace;font-size:12px;line-height:1.8} +.code{background:#f6f8f3;border:1px solid #e4eadf;border-radius:8px;min-height:240px;max-height:580px;padding:18px;color:#425637} +.code[tabindex]:focus{outline-offset:2px} +.field{display:flex;flex-direction:column;gap:7px;margin-bottom:17px} +.field-label{font-size:12px;font-weight:550} +.field small{color:#8b9885;font-size:10px;line-height:1.75} +.field-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px} +.checkbox{display:flex;gap:9px;align-items:center;margin:18px 0;font-size:12px} +.checkbox input{accent-color:#477e38;width:15px;height:15px;min-height:auto} +.form-footer{border-top:1px solid #e9eee5;padding-top:17px;display:flex;align-items:center;justify-content:flex-end;gap:10px} +.notice{padding:12px 14px;border-radius:8px;border:1px solid #e5e8d4;background:#f7f8ed;color:#7c8055;font-size:12px;margin-bottom:17px;line-height:1.8;display:flex;align-items:center;gap:13px;justify-content:space-between;overflow-wrap:anywhere} +.notice.danger{background:#fff1ee;border-color:#f0d7d0;color:#a34c3d} +.notice.success{background:#eff7e9;border-color:#dfebd4;color:#56783d} +.notice.info{background:#edf3f6;border-color:#dae5eb;color:#647f8d} +.global-notice{margin:18px 38px 0;padding:12px 15px;border:1px solid #ebdac1;background:#fcf5e7;color:#8c744b;border-radius:8px;font-size:12px} +.loading,.empty{padding:65px 25px;text-align:center;color:#819078;grid-column:1/-1} +.loading:before{content:'';display:inline-block;border:2px solid #d7e4cf;border-top-color:#618d51;border-radius:50%;width:14px;height:14px;margin-right:10px;vertical-align:-3px;animation:spin .9s linear infinite} +@keyframes spin{to{transform:rotate(360deg)}} +.empty-icon{font-size:33px;color:#a5b49a;display:block;margin-bottom:8px} +.empty p{font-size:12px;margin-top:8px;color:#9ca795} +.table-wrap{overflow:auto;border:1px solid var(--line);border-radius:var(--radius);background:white} +table{border-collapse:collapse;width:100%;text-align:left;white-space:nowrap;font-size:12px} +th{color:#93a087;font-size:10px;font-weight:500;background:#f9fbf6;padding:13px 18px} +td{padding:16px 18px;border-top:1px solid #edf0e8;color:#6c7c60} +td:first-child{color:#354b2c;font-weight:550;max-width:360px;white-space:normal;overflow-wrap:anywhere} +td .badge{margin-right:6px} +tbody tr:hover{background:#fcfdf9} +.run-row{position:relative;cursor:pointer}.run-row:hover,.run-row:focus-within{background:#f1f7ef}.run-row:focus-within{box-shadow:inset 0 0 0 2px #73b48a} +.run-name{font-size:13px;color:#354b2c}.run-open:after{content:'';position:absolute;inset:0} +.run-summary{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:15px;margin-bottom:20px} +.run-summary>div{border-right:1px solid var(--line);padding-right:15px} +.run-summary>div:last-child{border-right:0} +.run-summary small{display:block;color:#94a18b;font-size:10px;margin-bottom:7px} +.run-summary strong{font-size:12px;font-weight:550;overflow-wrap:anywhere} +.log-panel{padding:0;overflow:hidden} +.log-toolbar{padding:15px 19px;display:flex;justify-content:space-between;align-items:center;gap:16px;border-bottom:1px solid #e0e6d9} +.log-toolbar h2{font-size:14px} +.log{background:#1b281f;color:#cedcbd;padding:22px;min-height:320px;max-height:590px;font-size:12px;line-height:1.8;white-space:pre-wrap;overflow-wrap:anywhere} +.log-hint{font-size:10px;color:#8b9b80;padding:10px 19px;border-top:1px solid #e8eddf;display:flex;justify-content:space-between;gap:12px} +.log-toolbar label{font-size:11px;display:flex;align-items:center;gap:6px;color:#879779} +.artifact-list{display:grid;gap:9px} +.artifact{display:flex;justify-content:space-between;align-items:center;padding:13px 15px;border:1px solid #e6ecde;border-radius:8px;gap:16px} +.artifact-name{font-size:12px;overflow-wrap:anywhere} +.artifact-name small{display:block;font-size:10px;color:#9aa68f;margin-top:3px} +.disclosure{margin-top:17px} +.disclosure summary{cursor:pointer;font-size:12px;color:#71845f;padding:8px 0} +.disclosure pre{max-height:300px;background:#f5f8ef;border-radius:7px;padding:16px;font-size:11px;white-space:pre-wrap;overflow-wrap:anywhere} +.dialog{border:1px solid #dce5d0;border-radius:14px;padding:25px;width:min(580px,calc(100% - 30px));max-height:90vh;color:var(--ink);box-shadow:0 20px 80px #17250d35} +.dialog::backdrop{background:#15201070;backdrop-filter:blur(2px)} +.related-files{display:grid;gap:12px;margin-top:18px}.related-files .code{max-height:420px}.related-files>.button{justify-self:start} +.native-plan .notice:last-child{margin-bottom:0}.native-description{font-size:12px;color:#748079;margin-top:17px;line-height:1.8} +.native-impact{margin:18px 0;padding:14px 16px;background:#f5f8f0;border:1px solid #e4eada;border-radius:8px}.native-impact.attention{background:#fdf6e7;border-color:#ecdcba} +.native-impact ul{padding-left:20px;margin:9px 0;font-size:12px;line-height:1.9}.native-impact h3{font-size:13px}.native-impact .muted{font-size:11px} +.native-command{margin:12px 0;padding:15px;background:#f2f6ee;border:1px solid #dfe7d7;border-radius:8px;white-space:pre-wrap;overflow-wrap:anywhere;max-height:280px;font-size:11px} +.native-subtitle{margin-top:20px;font-size:12px}.native-dialog{width:min(720px,calc(100% - 30px))} +.preflight-checks{padding:0;margin:15px 0;list-style:none;display:grid;gap:10px}.preflight-checks li{display:flex;align-items:flex-start;gap:10px;font-size:12px}.preflight-checks p{font-size:11px;color:#7f8c74;margin-top:3px;overflow-wrap:anywhere} +.native-menu{border-top:1px solid var(--line);margin-top:20px;padding-top:20px}.native-menu h3{margin-bottom:12px}.native-parameters{border-top:1px solid var(--line);padding-top:17px}.input[readonly]{background:#f6f8f3;color:#73816a} +.dialog-header{display:flex;justify-content:space-between;align-items:center;gap:20px;margin-bottom:23px} +.dialog .code{max-height:55vh;white-space:pre-wrap;overflow-wrap:anywhere} +.page-footer{display:flex;justify-content:space-between;gap:20px;padding:17px 38px;border-top:1px solid var(--line);color:#a0ac94;font-size:10px} +.toast{position:fixed;bottom:26px;left:calc(50% + 110px);transform:translateX(-50%);z-index:20;background:#263e21;color:#e0edcf;padding:13px 22px;border-radius:9px;font-size:12px;box-shadow:0 5px 25px #19311425;max-width:calc(100% - 40px)} +.skip-link{position:fixed;top:-100px;left:15px;padding:10px;background:white;z-index:100} +.skip-link:focus{top:10px} +.noscript{position:fixed;top:80px;left:240px;background:#fff3df;padding:20px} +@media(min-width:1600px){main,.summary{padding-left:55px;padding-right:55px}.catalog-grid{grid-template-columns:repeat(3,1fr)}} +@media(max-width:1100px){.sidebar{width:184px;padding:29px 14px}.workspace{margin-left:184px}.topbar{padding:0 25px}main{padding:26px 25px}.summary{padding:22px 25px 0;gap:10px}.stat{padding:14px}.stat-foot{display:none}.detail-grid{grid-template-columns:1fr}.toast{left:calc(50% + 92px)}.global-notice{margin-left:25px;margin-right:25px}} +@media(max-width:720px){.sidebar{position:static;width:auto;padding:16px 19px;flex-direction:row;align-items:center;gap:20px}.brand{padding:0;margin:0;gap:8px}.brand strong{font-size:20px}.brand small{font-size:7px}.brand-mark{width:30px;height:33px;font-size:21px}.sidebar-label,.sidebar-note,.sidebar-bottom{display:none}nav{display:flex;gap:5px;margin-left:auto}nav a{padding:8px 10px;font-size:12px;gap:6px}nav a>span:first-child,.nav-count{display:none}.workspace{margin:0}.topbar{height:48px;padding:0 20px;font-size:10px}.eyebrow{display:none}.summary{padding:19px 18px 0;grid-template-columns:repeat(2,1fr);gap:9px}.stat{padding:12px 15px}.stat-label{font-size:10px}.stat-value{font-size:23px}.stat-foot{display:block;font-size:9px;right:12px;bottom:15px}main{padding:24px 18px}.page-heading{align-items:flex-start;flex-direction:column;gap:16px;margin-bottom:20px}.page-heading h1{font-size:24px}.page-heading p{font-size:11px}.page-heading>.actions{width:100%}.filters{gap:8px;padding:12px}.search{flex-basis:100%}.filters select{flex:1;max-width:none;width:calc(50% - 8px)}.catalog-grid{grid-template-columns:1fr}.panel{padding:17px}.log-panel{padding:0}.run-summary{grid-template-columns:1fr 1fr;row-gap:20px}.run-summary>div:nth-child(2){border:0}.log-toolbar{align-items:flex-start;flex-direction:column;gap:10px}.log-toolbar .actions{width:100%;justify-content:space-between}.log{padding:17px;font-size:11px}.log-hint{flex-direction:column;gap:3px}.artifact{align-items:flex-start;flex-direction:column}.artifact>.actions{align-self:flex-end}.field-grid{grid-template-columns:1fr;gap:0}.page-footer{padding:15px 18px;font-size:9px;flex-direction:column;gap:4px}.toast{left:50%;width:max-content}.global-notice{margin:15px 18px 0}.noscript{left:20px;right:20px}.metadata{grid-template-columns:75px minmax(0,1fr);gap:9px}.source-header{align-items:stretch}} +@media(prefers-reduced-motion:reduce){*{animation:none!important;transition:none!important}} diff --git a/console/static/ui.js b/console/static/ui.js new file mode 100644 index 0000000..578cea2 --- /dev/null +++ b/console/static/ui.js @@ -0,0 +1,125 @@ +export const stateNames = { + queued: '排队中', running: '运行中', succeeded: '进程成功', failed: '失败', + cancelled: '已取消', timed_out: '已超时', interrupted: '已中断', + ready: '可运行', needs_configuration: '待配置', missing: '源文件缺失' +}; +export const active = run => ['queued', 'running'].includes(run.state); +export const enc = value => encodeURIComponent(value); +export const scriptUrl = id => `/api/scripts/${enc(id)}`; +export const runUrl = id => `/api/runs/${enc(id)}`; +export const date = value => value ? new Date(value).toLocaleString('zh-CN', {hour12: false}) : '—'; +export function bytes(value) { + if (!Number.isFinite(Number(value))) return '—'; + const size = Number(value); + if (size < 1024) return `${size} B`; + if (size < 1048576) return `${(size / 1024).toFixed(1)} KB`; + return `${(size / 1048576).toFixed(1)} MB`; +} +export function el(tag, attributes = {}, ...children) { + const node = document.createElement(tag); + for (const [key, value] of Object.entries(attributes)) { + if (key === 'class') node.className = value; + else if (key.startsWith('on')) node.addEventListener(key.slice(2), value); + else if (key === 'text') node.textContent = value; + else if (['checked', 'disabled', 'hidden', 'selected', 'value'].includes(key)) node[key] = value; + else if (value !== undefined && value !== null) node.setAttribute(key, value); + } + for (const child of children.flat(Infinity)) { + if (child !== null && child !== undefined) node.append(child instanceof Node ? child : document.createTextNode(String(child))); + } + return node; +} +export const button = (text, onClick, style = 'secondary') => el('button', {type: 'button', class: `button ${style}`, onclick: onClick}, text); +export const link = (text, href, className = '') => el('a', {href, class: className}, text); +export const badge = (state, text = stateNames[state] || state) => el('span', {class: `badge ${state}`}, text); +export const note = (text, tone = '') => el('div', {class: `notice ${tone}`}, text); +export const empty = (title, detail) => el('div', {class: 'empty'}, el('span', {class: 'empty-icon', 'aria-hidden': 'true'}, '▤'), el('h3', {}, title), el('p', {}, detail)); +export const loading = (text = '正在加载…') => el('div', {class: 'loading', role: 'status'}, text); +let fieldCounter = 0; +export function field(text, control, hint = '') { + const hintId = `field-hint-${++fieldCounter}`; + control.setAttribute('aria-label', text); + if (hint) control.setAttribute('aria-describedby', hintId); + return el('label', {class: 'field'}, el('span', {class: 'field-label'}, text), control, hint ? el('small', {id: hintId}, hint) : null); +} +export const input = (attributes = {}) => el('input', {class: 'input', ...attributes}); +export const textarea = (attributes = {}) => el('textarea', {class: 'input', rows: 3, ...attributes}); +export const select = (label, options, value = '') => el('select', {class: 'input', 'aria-label': label}, options.map(([id, text]) => el('option', {value: id, selected: String(id) === String(value)}, text))); +export function heading(title, subtitle, actions = []) { + return el('div', {class: 'page-heading'}, el('div', {}, el('h1', {}, title), el('p', {}, subtitle)), el('div', {class: 'actions'}, actions)); +} +export function kv(items) { + return el('dl', {class: 'metadata'}, items.map(([label, value]) => [el('dt', {}, label), el('dd', {}, value ?? '—')])); +} +export function errorBox(error, retry) { + return el('div', {class: 'notice danger', role: 'alert'}, el('span', {}, error.message || '请求失败，请稍后重试。'), retry ? button('重试', retry, 'small') : null); +} +export async function api(path, options = {}, signal) { + const controller = new AbortController(); + const abort = () => controller.abort(); + if (signal?.aborted) controller.abort(); + else signal?.addEventListener('abort', abort, {once: true}); + const timer = setTimeout(abort, options.body instanceof FormData ? 120000 : 20000); + const headers = {...options.headers}; + if (options.method && options.method !== 'GET') headers['X-XAS-Console'] = '1'; + let body = options.body; + if (body && !(body instanceof FormData)) { + headers['Content-Type'] = 'application/json'; + body = JSON.stringify(body); + } + try { + const response = await fetch(path, {...options, body, headers, signal: controller.signal, credentials: 'same-origin'}); + const data = await response.json().catch(() => null); + if (!response.ok) throw new Error(typeof data?.detail === 'string' ? data.detail : `请求未完成（HTTP ${response.status}）。`); + if (data === null) throw new Error('服务器返回了无法读取的数据。'); + return data; + } catch (error) { + if (signal?.aborted) throw error; + if (error.name === 'AbortError') throw new Error('请求超时，操作结果尚未确认。请先核对记录；运行请求重试会复用原编号。'); + if (error instanceof TypeError) throw new Error('无法连接控制台，请检查网络后重试。'); + throw error; + } finally { + clearTimeout(timer); + signal?.removeEventListener('abort', abort); + } +} +let toastTimer; +export function toast(text) { + const target = document.querySelector('#toast'); + target.textContent = text; + target.hidden = false; + clearTimeout(toastTimer); + toastTimer = setTimeout(() => { target.hidden = true; }, 5000); +} +export function dialog(title, content) { + const close = button('关闭', () => panel.close(), 'small'); + close.setAttribute('aria-label', '关闭对话框'); + const panel = el('dialog', {class: 'dialog', 'aria-label': title}, el('div', {class: 'dialog-header'}, el('h2', {}, title), close), content); + panel.addEventListener('close', () => panel.remove(), {once: true}); + document.body.append(panel); + panel.showModal(); + return panel; +} +export function pageContext(main) { + const controller = new AbortController(); + const timers = new Set(); + const context = { + main, signal: controller.signal, + get alive() { return !controller.signal.aborted; }, + show(...nodes) { if (context.alive) { main.replaceChildren(...nodes.filter(node => node !== null && node !== undefined)); main.setAttribute('aria-busy', 'false'); } }, + async repeat(callback, interval = 2500) { + if (!context.alive) return; + if (document.visibilityState === 'visible' && await callback() === false) return; + if (context.alive) { + const timer = setTimeout(() => { timers.delete(timer); context.repeat(callback, interval); }, interval); + timers.add(timer); + } + }, + dispose() { + controller.abort(); + timers.forEach(clearTimeout); + document.querySelectorAll('dialog').forEach(panel => panel.close()); + } + }; + return context; +} diff --git a/console/store.py b/console/store.py new file mode 100644 index 0000000..7e718d1 --- /dev/null +++ b/console/store.py @@ -0,0 +1,216 @@ +"""Small SQLite repository. Queue transitions are serialized transactions.""" +from contextlib import contextmanager +from datetime import datetime, timezone +import json +import sqlite3 +import uuid + +TERMINAL = {"succeeded", "failed", "cancelled", "timed_out", "interrupted"} + + +def now(): + return datetime.now(timezone.utc).isoformat() + + +class Store: + def __init__(self, settings): + self.settings = settings + settings.prepare() + with self.connect() as db: + version = db.execute("PRAGMA user_version").fetchone()[0] + if version not in (0, 1): + raise RuntimeError("Unsupported database version") + db.executescript(""" + PRAGMA journal_mode=WAL; + CREATE TABLE IF NOT EXISTS scripts(id TEXT PRIMARY KEY, data TEXT NOT NULL); + CREATE TABLE IF NOT EXISTS versions( + script_id TEXT NOT NULL, version INTEGER NOT NULL, data TEXT NOT NULL, + PRIMARY KEY(script_id,version)); + CREATE TABLE IF NOT EXISTS runs( + id TEXT PRIMARY KEY, request_id TEXT NOT NULL UNIQUE, + script_id TEXT NOT NULL, state TEXT NOT NULL, + cancel_requested INTEGER NOT NULL DEFAULT 0, data TEXT NOT NULL); + CREATE TABLE IF NOT EXISTS health(key TEXT PRIMARY KEY, value TEXT NOT NULL); + PRAGMA user_version=1; + """) + + @contextmanager + def connect(self, write=False): + db = sqlite3.connect(self.settings.db, timeout=10) + db.row_factory = sqlite3.Row + try: + if write: + db.execute("BEGIN IMMEDIATE") + yield db + db.commit() + except Exception: + db.rollback() + raise + finally: + db.close() + + def scripts(self): + with self.connect() as db: + return [json.loads(r[0]) for r in db.execute("SELECT data FROM scripts ORDER BY id")] + + def script(self, identity, versions=False): + with self.connect() as db: + row = db.execute("SELECT data FROM scripts WHERE id=?", (identity,)).fetchone() + if not row: + raise KeyError("脚本不存在") + item = json.loads(row[0]) + if versions: + item["versions"] = [json.loads(r[0]) for r in db.execute( + "SELECT data FROM versions WHERE script_id=? ORDER BY version DESC", (identity,))] + return item + + def save_script(self, item): + with self.connect(write=True) as db: + db.execute("INSERT OR REPLACE INTO scripts VALUES(?,?)", (item["id"], json.dumps(item))) + + def version(self, identity, version): + with self.connect() as db: + row = db.execute("SELECT data FROM versions WHERE script_id=? AND version=?", (identity, version)).fetchone() + if not row: + raise KeyError("版本不存在") + return json.loads(row[0]) + + def upload_version(self, item, content, filename): + # A transaction prevents two simultaneous uploads from assigning the same version. + with self.connect(write=True) as db: + current = db.execute("SELECT data FROM scripts WHERE id=?", (item["id"],)).fetchone() + if current: + item = json.loads(current[0]) + version = item["version"] + 1 + target = self.settings.library / item["id"] / "versions" / str(version) / filename + target.parent.mkdir(parents=True, exist_ok=False) + try: + with target.open("xb") as handle: + handle.write(content) + import hashlib + value = {"version": version, "sha256": hashlib.sha256(content).hexdigest(), + "created_at": now(), "filename": filename, "path": str(target)} + item.update(version=version, sha256=value["sha256"], source_path=str(target), updated_at=now()) + db.execute("INSERT INTO versions VALUES(?,?,?)", (item["id"], version, json.dumps(value))) + db.execute("INSERT OR REPLACE INTO scripts VALUES(?,?)", (item["id"], json.dumps(item))) + except Exception: + target.unlink(missing_ok=True) + target.parent.rmdir() + raise + return item + + @staticmethod + def unpack_run(row): + data = json.loads(row["data"]) + data.update(state=row["state"], cancel_requested=bool(row["cancel_requested"])) + return data + + def runs(self, script_id=None, limit=100): + with self.connect() as db: + query = "SELECT * FROM runs" + values = [] + if script_id: + query += " WHERE script_id=?" + values.append(script_id) + query += " ORDER BY rowid DESC LIMIT ?" + values.append(limit) + return [self.unpack_run(r) for r in db.execute(query, values)] + + def run(self, identity): + with self.connect() as db: + row = db.execute("SELECT * FROM runs WHERE id=?", (identity,)).fetchone() + if not row: + raise KeyError("运行记录不存在") + return self.unpack_run(row) + + def run_for_request(self, request_id): + with self.connect() as db: + row = db.execute("SELECT * FROM runs WHERE request_id=?", (request_id,)).fetchone() + return self.unpack_run(row) if row else None + + def queue(self, script, request_id, ip, execution=None): + with self.connect(write=True) as db: + old = db.execute("SELECT * FROM runs WHERE request_id=?", (request_id,)).fetchone() + if old: + if old["script_id"] != script["id"]: + raise ValueError("请求编号已用于其他脚本") + return self.unpack_run(old) + pending = db.execute("SELECT count(*) FROM runs WHERE state IN ('queued','running')").fetchone()[0] + if pending >= 20: + raise ValueError("队列已满，请等待已有测试结束") + item = {"id": uuid.uuid4().hex, "script_id": script["id"], "script_name": script["name"], + "version": script["version"], "sha256": script["sha256"], "state": "queued", + "created_at": now(), "started_at": None, "finished_at": None, "exit_code": None, + "message": "等待执行", "config": script["config"], "artifacts": [], + "synthetic": script.get("synthetic", False), "source_ip": ip, + "source_path": script["source_path"], "language": script["language"], + "kind": script["kind"], "source_group": script["source_group"]} + if execution: + item["execution"] = execution + db.execute("INSERT INTO runs(id,request_id,script_id,state,data) VALUES(?,?,?,?,?)", + (item["id"], request_id, script["id"], "queued", json.dumps(item))) + return item + + def claim(self): + with self.connect(write=True) as db: + if db.execute("SELECT 1 FROM runs WHERE state='running'").fetchone(): + return None + row = db.execute("SELECT * FROM runs WHERE state='queued' ORDER BY rowid LIMIT 1").fetchone() + if not row: + return None + item = self.unpack_run(row) + item.update(started_at=now(), state="running", message="正在启动测试") + db.execute("UPDATE runs SET state='running',data=? WHERE id=?", (json.dumps(item), item["id"])) + return item + + def finish(self, identity, state, **values): + assert state in TERMINAL + with self.connect(write=True) as db: + row = db.execute("SELECT * FROM runs WHERE id=?", (identity,)).fetchone() + item = self.unpack_run(row) + item.update(values, state=state, finished_at=now()) + db.execute("UPDATE runs SET state=?,data=? WHERE id=?", (state, json.dumps(item), identity)) + return item + + def running_message(self, identity, message): + with self.connect(write=True) as db: + row = db.execute("SELECT * FROM runs WHERE id=? AND state='running'", (identity,)).fetchone() + if row: + item = self.unpack_run(row) + item["message"] = message + db.execute("UPDATE runs SET data=? WHERE id=?", (json.dumps(item), identity)) + + def update_execution(self, identity, values): + with self.connect(write=True) as db: + row = db.execute("SELECT * FROM runs WHERE id=? AND state='running'", (identity,)).fetchone() + if not row: + raise ValueError("运行状态已变化") + item = self.unpack_run(row) + item["execution"] = {**item.get("execution", {}), **values} + db.execute("UPDATE runs SET data=? WHERE id=?", (json.dumps(item), identity)) + return item + + def cancel(self, identity): + with self.connect(write=True) as db: + row = db.execute("SELECT * FROM runs WHERE id=?", (identity,)).fetchone() + if not row: + raise KeyError("运行记录不存在") + item = self.unpack_run(row) + if row["state"] == "queued": + item.update(state="cancelled", finished_at=now(), message="已取消排队") + db.execute("UPDATE runs SET state='cancelled',cancel_requested=1,data=? WHERE id=?", + (json.dumps(item), identity)) + elif row["state"] == "running": + db.execute("UPDATE runs SET cancel_requested=1 WHERE id=?", (identity,)) + return self.run(identity) + + def heartbeat(self): + with self.connect(write=True) as db: + db.execute("INSERT OR REPLACE INTO health VALUES('worker',?)", (now(),)) + + def health(self): + with self.connect() as db: + row = db.execute("SELECT value FROM health WHERE key='worker'").fetchone() + last = row[0] if row else None + online = bool(last and (datetime.now(timezone.utc) - datetime.fromisoformat(last)).total_seconds() < 15) + return {"online": online, "last_seen": last} diff --git a/console/test_catalog.py b/console/test_catalog.py new file mode 100644 index 0000000..a63b90e --- /dev/null +++ b/console/test_catalog.py @@ -0,0 +1,72 @@ +"""Project a file inventory into reviewed, runnable test entry points.""" +import fnmatch +from pathlib import Path + + +def relative_path(settings, item): + source = next((s for s in settings.sources if s["id"] == item["source_group"]), None) + if not source: + return None + try: + return Path(item["source_path"]).relative_to(Path(source["path"])).as_posix() + except ValueError: + return None + + +def definition(settings, item): + if item["kind"] == "managed": + return next((d for d in settings.test_definitions + if d.get("managed_profile") == item["config"]["profile"]), {}) + path = relative_path(settings, item) + return next((d for d in settings.test_definitions + if d.get("source_group") == item["source_group"] and d.get("entry") == path), None) + + +def is_entry(settings, item): + return definition(settings, item) is not None + + +def members(settings, item, inventory): + spec = definition(settings, item) + if spec is None: + raise ValueError("此文件是内部源码，请从测试项目入口查看相关文件") + result = [] + for candidate in inventory: + path = relative_path(settings, candidate) + match = next((m for m in spec.get("members", []) + if candidate["source_group"] == m["source_group"] and path is not None + and (m["pattern"] == "**/*" or fnmatch.fnmatchcase(path, m["pattern"]))), None) + if candidate["id"] != item["id"] and match is None: + continue + role = "entry" if candidate["id"] == item["id"] else (match or {}).get("role", "support") + if role == "support" and path and ("tests" in Path(path).parts or Path(path).name.startswith("release-")): + role = "self_test" + result.append({"id": candidate["id"], "name": Path(candidate["source_path"]).name, + "source_path": candidate["source_path"], "relative_path": path or Path(candidate["source_path"]).name, + "source_group": candidate["source_group"], "role": role, "status": candidate["status"]}) + return sorted(result, key=lambda f: (f["role"] != "entry", f["source_group"], f["relative_path"])) + + +def describe(settings, item, inventory): + from .native_plans import public_execution + result = dict(item) + spec = definition(settings, item) + result["is_test"] = spec is not None + result["execution"] = public_execution(settings, item) + if spec is None: + result.update(test_kind="source", category="source", file_count=1, enabled=False) + return result + example = item.get("synthetic", False) or item["id"] in settings.example_script_ids + result.update(test_kind=spec.get("kind", "test"), category="example" if example else "test", + file_count=len(members(settings, item, inventory))) + if item["kind"] == "external" and item["name"] == Path(item["source_path"]).name: + result["name"] = spec.get("name", item["name"]) + if not item.get("description"): + result["description"] = spec.get("description", "") + return result + + +def tests(settings, inventory, include_examples=False): + result = [describe(settings, item, inventory) for item in inventory if is_entry(settings, item)] + result = [item for item in result if include_examples or item["category"] != "example"] + return sorted(result, key=lambda s: (not s["enabled"], s["category"] == "example", s["source_group"], s["name"])) diff --git a/console/worker.py b/console/worker.py new file mode 100644 index 0000000..e9c5a59 --- /dev/null +++ b/console/worker.py @@ -0,0 +1,270 @@ +"""Private dispatcher with a local Unix socket and one active test at a time.""" +import fcntl +import hashlib +import json +import os +from pathlib import Path +import re +import signal +import shutil +import subprocess +import threading +import time +from .artifacts import Collector +from .catalog import clean_source, safe_path, script_path, source_for, validate_config, SECRET, SERVICE, SMOKE_HASH +from .settings import Settings +from .store import Store, now +from . import workspace + +LABEL = "xas.console=dedicated" + + +def docker(*args, timeout=20): + result = subprocess.run(["docker", *args], capture_output=True, text=True, timeout=timeout) + if result.returncode: + # Arguments and secrets are never included in public error details. + raise RuntimeError("Docker operation failed: " + args[0]) + return result.stdout.strip() + + +class Worker: + def __init__(self, settings, config): + self.settings, self.config = settings, config + self.store = Store(settings) + self.stopping = False + self.container = None + + def stop(self, *args): + self.stopping = True + + def inspect_owned(self, container): + info = json.loads(docker("inspect", container))[0] + if info["Config"]["Labels"].get("xas.console") != "dedicated": + raise RuntimeError("Refusing to manage a foreign container") + return info + + def remove(self, container): + self.inspect_owned(container) + docker("rm", "-f", container) + + def recover(self): + for container in docker("ps", "-aq", "--filter", "label=" + LABEL).splitlines(): + if container: + self.remove(container) + for mount in workspace.mounts(self.settings): + workspace.remove(self.settings, mount) + for run in self.store.runs(limit=10000): + if run["state"] == "running": + if run.get("execution", {}).get("mode") == "native": + from .native_executor import NativeExecutor + NativeExecutor(self).monitor(run) + else: + self.store.finish(run["id"], "interrupted", message="执行器重启，测试容器已停止；未自动补跑，远端请求结果可能未知") + + def command(self, run, directory): + if not re.fullmatch(r"[a-f0-9]{32}", run["id"]): + raise ValueError("Invalid run identity") + source = script_path(self.settings, run) + raw = source.read_bytes() + if hashlib.sha256(raw).hexdigest() != run["sha256"]: + raise ValueError("脚本在排队后发生变化，本次未执行") + if SECRET.search(clean_source(raw)): + raise ValueError("脚本包含疑似凭据，未执行") + if run["kind"] == "external" and SERVICE.search(clean_source(raw)): + raise ValueError("涉及服务或设备管理的脚本尚未接入") + config = validate_config(self.settings, run, run["config"]) + if run["language"] not in {"shell", "python"}: + raise ValueError("Unsupported language") + snapshot = directory / "source" + snapshot.mkdir(mode=0o750) + (snapshot / "script.txt").write_bytes(raw) + (snapshot / "script.txt").chmod(0o444) + work = directory / "work" + work.mkdir(mode=0o770) + uid = 0 if run["kind"] == "external" else 1000 + os.chown(work, uid, uid) + workspace.create(self.settings, run["id"], uid) + project = Path(self.config["project"]) + cmd = ["create", "--name", "adamwen-test-run-" + run["id"], "--label", LABEL, + "--label", "xas.run=" + run["id"], "--runtime", "runc", "--network", "bridge", + "--user", f"{uid}:{uid}", "--cap-drop", "ALL", "--security-opt", "no-new-privileges", + "--pids-limit", "64", "--memory", "512m", "--cpus", "1", "--read-only", + "--tmpfs", "/tmp:rw,nosuid,nodev,noexec,size=67108864", "--log-driver", "local", + "--log-opt", "max-size=10m", "--log-opt", "max-file=2", "--interactive", + "--env", "PYTHONUNBUFFERED=1", "--env", "PYTHONDONTWRITEBYTECODE=1", + "--env", "XAS_RUN_DIR=/work", "--mount", f"type=bind,src={work},dst=/work", + "--mount", f"type=bind,src={project / 'console'},dst=/opt/xas-console,readonly", + "--mount", f"type=bind,src={snapshot / 'script.txt'},dst=/input/script{source.suffix},readonly"] + cwd, execution_path = "/work", "/input/script" + source.suffix + if run["kind"] == "external": + root = source_for(self.settings, run["source_group"]) + cmd += ["--mount", f"type=bind,src={root},dst={root},readonly"] + cwd = config["cwd"] + # Preserve __file__ and sibling imports. Hash is rechecked immediately before launch. + execution_path = str(source) + cmd += ["--mount", f"type=bind,src={snapshot / 'script.txt'},dst={source},readonly"] + for output in config["output_paths"]: + target = Path(output) + cmd += ["--mount", f"type=bind,src={target},dst={target}"] + cmd += ["--workdir", cwd, "--entrypoint", "python3", self.config["runner_image"], "/opt/xas-console/job_main.py"] + payload = {"language": run["language"], "script": execution_path, "args": config["args"], "profile": config["profile"]} + if config["profile"] == "legacy_smoke": + if run["sha256"] != SMOKE_HASH or config["args"] or run["id"] in self.config.get("forbidden_runs", []): + raise ValueError("轻量模型测试必须使用已核对的原始 smoke.sh，不接受额外参数") + credential = Path(self.config["smoke_credential"]) + pairs = [line.split("=", 1)[1].strip().strip("\"'") for line in credential.read_text().splitlines() + if line.startswith("VLLM_API_KEY=")] + if len(pairs) != 1 or not pairs[0]: + raise ValueError("模型认证配置不可用") + payload.update(key=pairs[0], upstream=self.config["smoke_upstream"]) + return cmd, payload + + def execute(self, run): + directory = safe_path(self.settings.runs / run["id"], self.settings.runs, must_exist=False) + directory.mkdir(mode=0o750, exist_ok=False) + log = (directory / "console.log").open("wb", buffering=0) + log_lock = threading.Lock() + overflow = threading.Event() + process = None + collector = None + state, exit_code, message = "failed", None, "执行器发生错误" + + def emit(data): + with log_lock: + remaining = self.settings.max_log - log.tell() + if remaining <= len(data): + overflow.set() + if remaining > 0: + log.write(data[:remaining]) + + try: + if shutil.disk_usage(self.settings.root).free < 10 * 1024**3: + raise ValueError("服务器可用磁盘低于 10 GiB，未启动测试") + cmd, payload = self.command(run, directory) + collector = Collector(self.settings, directory, run["config"]["output_paths"]) + self.container = docker(*cmd) + process = subprocess.Popen(["docker", "start", "-ai", self.container], stdin=subprocess.PIPE, + stdout=subprocess.PIPE, stderr=subprocess.STDOUT) + process.stdin.write((json.dumps(payload) + "\n").encode()) + process.stdin.close() + payload.clear() + + def drain(): + while True: + chunk = os.read(process.stdout.fileno(), 4096) + if not chunk: + break + emit(chunk) + reader = threading.Thread(target=drain, daemon=True) + reader.start() + started = time.monotonic() + while process.poll() is None: + self.store.heartbeat() + collector.follow(emit) + cancel = self.store.run(run["id"])["cancel_requested"] + timed_out = time.monotonic() - started > run["config"]["timeout_seconds"] + disk_full = shutil.disk_usage(self.settings.root).free < 10 * 1024**3 or collector.external_growth() > 128 * 1024**2 + if cancel or timed_out or overflow.is_set() or self.stopping or disk_full: + self.inspect_owned(self.container) + docker("kill", self.container) + state = "cancelled" if cancel else ("timed_out" if timed_out else ("interrupted" if self.stopping else "failed")) + message = "本次容器已停止；若已发送模型请求，远端推理是否结束需另行核对" + if overflow.is_set(): + message = "日志达到 16 MiB 上限，本次测试已停止" + if disk_full: + message = "可用空间低于 10 GiB 或原目录输出新增超过 128 MiB，本次测试已停止；原文件保留" + break + time.sleep(0.5) + process.wait(timeout=15) + reader.join(timeout=5) + if reader.is_alive(): + raise RuntimeError("Log reader did not stop") + info = self.inspect_owned(self.container) + exit_code = info["State"]["ExitCode"] + if state == "failed" and message == "执行器发生错误": + state = "succeeded" if exit_code == 0 else "failed" + message = "脚本正常退出；模型质量请结合报告判断" if exit_code == 0 else f"脚本退出码 {exit_code}，请查看日志" + if info["State"].get("OOMKilled"): + message = "测试超过 512 MiB 内存限制" + if info["State"].get("Error") and info["State"].get("StartedAt", "").startswith("0001-"): + exit_code, state, message = None, "failed", "容器未成功启动，脚本未执行，请查看日志" + except Exception as exc: + message = str(exc) if isinstance(exc, ValueError) else f"执行器错误：{type(exc).__name__}；未自动重试" + emit(("\n[控制台] " + message + "\n").encode()) + finally: + if self.container: + try: + self.remove(self.container) + self.container = None + except Exception: + state, message = "interrupted", "容器清理未确认，执行器停止接单，请管理员检查" + self.stopping = True + if process and process.poll() is None: + process.terminate() + process.wait(timeout=10) + if collector: + collector.finish_follow(emit) + artifacts = collector.collect() if collector else [] + work = directory / "work" + if work in workspace.mounts(self.settings): + try: + workspace.remove(self.settings, work) + except Exception: + state, message = "interrupted", "临时目录卸载未确认，执行器停止接单，请管理员检查" + self.stopping = True + if overflow.is_set() and state == "succeeded": + state, message = "failed", "日志超过 16 MiB 上限，日志记录不完整，请查看已归档结果" + notices = list(dict.fromkeys(collector.notices))[:32] if collector else [] + summary = {"run_id": run["id"], "script_name": run["script_name"], "state": state, + "exit_code": exit_code, "sha256": run["sha256"], "version": run["version"], + "synthetic": run["synthetic"], "message": message, "finished_at": now(), + "archive_notices": notices, "log_truncated": overflow.is_set()} + data = json.dumps(summary, ensure_ascii=False, indent=2).encode("utf-8") + summary_path = directory / "summary.json" + summary_path.write_bytes(data) + artifact_id = hashlib.sha256(str(summary_path).encode()).hexdigest()[:24] + (directory / "artifacts").mkdir(exist_ok=True) + (directory / "artifacts" / artifact_id).write_bytes(data) + artifacts.append({"id": artifact_id, "name": "summary.json", "size": len(data), "kind": "json"}) + for notice in notices: + emit(("\n[归档] " + notice + "\n").encode()) + emit(("\n[控制台] " + message + "\n").encode()) + log.close() + if process: + process.stdout.close() + self.store.finish(run["id"], state, exit_code=exit_code, message=message, artifacts=artifacts) + + def loop(self): + self.recover() + while not self.stopping: + self.store.heartbeat() + run = self.store.claim() + if run: + if run.get("execution", {}).get("mode") == "native": + from .native_executor import NativeExecutor + NativeExecutor(self).execute(run) + else: + self.execute(run) + else: + time.sleep(1) + + +def main(): + config_path = Path(os.environ["XAS_WORKER_CONFIG"]) + config = json.loads(config_path.read_text()) + settings = Settings.from_env() + settings.prepare() + lock = (settings.db.parent / "worker.lock").open("a") + fcntl.flock(lock, fcntl.LOCK_EX | fcntl.LOCK_NB) + worker = Worker(settings, config) + from . import native_rpc + rpc = native_rpc.start(settings, worker.store) + signal.signal(signal.SIGTERM, worker.stop) + signal.signal(signal.SIGINT, worker.stop) + try:worker.loop() + finally: + rpc.shutdown();rpc.server_close() + + +if __name__ == "__main__": + main() diff --git a/console/workspace.py b/console/workspace.py new file mode 100644 index 0000000..3d7eafc --- /dev/null +++ b/console/workspace.py @@ -0,0 +1,35 @@ +"""Bounded temporary work files on a private per-run tmpfs mount.""" +from pathlib import Path +import re +import subprocess +from .catalog import safe_path + + +def mounts(settings): + result = [] + for line in Path("/proc/mounts").read_text().splitlines(): + device, target, kind, *_ = line.split() + if not device.startswith("xas-run-") or kind != "tmpfs": + continue + identity = device.removeprefix("xas-run-") + if not re.fullmatch(r"[a-f0-9]{32}", identity): + continue + expected = settings.runs / identity / "work" + if target != str(expected): + continue + result.append(safe_path(expected, settings.runs)) + return result + + +def create(settings, identity, uid): + target = safe_path(settings.runs / identity / "work", settings.runs) + if target in mounts(settings): + raise ValueError("本次临时目录已经挂载，拒绝覆盖") + subprocess.run(["mount", "-t", "tmpfs", "-o", f"size=134217728,nodev,nosuid,noexec,mode=0770,uid={uid},gid={uid}", + "xas-run-" + identity, str(target)], check=True, capture_output=True, timeout=10) + + +def remove(settings, target): + if target not in mounts(settings): + raise ValueError("临时挂载归属核验失败") + subprocess.run(["umount", "--", str(target)], check=True, capture_output=True, timeout=10) diff --git a/deploy/Dockerfile b/deploy/Dockerfile new file mode 100644 index 0000000..341a037 --- /dev/null +++ b/deploy/Dockerfile @@ -0,0 +1,8 @@ +FROM rundeck/rundeck:6.2.1@sha256:63d12aefbbd129a121d2af7d97abfaa64c3cbd7756063f74dbf3ab3377d136bd +USER root +RUN apt-get update \ + && apt-get install -y --no-install-recommends python3=3.10.6-1~22.04.1 \ + && dpkg-query -W python3 > /opt/xas-runtime-packages.txt \ + && rm -rf /var/lib/apt/lists/* +COPY --chown=1000:0 scripts /opt/xas-test-library/scripts +USER 1000 diff --git a/deploy/console-worker.service b/deploy/console-worker.service new file mode 100644 index 0000000..9921939 --- /dev/null +++ b/deploy/console-worker.service @@ -0,0 +1,21 @@ +[Unit] +Description=XAS script console private execution worker +After=docker.service +Requires=docker.service + +[Service] +Type=simple +WorkingDirectory=/adamwen-work-space/xas-test-library +Environment=XAS_CONSOLE_ROOT=/adamwen-work-space/xas-test-library/runtime +Environment=XAS_WORKER_CONFIG=/adamwen-work-space/xas-test-library/deploy/console-worker.json +Environment=PYTHONDONTWRITEBYTECODE=1 +ExecStart=/usr/bin/python3 -m console.worker +User=root +Group=root +UMask=0022 +Restart=on-failure +RestartSec=5 +TimeoutStopSec=30 + +[Install] +WantedBy=multi-user.target diff --git a/deploy/console.Dockerfile b/deploy/console.Dockerfile new file mode 100644 index 0000000..7246bf6 --- /dev/null +++ b/deploy/console.Dockerfile @@ -0,0 +1,10 @@ +ARG PYTHON_IMAGE=python@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 +FROM ${PYTHON_IMAGE} +ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 +WORKDIR /app +COPY console/requirements.txt /app/console/requirements.txt +RUN pip install --no-cache-dir -r /app/console/requirements.txt +COPY console /app/console +COPY catalog /app/catalog +ENTRYPOINT ["python3", "-m", "uvicorn", "console.app:create_app", "--factory", "--no-proxy-headers", "--no-access-log", "--host", "10.88.118.188"] +CMD ["--port", "14442"] diff --git a/deploy/console.Dockerfile.dockerignore b/deploy/console.Dockerfile.dockerignore new file mode 100644 index 0000000..79e2de6 --- /dev/null +++ b/deploy/console.Dockerfile.dockerignore @@ -0,0 +1,10 @@ +* +!console/ +!console/** +!catalog/ +!catalog/*.json +!deploy/ +!deploy/console.Dockerfile +!deploy/console.Dockerfile.dockerignore +**/__pycache__ +**/*.pyc diff --git a/deploy/cutover_console.py b/deploy/cutover_console.py new file mode 100644 index 0000000..a2f5f00 --- /dev/null +++ b/deploy/cutover_console.py @@ -0,0 +1,90 @@ +"""Cut over the verified dedicated console; preserve both previous deployments.""" +from datetime import datetime, timezone +import json +from pathlib import Path +import shutil +import sqlite3 +import subprocess +import sys +import time +import urllib.request + +sys.path.insert(0, str(Path(__file__).resolve().parents[1])) +from deploy.dedicated import ROOT, NAME, IMAGE, UNIT, command, prepare, web_arguments +from console.settings import Settings +from console.store import Store + +PREVIEW = NAME + "-preview-20261013" + + +def inspect(name): + return json.loads(command("docker", "inspect", name))[0] + + +def get(port, path): + req = urllib.request.Request(f"http://10.88.118.188:{port}{path}", headers={"Accept": "application/json"}) + with urllib.request.urlopen(req, timeout=8) as response: + return json.load(response) + + +def main(): + prepare() + preview = inspect(NAME) + if preview["Config"]["Labels"].get("xas.application") != "script-console": + raise RuntimeError("Unexpected preview owner") + if command("docker", "ps", "-aq", "--filter", "name=^/" + PREVIEW + "$"): + raise RuntimeError("Cutover has already been attempted; inspect saved state") + for name in ("adamwen-test-console", "adamwen-test-console-proxy"): + if inspect(name)["Config"]["Labels"].get("cn.aisuan.owner") != "adamwen-test-console": + raise RuntimeError("Unexpected old console owner") + old_runs = get(14440, "/api/41/project/xas-test-library/executions/running") + if not isinstance(old_runs.get("executions"), list): + raise RuntimeError("Cannot verify old console running tasks") + if get(14442, "/api/summary")["active"] or old_runs["executions"]: + raise RuntimeError("Console has running work; wait before cutover") + store = Store(Settings.from_env()) + if not any(r["state"] == "succeeded" and r["config"]["profile"] == "legacy_smoke" for r in store.runs()): + raise RuntimeError("Successful single smoke acceptance missing") + backup = ROOT / "runtime/backups/before-dedicated-20261013" + backup.mkdir(mode=0o700, exist_ok=False) + command("systemctl", "stop", UNIT) + command("docker", "stop", NAME) + with sqlite3.connect(store.settings.db) as source, sqlite3.connect(backup / "console.sqlite3") as destination: + source.backup(destination) + if destination.execute("PRAGMA integrity_check").fetchone()[0] != "ok": + raise RuntimeError("Snapshot integrity failure") + for folder in ("library", "runs"): + shutil.copytree(ROOT / "runtime" / folder, backup / folder) + (backup / "metadata.json").write_text(json.dumps({"observed_at": datetime.now(timezone.utc).isoformat(), + "preview_image": preview["Image"], "new_image": IMAGE, "old_console": "adamwen-test-console", + "old_proxy": "adamwen-test-console-proxy"}, indent=2)) + command("docker", "rename", NAME, PREVIEW) + command("docker", "stop", "adamwen-test-console") + command("docker", "stop", "adamwen-test-console-proxy") + try: + print(command(*web_arguments(14440)), flush=True) + command("systemctl", "start", UNIT) + for _ in range(20): + try: + if get(14440, "/api/summary")["worker"]["online"]: + print("CUTOVER_OK", flush=True) + break + except (OSError, ValueError): + pass + time.sleep(.5) + else: + raise RuntimeError("New entry point failed readiness check") + except Exception: + # Only revert app availability, never restore old data over newer records. + result = subprocess.run(["docker", "inspect", NAME], capture_output=True, text=True) + if result.returncode == 0 and json.loads(result.stdout)[0]["Config"]["Labels"].get("xas.application") == "script-console": + command("docker", "rm", "-f", NAME) + command("docker", "start", "adamwen-test-console-proxy") + command("docker", "start", "adamwen-test-console") + command("docker", "start", PREVIEW) + command("systemctl", "start", UNIT) + raise + + +if __name__ == "__main__": + main() diff --git a/deploy/dedicated.py b/deploy/dedicated.py new file mode 100644 index 0000000..bf5bc56 --- /dev/null +++ b/deploy/dedicated.py @@ -0,0 +1,102 @@ +"""First deployment / explicit port cutover. Only manages this application's resources.""" +import argparse +import json +import os +from pathlib import Path +import shutil +import socket +import subprocess +import sys + +ROOT = Path("/adamwen-work-space/xas-test-library") +NAME = "adamwen-script-console" +IMAGE = "adamwen/script-console:20261013-5" +UNIT = "adamwen-script-worker.service" + + +def validate_runtime(root): + for path in (root / "runtime", *(root / "runtime" / name for name in ("console-data", "library", "runs", "native-ipc"))): + if not path.resolve().is_relative_to(root.resolve()): + raise ValueError("Runtime must remain inside this project") + if any(part.is_symlink() for part in (path, *path.parents)): + raise ValueError("Runtime symlink rejected") + + +def command(*args, timeout=30): + return subprocess.check_output(args, text=True, timeout=timeout).strip() + + +def web_arguments(port): + validate_runtime(ROOT) + runtime = ROOT / "runtime" + args = ["docker", "run", "-d", "--name", NAME, "--label", "xas.application=script-console", + "--runtime", "runc", "--network", "host", "--user", "0:0", "--cap-drop", "ALL", + "--security-opt", "no-new-privileges", "--read-only", "--memory", "512m", "--cpus", "1", + "--pids-limit", "96", "--tmpfs", "/tmp:rw,nosuid,nodev,noexec,size=67108864", + "--log-driver", "local", "--log-opt", "max-size=10m", "--log-opt", "max-file=2", + "--env", "XAS_CONSOLE_ROOT=" + str(runtime)] + for name in ("console-data", "library", "runs", "native-ipc"): + path = runtime / name + args += ["--mount", f"type=bind,src={path},dst={path}" + (",readonly" if name in {"runs", "native-ipc"} else "")] + sources = json.loads((ROOT / "catalog/external-sources.json").read_text())["sources"] + for source in sources: + path = Path(source["path"]) + if path.is_dir(): + args += ["--mount", f"type=bind,src={path},dst={path},readonly"] + if path.name == "scripts": + for folder in ("logs", "results"): + logs = path.parent / folder + if logs.is_dir(): + args += ["--mount", f"type=bind,src={logs},dst={logs},readonly"] + return args + [IMAGE, "--port", str(port)] + + +def prepare(): + if os.geteuid() != 0 or ROOT.resolve() != ROOT or not (ROOT / "console/worker.py").is_file(): + raise RuntimeError("Run through the documented sudo flow in the confirmed project") + validate_runtime(ROOT) + for name in ("console-data", "library", "runs", "native-ipc"): + path = ROOT / "runtime" / name + if path.is_symlink(): + raise RuntimeError("Runtime symlink rejected") + path.mkdir(mode=0o750, exist_ok=True) + runner = command("docker", "image", "inspect", "--format", "{{.Id}}", "adamwen/test-console:20261013-2") + config = {"project": str(ROOT), "runner_image": runner, + "smoke_upstream": "http://100.64.0.55:18100", + "smoke_credential": "/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/configs/vllm.env"} + path = ROOT / "deploy/console-worker.json" + if path.exists() and json.loads(path.read_text()) != config: + raise RuntimeError("Existing worker configuration differs; review before replacing") + path.write_text(json.dumps(config, indent=2)) + path.chmod(0o600) + # Existing roots are 0700/root. Container root has no capabilities and read-only mounts. + # Runtime code used by non-root jobs needs read access, without changing original scripts. + for p in (ROOT / "console").rglob("*"): + p.chmod(0o755 if p.is_dir() else 0o644) + (ROOT / "console").chmod(0o755) + + +def start(port): + existing = command("docker", "ps", "-aq", "--filter", "name=^/" + NAME + "$") + if existing: + raise RuntimeError("Console container already exists; inspect before replacement") + with socket.socket() as probe: + probe.bind(("10.88.118.188", port)) + print(command(*web_arguments(port))) + service = Path("/etc/systemd/system") / UNIT + content = (ROOT / "deploy/console-worker.service").read_bytes() + if service.exists() and service.read_bytes() != content: + raise RuntimeError("Existing systemd service differs") + service.write_bytes(content) + command("systemctl", "daemon-reload") + # Start only; no automatic boot scheduling is enabled by this deployment. + command("systemctl", "start", UNIT) + print(command("systemctl", "is-active", UNIT)) + + +if __name__ == "__main__": + parser = argparse.ArgumentParser() + parser.add_argument("--port", type=int, choices=[14440, 14442], default=14442) + options = parser.parse_args() + prepare() + start(options.port) diff --git a/deploy/jaas-loginmodule.conf.template b/deploy/jaas-loginmodule.conf.template new file mode 100644 index 0000000..0e3f1c3 --- /dev/null +++ b/deploy/jaas-loginmodule.conf.template @@ -0,0 +1,5 @@ +rundeck { + org.rundeck.jaas.jetty.ReloadablePropertyFileLoginModule required + debug="false" + file="/home/rundeck/secure/realm.properties"; +}; diff --git a/deploy/jobs.yaml b/deploy/jobs.yaml new file mode 100644 index 0000000..ec20181 --- /dev/null +++ b/deploy/jobs.yaml @@ -0,0 +1,31 @@ +- uuid: ef76123d-f532-42c7-b7f7-a78f9231c18d + name: 快速流程验收（模拟数据） + group: 00-platform-acceptance + description: | + 验证网页、执行、日志与结果流程。不使用 GPU，不调用模型。 + success：约一秒后成功；failure：主动失败；invalid-report：报告异常；wait：等待，用于测试超时或点击停止。 + 结果中的 synthetic=true 表示模拟验收数据，不能作为模型性能结果。 + executionEnabled: true + scheduleEnabled: false + multipleExecutions: false + loglevel: INFO + timeout: 45s + nodeFilterEditable: false + options: + - name: mode + label: 验收场景 + required: true + enforced: true + value: success + values: [success, failure, invalid-report, wait] + - name: timeout + label: 最长运行秒数 + required: true + enforced: true + value: '8' + values: ['2', '5', '8', '15', '30'] + sequence: + keepgoing: false + strategy: node-first + commands: + - exec: python3 -u /opt/xas-test-library/scripts/run_smoke.py diff --git a/deploy/lan-settings.json b/deploy/lan-settings.json new file mode 100644 index 0000000..5ea5ecd --- /dev/null +++ b/deploy/lan-settings.json @@ -0,0 +1,5 @@ +{ + "address": "10.88.118.188", + "allowed_cidrs": ["10.88.0.0/17", "10.20.0.0/21"], + "port": 14440 +} diff --git a/deploy/lan_config.py b/deploy/lan_config.py new file mode 100644 index 0000000..c37492d --- /dev/null +++ b/deploy/lan_config.py @@ -0,0 +1,89 @@ +"""Validated private-interface settings and a fixed-identity reverse proxy.""" +import ipaddress +import json + +PROXY_IMAGE = 'nginx:stable-alpine@sha256:0985e772fb9f729e6fa0980da05fca5d9c468e870eed43071545afa9d2e27d94' +NETWORK = 'adamwen-test-console-net' +PROXY = 'adamwen-test-console-proxy' + + +def validate_settings(value): + if not isinstance(value, dict) or set(value) != {'address', 'allowed_cidrs', 'port'}: + raise ValueError('Exactly address, allowed_cidrs and port must be configured') + address = ipaddress.ip_address(value['address']) + if not isinstance(value['allowed_cidrs'],list) or not 1 <= len(value['allowed_cidrs']) <= 8: + raise ValueError('Configure one to eight explicit private source networks') + networks = [ipaddress.ip_network(n, strict=True) for n in value['allowed_cidrs']] + private = [ipaddress.ip_network(n) for n in ('10.0.0.0/8','172.16.0.0/12','192.168.0.0/16')] + if address.version != 4 or any(n.version != 4 or not any(n.subnet_of(p) for p in private) for n in networks): + raise ValueError('An explicit RFC1918 IPv4 interface and network are required') + if not any(address in n and address not in (n.network_address,n.broadcast_address) for n in networks): + raise ValueError('The interface must belong to the allowed LAN subnet') + if type(value['port']) is not int or not 1024 <= value['port'] <= 65535: + raise ValueError('The port must be an integer between 1024 and 65535') + if len({str(n) for n in networks}) != len(networks): + raise ValueError('Duplicate source networks are not allowed') + return {'address': str(address), 'allowed_cidrs': [str(n) for n in networks], 'port': value['port']} + + +def load_settings(path): + return validate_settings(json.loads(path.read_text(encoding='utf-8'))) + + +def proxy_config(settings): + value = validate_settings(settings) + address, port = value['address'], value['port'] + allows = '\n '.join(f'allow {cidr};' for cidr in value['allowed_cidrs']) + origin = f'http://{address}:{port}' + return f'''worker_processes 1; +pid /tmp/nginx.pid; +error_log /dev/stderr warn; +events {{ worker_connections 256; }} +http {{ + client_body_temp_path /tmp/client_body; + proxy_temp_path /tmp/proxy; + fastcgi_temp_path /tmp/fastcgi; + uwsgi_temp_path /tmp/uwsgi; + scgi_temp_path /tmp/scgi; + log_format limited '$remote_addr [$time_local] "$request_method $uri $server_protocol" $status $body_bytes_sent'; + access_log /dev/stdout limited; + map $http_origin $origin_allowed {{ default 0; "" 1; "{origin}" 1; }} + map $http_sec_fetch_site $cross_site {{ default 0; cross-site 1; }} + server {{ + listen 8080; + server_name {address}; + {allows} + deny all; + if ($host != {address}) {{ return 403; }} + if ($origin_allowed = 0) {{ return 403; }} + if ($cross_site = 1) {{ return 403; }} + if ($arg_authtoken != "") {{ return 403; }} + client_max_body_size 1m; + keepalive_timeout 30s; + send_timeout 30s; + location / {{ + proxy_pass http://127.0.0.1:4440; + proxy_http_version 1.1; + proxy_set_header Connection ""; + proxy_set_header Host {address}:{port}; + proxy_set_header X-Forwarded-Host {address}:{port}; + proxy_set_header X-Forwarded-Port {port}; + proxy_set_header X-Forwarded-Proto http; + proxy_set_header X-Forwarded-For $remote_addr; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header Forwarded ""; + proxy_set_header X-Forwarded-Uuid xas-intranet; + proxy_set_header X-Forwarded-Roles xas-operator; + proxy_set_header X-Forwarded-User-FirstName ""; + proxy_set_header X-Forwarded-User-LastName ""; + proxy_set_header X-Forwarded-User-Email ""; + proxy_set_header Authorization ""; + proxy_set_header X-Rundeck-Auth-Token ""; + proxy_buffering off; + proxy_connect_timeout 5s; + proxy_read_timeout 60s; + proxy_send_timeout 30s; + }} + }} +}} +''' diff --git a/deploy/migrate_lan.py b/deploy/migrate_lan.py new file mode 100644 index 0000000..6272e9d --- /dev/null +++ b/deploy/migrate_lan.py @@ -0,0 +1,81 @@ +#!/usr/bin/env python3 +"""One-time, scoped cutover from the loopback preview; preserve a recovery snapshot.""" +import argparse +import hashlib +import json +from pathlib import Path +import subprocess +import tarfile + +from start import CONTAINER, IMAGE, validate_runtime + +OLD = 'adamwen-test-console-before-lan-20261013' + + +def run(args): + return subprocess.check_output(args, text=True, timeout=90).strip() + + +def inspect(name): + result = subprocess.run(['docker','inspect',name], capture_output=True, text=True) + return json.loads(result.stdout)[0] if result.returncode == 0 else None + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument('--project-root',type=Path,required=True) + args = parser.parse_args() + project = args.project_root.resolve(strict=True) + runtime = validate_runtime(project) + before = inspect(CONTAINER) + if before is None or before['Config'].get('Labels',{}).get('cn.aisuan.owner') != CONTAINER: + parser.error('Expected the existing project-owned preview container') + if before['HostConfig'].get('PortBindings',{}).get('4440/tcp') != [{'HostIp':'127.0.0.1','HostPort':'14440'}]: + parser.error('Expected the original loopback preview; do not repeat this migration') + if inspect(OLD) or inspect('adamwen-test-console-proxy'): + parser.error('Cutover containers already exist; inspect the saved outcome before retrying') + if inspect(IMAGE) is None: + parser.error('Build the new project image before cutover') + backup = runtime / 'backups/before-lan-20261013' + if not (backup/'source/deploy/start.py').is_file() or backup.is_symlink(): + parser.error('The source snapshot must already exist inside this project') + archive = backup/'runtime-before-lan.tar.gz' + if archive.exists(): + parser.error('A data snapshot already exists; refusing to overwrite it') + active = run(['docker','exec',CONTAINER,'python3','-c', + "from pathlib import Path;import os;print(len([p for p in Path('/proc').glob('[0-9]*/cmdline') if p.parent.name != str(os.getpid()) and any(x in p.read_bytes().split(b'\\x00') for x in (b'/opt/xas-test-library/scripts/run_smoke.py',b'/opt/xas-test-library/scripts/smoke_task.py'))]))"]) + if active != '0': + parser.error('An acceptance task is still running; wait for it to finish') + for name in ('configure-login.sh','set_login.py'): + current, saved = project/'deploy'/name, backup/'source/deploy'/name + if current.exists() and hashlib.sha256(current.read_bytes()).digest() != hashlib.sha256(saved.read_bytes()).digest(): + parser.error('A legacy source file has changed since backup; preserve the user change') + print(run(['docker','stop','--timeout','30',CONTAINER]),flush=True) + try: + with tarfile.open(archive,'x:gz') as tar: + for name in ('data','logs','projects','results','auth'): + source = runtime/name + if source.exists(): + tar.add(source,arcname=name,recursive=True) + archive.chmod(0o600) + metadata = {'container_id':before['Id'],'image_id':before['Image'], + 'started_at':before['State']['StartedAt'],'backup_container':OLD, + 'database_snapshot':archive.name} + (backup/'metadata.json').write_text(json.dumps(metadata,indent=2),encoding='utf-8') + print(run(['docker','rename',CONTAINER,OLD]),flush=True) + except Exception: + run(['docker','start',CONTAINER]) + raise + # The two removed files are this project's reviewed password provisioning implementation. + for name in ('configure-login.sh','set_login.py'): + path=project/'deploy'/name + if path.exists(): + path.unlink() + result = subprocess.run(['python3',str(project/'deploy/start.py'),'--project-root',str(project)]) + if result.returncode: + raise SystemExit('New stack was not fully started. Old container and data snapshot are preserved; inspect before rollback.') + print(json.dumps({'cutover':'started','backup':str(backup),'previous_container':OLD})) + + +if __name__ == '__main__': + main() diff --git a/deploy/native_profiles.py b/deploy/native_profiles.py new file mode 100644 index 0000000..a9193fb --- /dev/null +++ b/deploy/native_profiles.py @@ -0,0 +1,83 @@ +"""Auditable, additive configuration migration; no source/history/schema changes.""" +import argparse +import hashlib +import json +import os +from pathlib import Path +import sys + +sys.path.insert(0, str(Path(__file__).resolve().parents[1])) +from console.native_plans import profile_for, validate_config +from console.settings import Settings +from console.store import Store, now + + +def migrate(store, backup, apply=False): + changes = [] + for item in store.scripts(): + profile = profile_for(store.settings, item) + if not profile: + continue + if hashlib.sha256(Path(item["source_path"]).read_bytes()).hexdigest() != item["sha256"]: + raise ValueError("Source changed: " + profile["id"]) + updated = {**item} + updated["config"] = validate_config(store.settings, item, + {"timeout_seconds": profile.get("timeout_seconds", 3600), "native_options": item["config"].get("native_options", {})}) + available = profile.get("available", True) + updated.update(enabled=available, blocked=not available, + status="ready" if available else "needs_configuration", + reason="" if available else profile.get("unavailable_reason", "原环境不可用")) + if all(updated[k] == item.get(k) for k in ("config", "enabled", "blocked", "status", "reason")): + continue + updated["updated_at"] = now() + changes.append((item, updated)) + if len({profile_for(store.settings, item)["id"] for item in store.scripts() if profile_for(store.settings, item)}) != len(store.settings.native_catalog["profiles"]): + raise ValueError("Registered sources do not match trusted profiles") + if not apply: + return {"pending": len(changes), "applied": False} + if not changes: + return {"pending": 0, "applied": True} + with store.connect(write=True) as db: + if db.execute("SELECT 1 FROM runs WHERE state IN ('queued','running')").fetchone(): + raise ValueError("Drain active runs before migrating") + saved = [] + for old, updated in changes: + raw = db.execute("SELECT data FROM scripts WHERE id=?", (old["id"],)).fetchone()[0] + if json.loads(raw) != old: + raise ValueError("Concurrent configuration change; migration aborted") + saved.append({"id": old["id"], "before": raw, "after": json.dumps(updated)}) + backup.parent.mkdir(parents=True, exist_ok=True) + with backup.open("x", encoding="utf-8") as handle: + json.dump({"created_at": now(), "scripts": saved}, handle, ensure_ascii=False, indent=2) + backup.chmod(0o600) + for item in saved: + db.execute("UPDATE scripts SET data=? WHERE id=?", (item["after"], item["id"])) + return {"pending": len(changes), "applied": True, "backup": str(backup)} + + +def restore(store, backup): + saved = json.loads(backup.read_text(encoding="utf-8"))["scripts"] + with store.connect(write=True) as db: + if db.execute("SELECT 1 FROM runs WHERE state IN ('queued','running')").fetchone(): + raise ValueError("Drain active runs before rollback") + for item in saved: + current = db.execute("SELECT data FROM scripts WHERE id=?", (item["id"],)).fetchone()[0] + if current not in (item["before"], item["after"]): + raise ValueError("Configuration changed after migration; review before rollback") + for item in saved: + db.execute("UPDATE scripts SET data=? WHERE id=?", (item["before"], item["id"])) + return {"restored": len(saved), "history_preserved": True} + + +if __name__ == "__main__": + parser = argparse.ArgumentParser() + parser.add_argument("--apply", action="store_true") + parser.add_argument("--restore", action="store_true") + parser.add_argument("--backup", type=Path, required=True) + args = parser.parse_args() + if os.geteuid() != 0: + raise SystemExit("Run using the documented sudo flow") + if args.apply and args.restore: + parser.error("Choose apply or restore") + store = Store(Settings.from_env()) + print(json.dumps(restore(store, args.backup) if args.restore else migrate(store, args.backup, args.apply))) diff --git a/deploy/operator.aclpolicy b/deploy/operator.aclpolicy new file mode 100644 index 0000000..d517fe3 --- /dev/null +++ b/deploy/operator.aclpolicy @@ -0,0 +1,30 @@ +description: Operators may view and execute registered acceptance jobs only +context: + project: xas-test-library +for: + resource: + - equals: + kind: job + allow: [read] + - equals: + kind: event + allow: [read] + job: + - equals: + group: 00-platform-acceptance + allow: [read, run, kill] + node: + - allow: [read, run] +by: + group: xas-operator +--- +description: Operators may see this project, but not create projects or commands +context: + application: rundeck +for: + project: + - equals: + name: xas-test-library + allow: [read] +by: + group: xas-operator diff --git a/deploy/realm.disabled.properties b/deploy/realm.disabled.properties new file mode 100644 index 0000000..e9e0620 --- /dev/null +++ b/deploy/realm.disabled.properties @@ -0,0 +1 @@ +# Password login is disabled. The private backend accepts the proxy's fixed operator identity. diff --git a/deploy/start.py b/deploy/start.py new file mode 100644 index 0000000..62f2b5d --- /dev/null +++ b/deploy/start.py @@ -0,0 +1,111 @@ +#!/usr/bin/env python3 +"""Start only this project's CPU-only Rundeck container (run via normal sudo).""" +import argparse +import json +import os +from pathlib import Path +import socket +import subprocess +import sys + +CONTAINER = "adamwen-test-console" +IMAGE = "adamwen/test-console:20261013-2" + + +def validate_runtime(project): + project = project.resolve(strict=True) + runtime = project / "runtime" + candidates = [runtime] + [runtime / name for name in ("auth", "data", "logs", "projects", "results", "proxy")] + for path in candidates: + if path.is_symlink() or not path.resolve().is_relative_to(project): + raise ValueError("Runtime directories must remain inside this project without symlinks") + if path.exists() and not path.is_dir(): + raise ValueError("Runtime paths must be directories") + return runtime + + +def main(): + from lan_config import load_settings, proxy_config, PROXY_IMAGE, NETWORK, PROXY + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--project-root", type=Path, required=True) + args = parser.parse_args() + project = args.project_root.resolve(strict=True) + try: + runtime = validate_runtime(project) + except ValueError as exc: + parser.error(str(exc)) + settings = load_settings(project / "deploy/lan-settings.json") + for name in (CONTAINER, PROXY): + existing = subprocess.run(["docker", "container", "inspect", name], + stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) + if existing.returncode == 0: + parser.error(f"{name} already exists; inspect it instead of replacing it") + with socket.socket() as probe: + probe.bind((settings['address'], settings['port'])) + network = subprocess.run(["docker", "network", "inspect", NETWORK], capture_output=True, text=True) + if network.returncode == 0: + if json.loads(network.stdout)[0].get('Labels', {}).get('cn.aisuan.owner') != CONTAINER: + parser.error('Existing network does not belong to this project') + else: + subprocess.run(['docker','network','create','--label',f'cn.aisuan.owner={CONTAINER}',NETWORK],check=True) + for name in ("data", "logs", "projects", "results", "proxy"): + path = runtime / name + if path.is_symlink(): + parser.error("Symlink runtime directories are forbidden") + path.mkdir(parents=True, exist_ok=True, mode=0o700) + os.chown(path, 1000, 0) + os.chmod(path, 0o700) + config = runtime / 'proxy/nginx.conf' + if config.is_symlink(): + parser.error('Proxy config must not be a symlink') + config.write_text(proxy_config(settings), encoding='utf-8') + os.chmod(config, 0o644) + url = f"http://{settings['address']}:{settings['port']}" + command = ["docker", "run", "-d", "--name", CONTAINER, + "--label", "cn.aisuan.owner=adamwen-test-console", + "--runtime", "runc", "--user", "1000:0", "--init", + "--cpus", "2", "--memory", "2g", "--memory-swap", "2g", + "--pids-limit", "256", "--cap-drop", "ALL", + "--security-opt", "no-new-privileges:true", + "--restart", "no", "--network", f"container:{PROXY}", + "--log-opt", "max-size=10m", "--log-opt", "max-file=3", + "-e", f"RUNDECK_GRAILS_URL={url}", + "-e", "RUNDECK_SERVER_ADDRESS=127.0.0.1", + "-e", "RUNDECK_SERVER_FORWARDED=true", + "-e", "RUNDECK_PREAUTH_ENABLED=true", + "-e", "RUNDECK_PREAUTH_ATTRIBUTE_NAME=REMOTE_USER_GROUPS", + "-e", "RUNDECK_PREAUTH_USERNAME_HEADER=X-Forwarded-Uuid", + "-e", "RUNDECK_PREAUTH_ROLES_HEADER=X-Forwarded-Roles", + "-e", "RUNDECK_SERVER_SESSION_TIMEOUT=1800", + "-e", "RUNDECK_QUARTZ_THREADPOOL_THREADCOUNT=2", + "-e", "JVM_MAX_RAM_PERCENTAGE=60", + "-e", "NVIDIA_VISIBLE_DEVICES=void", + "-e", "CUDA_VISIBLE_DEVICES="] + mounts = [(project / 'deploy/realm.disabled.properties', "/home/rundeck/secure/realm.properties", "ro"), + (runtime / "data", "/home/rundeck/server/data", "rw"), + (runtime / "logs", "/home/rundeck/var/logs", "rw"), + (runtime / "projects", "/home/rundeck/projects", "rw"), + (runtime / "results", "/home/rundeck/test-results", "rw"), + (project / "deploy" / "operator.aclpolicy", "/home/rundeck/etc/xas-operator.aclpolicy", "ro"), + (project / "deploy" / "jaas-loginmodule.conf.template", "/etc/remco/templates/jaas-loginmodule.conf", "ro")] + for source, destination, access in mounts: + command += ["--mount", f"type=bind,src={source},dst={destination}" + (",readonly" if access == "ro" else "")] + command.append(IMAGE) + proxy_base = ['docker','run','--runtime','runc','--network',NETWORK,'--user','101:101', + '--cpus','0.25','--memory','64m','--pids-limit','32','--cap-drop','ALL', + '--security-opt','no-new-privileges:true','--read-only', + '--tmpfs','/tmp:rw,noexec,nosuid,size=16m', + '--mount',f'type=bind,src={config},dst=/etc/nginx/nginx.conf,readonly', + '--entrypoint','nginx'] + subprocess.run(proxy_base + ['--rm',PROXY_IMAGE,'-t'],check=True) + subprocess.run(proxy_base + ['-d','--name',PROXY,'--label',f'cn.aisuan.owner={CONTAINER}', + '--publish',f"{settings['address']}:{settings['port']}:8080", + '--restart','no','--log-opt','max-size=5m','--log-opt','max-file=2', + PROXY_IMAGE,'-g','daemon off;'],check=True) + # Namespace loopback cannot be reached via the container IP from the shared host. + subprocess.run(command, check=True) + print(json.dumps({"container":CONTAINER,"proxy":PROXY,"url":url,"allowed_cidrs":settings['allowed_cidrs'],"gpu":False})) + + +if __name__ == "__main__": + main() diff --git a/docs/acceptance-2026-10-13.md b/docs/acceptance-2026-10-13.md new file mode 100644 index 0000000..13fd2b8 --- /dev/null +++ b/docs/acceptance-2026-10-13.md @@ -0,0 +1,81 @@ +# 第一阶段验收记录 + +此文为最初回环预览的历史快照；用户后续免登录要求的当前状态见 [内网验收](acceptance-lan-2026-10-13.md)。 + +核对日期：2026-10-13（北京时间）。结论：受限网页预览与轻量流程验证通过；正式 GPU 测试尚未接入。 + +## 本轮变更 + +- 新建本地私有脚本库工作目录及空 Git 仓库，所有文件未暂存；提交数为 0，无远程仓库。 +- 新建服务器目录 `/adamwen-work-space/xas-test-library` 和容器 `adamwen-test-console`。 +- 网页使用 Rundeck 6.2.1，基础镜像摘要 `sha256:63d12aefbbd129a121d2af7d97abfaa64c3cbd7756063f74dbf3ab3377d136bd`。 +- 运行镜像 `adamwen/test-console:20261013-1`，镜像 ID `sha256:429dfa1322c8e72b25fb82d5a1a6452af4968f30f5dbb6ee6937825aadd38ab7`。 +- 镜像增加 Python 3.10.6-1~22.04.1、python3-bcrypt 3.2.0-1build1，宿主机运行时未升级。 +- 只导入一个轻量任务，UUID 为 `ef76123d-f532-42c7-b7f7-a78f9231c18d`。旧公司套件与两个试验目录只登记来源。 + +## 行为测试 + +| 验证环境 | 本轮最终结果 | +|---|---| +| 本地 Windows | 10 项中 6 通过、4 跳过；跳过原因是 Linux 进程组及当前账号无法创建目录链接 | +| 00088 Linux | 10/10 通过，耗时 4.087 秒，无跳过 | + +覆盖：成功日志和模拟结果、脚本非零退出、退出 0 但报告无效、重复编号不覆盖、路径穿越/无效参数拒绝、超时清理、取消父子进程、运行根目录和子目录链接拒绝。 + +新增代码先观察失败测试，再完成实现；独立审查指出的运行目录父链接问题已补回归测试并修复。修复后的全套 Linux 测试通过。没有未处理的审查发现。 + +## Rundeck 真实任务链路 + +| 执行编号 | 场景 | Rundeck 状态 | 业务状态 | 清理确认 | +|---|---|---|---|---| +| 1 | 成功 | succeeded | succeeded | true | +| 2 | 主动失败 | failed | failed | true | +| 3 | 无效报告 | failed | invalid_result | true | +| 4 | 2 秒超时 | failed | timed_out | true | +| 5 | 运行后取消 | aborted | cancelled | true | +| 6 | 浏览器点击运行 | succeeded | succeeded | true | + +前五项在 11:14:36 至 11:14:43 完成。第六项在 11:19:28 至 11:19:29 完成，运行器记录约 0.64 秒。以上均为 synthetic 流程验收数据，没有使用 GPU 或模型接口。 + +未登录 API 返回 403；普通操作角色执行任意命令返回 403；同一任务正在执行时再次提交返回 409。 + +## 真实浏览器 + +使用独立 Edge 浏览器上下文，通过 SSH 转发登录普通操作账号，核对任务列表和参数页；点击 Run Job Now 产生执行 6；核对完成页、三条进度日志和结构化结果。 + +页面的 Succeeded 文案由 CSS `::after` 生成，最初按 DOM 文字精确定位的自动等待超时。服务端记录与截图均成功，后续只读取已有执行 6，确认伪元素内容为 `"Succeeded"` 并打开日志页，没有因文字定位问题重复提交任务。 + +截图：[任务参数页](images/job.png)、[执行日志页](images/logs.png)。视口为 1440 × 1000。 + +## 共享服务与隔离证据 + +- 原有 `dengyuyun-joy-dsv41-trial` 容器 ID 为 `114ceebc787845e45e1abcb0a46ac962529c28a4b865894cd3581234cd729e1a`，仍为 running，启动时间为 2026-10-12 13:29:36（北京时间），RestartCount=0。它的启动时间早于本轮操作，未被本轮重启。 +- GPU 查询仍看到 VLLM::Worker_TP0～TP7；没有创建新的 GPU 任务。本轮没有调用模型接口，不能把进程存活当作模型业务质量验证。 +- 新容器 DeviceRequests=null、Devices=[]、Privileged=false，容器内 `/dev/nvidia*` 为空。 +- 所有绑定挂载都在本项目目录下；没有 `/dengyuyun-joy-work-space`、共享模型或 Docker socket 挂载。 +- 只发布 `127.0.0.1:14440 → 4440`，未改防火墙和旧端口。 +- 配置上限为 2 CPU、2 GiB 内存、256 进程。检查时新容器 CPU 约 0.06%、内存约 1.275 GiB；这是观察值，不是持续性能承诺。 + +## 过程中的问题与修复 + +- 首次启动登录页早于 API 就绪；将准备检查改为 API 的未认证响应，避免把加载页 HTTP 200 当作可用。 +- 权限验收请求最初缺少 project 参数，返回 400；补齐官方 API 参数后得到明确 403。 +- YAML 的固定标识改用 uuid，并与实际已创建任务对齐，保留同一任务；原 404 请求没有创建运行记录。 +- 浏览器输出使用 UTF-8；状态文字采用实际 CSS 和截图证据核验。 +- 独立审查发现运行目录父链接可跨出项目；已在任何 mkdir/chown/chmod 前核验完整运行路径。 + +## 交付边界 + +用户仍需通过 README 中的交互式工具设置自己的网页登录密码，明文不进入聊天、源码或参数。临时验收账号在交付收尾时撤销。 + +当前为单实例 H2 预览，未配置组织 SSO、正式数据库、自动备份、系统自启或公司网访问入口。运行日志与结果尚无自动清理；没有新增定时任务。 + +长时 GPU 压测、模型性能/质量、正式脚本停止语义与多人资源调度均未验证。公司仓库尚未建立，因此远程 Git 集成未验证。 + +恢复时只操作本项目容器及目录；保留数据库和结果。版本回退不自动恢复数据库，后续升级需另行备份并核验数据兼容性。 + +## 核对过的官方资料 + +- [Rundeck Docker 配置](https://docs.rundeck.com/docs/administration/configuration/docker.html) +- [认证和可重载密码文件](https://docs.rundeck.com/docs/administration/security/authentication.html) +- [API：导入、执行与取消](https://docs.rundeck.com/docs/api/) diff --git a/docs/acceptance-behavior-catalog-2026-10-13.md b/docs/acceptance-behavior-catalog-2026-10-13.md new file mode 100644 index 0000000..5efc084 --- /dev/null +++ b/docs/acceptance-behavior-catalog-2026-10-13.md @@ -0,0 +1,35 @@ +# 按测试行为整理目录：验收记录 + +核对日期：2026-10-13 19:06（北京时间）。用户要求“一项测试为一个项目”，不把套件内部文件平铺。当前规则见 [ADR 0003](adr/0003-test-behavior-catalog.md)。 + +## 实际结果 + +- 正式地址仍为 `http://10.88.118.188:14440/#/scripts`。主列表 23 项业务测试，包含 8 项套件和 15 项单项测试。 +- GPU 综合验收套件只显示一项，详情关联 224 个文件，其内部 148 个验证文件不再作为独立项目。 +- 套件和同类测试的辅助模块、素材生成脚本及相关实现归入详情“相关文件”。文件可搜索和只读查看；选择文件不会变更执行入口。 +- 两个控制台验收样例默认隐藏，可在“项目用途 → 验收示例”查看。已接入的轻量检查保持可运行，其他业务测试仍待配置。 +- 扫描文件只更新文件清单，不自动生成测试卡片。测试入口由 `catalog/test-definitions.json` 明确登记；新上传的单入口脚本作为新测试。 + +## 本轮验证 + +隔离 Linux 环境 **37/37** 回归检查通过，其中新增 6 项覆盖：套件合并、刷新不提升辅助文件、内部文件服务端执行限制、上传与示例筛选、历史保留、测试名称与唯一入口排队。原有配置、日志、结果、版本和执行器回归一并通过。 + +真实浏览器在数据库副本预览与正式地址均完成只读验收：主列表 23 项，套件详情 224 个文件，源码只读，内部文件详情没有运行按钮，直接运行 API 返回 400，示例筛选 2 项，10 条历史记录保留。桌面和 390px 视口通过，浏览器无 JavaScript 错误。验收发现长路径卡片在小屏撑宽，已用网格子项 min-width 修复并复查。 + +本轮没有执行任何服务器测试脚本或调用实际模型。测试中的本机假上游与临时子进程只用于隔离回归，不是业务测试运行。 + +## 数据及共享资源 + +更新前后 scripts、versions、runs 三张表的完整数据摘要一致；SQLite 结构仍为 schema v1，没有结构迁移、回填、删除或历史重写。307 个原位置文件的 SHA-256 全部一致。 + +私有执行器进程 MainPID 仍为 2086920，没有重启；模型容器 ID 和 StartedAt 与更新前一致，没有重启或更改配置。只替换了本项目网页容器。正式地址执行器在线、活动任务 0、历史记录 10；目录预览容器已移除。 + +## 发布、回退和改动文件 + +正式镜像为 `adamwen/script-console:20261013-2`，摘要 `sha256:e163e0dcf1bc7bff05d0f42cb495732de6e7d97a8950f6ad64a7e6ccc40641f1`。切换前的网页容器停止保留为 `adamwen-script-console-before-catalog-20261013`。 + +备份位于 `runtime/backups/before-behavior-catalog-20261013/`，包括本轮改动前源码、SQLite 快照、原文件摘要、原网页/模型状态与执行器 PID。应用回退只需在无活动任务时停止并保留新网页，恢复旧网页容器原名后启动；旧镜像兼容同一 schema v1，无须覆盖数据库。恢复源码时逐文件核对后续改动，不能用整目录覆盖；数据快照恢复须另行确认，不自动丢弃新记录。故障回退路径未实际触发。 + +主要修改：`console/test_catalog.py`、`console/app.py`、`console/settings.py`、`console/static/` 相关页面、`catalog/test-definitions.json`、`tests/test_test_catalog.py`、既有测试入口夹具、部署镜像引用和维护文档。没有 Git 暂存、提交或推送。 + +脱敏证据：服务器 `runtime/behavior-catalog-acceptance.json`；本地 `.local/evidence/behavior-catalog-browser.json` 与 `.local/screenshots/behavior-*.png`。旧部署验收记录保留其原始时点，不作为本轮状态。 diff --git a/docs/acceptance-dedicated-2026-10-13.md b/docs/acceptance-dedicated-2026-10-13.md new file mode 100644 index 0000000..6725afe --- /dev/null +++ b/docs/acceptance-dedicated-2026-10-13.md @@ -0,0 +1,64 @@ +# 专用控制台验收记录 + +核对日期：2026-10-13；正式入口切换时间 17:32（北京时间），中断后再次核对时间 17:59。以下是本轮实际执行证据，不代表所有原有脚本或 GPU 测试已验收。 + +## 已交付 + +正式入口为 `http://10.88.118.188:14440/`，公司内网免登录。旧 `/project/xas-test-library/nodes` 等项目书签自动转到新脚本库。14442 预览已停止，旧 Rundeck 网页和代理容器停止保留，原数据没有删除或迁移覆盖。 + +支持脚本搜索/筛选、只读源码、上传新脚本及新版本、元数据与运行配置、单并发队列、实时标准输出/错误和 `.log`、取消、历史记录、结果预览/下载。排队记录固定版本和配置，历史上传版本不可覆盖。 + +当前共 310 项：公司套件 224 项、DeepSeek 试验目录 35 项、模型试验目录 48 项、托管脚本 3 项。307 个原位置文件包括执行入口和辅助模块，只登记，不批量复制。可运行的 3 项为复制的 DeepSeek 轻量检查、快速流程样例和网页上传演示；原位置条目仍待逐项配置。 + +## 自动检查与浏览器 + +- 最终候选版本在隔离 Linux 容器执行 **31/31** 项检查通过，包括历史运行器回归、上传版本、路径/链接限制、请求幂等、日志 UTF-8 分块、文件日志尾段、模型代理预算/禁止重定向、清理失败时记录与摘要一致性。 +- 本地 Windows 对相关检查通过；Linux 专属符号链接与 worker/进程检查在 Linux 补齐，未把平台跳过当成通过。 +- 真实浏览器完成上传、新版本、版本切换、只读源码、运行、日志、JSON 预览；390px 视口没有横向溢出。最终入口验证无浏览器 JavaScript 错误。 +- 错误 Origin 和缺少修改请求专用头均返回 403；生产不信任转发 IP 或身份头。 +- SQLite `PRAGMA integrity_check` 返回 `ok`。17:59 执行器在线，活动任务 0，本项目临时容器 0、tmpfs 挂载残留 0，共保留 10 条运行记录。 + +## 现场执行记录 + +| 场景 | 运行编号 | 实际结果 | +|---|---|---| +| 最初容器启动验证 | 45def157885d4228bb9c0fc8480dda00 | Docker 日志轮转 max-file=1 与压缩不兼容，脚本未启动；改为 2 后验证通过。保留失败记录。 | +| 快速模拟成功 | 13caa662bf10489698b3d1bf4b567021 | succeeded，日志及 result.json 可见 | +| 脚本主动失败 | 794e00e7dc35437ba29191c229db595b | failed，退出码 2，符合预期 | +| 5 秒超时 | 3716cec9637143048220c6fe7b16abab | timed_out，测试容器清理 | +| 运行中取消 | 92b38203e0cd42e3a585c8eb4f09c614 | cancelled | +| 排队取消 | c2eafe168c09444e96f800fd1094e3e1 | cancelled，未启动脚本 | +| 网页上传版本 2 | 8607ca8f5511498ca041b65ebfd4223d | succeeded，标准输出、application.log、result.json 可见；仅模拟数据 | +| worker 意外退出 | bffd569a881d43d5a2e87fdef04c40b6 | interrupted；恢复后无任务容器/挂载残留，未补跑 | +| 原始轻量模型检查 | fddc3dd84d36403cb8083c3303220ce7 | succeeded，真实请求见下 | +| 正式入口最终快速验证 | 76478f6925d34c4eb3d3b613c558946a | succeeded，运行状态与下载摘要一致 | + +失败、超时、取消和中断记录是有意验证的不同路径，除了最初已修复的容器配置错误，不应当作未解决的产品故障，也不作为模型质量统计。 + +## 一轮真实模型检查 + +使用复制的原始 smoke.sh，SHA-256 为 `be858e914d87454240791da773578cb3f80f380e740f919546db347b7715a13d`。原位置文件、本地副本与运行摘要相同。 + +一次模型列表 GET 和三个顺序问答 POST 全部 HTTP 200，没有重试或重定向。三个回答 `finish_reason=stop`，completion_tokens 分别为 99、100、300（合计 499）；每次仍保留原脚本 max_tokens=512。算术问题返回 97,406,784，日志和完整响应报告 `smoke-response.json` 已在控制台查看。 + +本次只证明接口与控制台执行/记录链路可用，不是全面的回答质量、代码正确性、多卡性能或并发压力验收。没有执行模型返回的 Fibonacci 代码。 + +## 共享资源与恢复 + +`dengyuyun-joy-dsv41-trial` 的容器 ID 始终为 `114ceebc787845e45e1abcb0a46ac962529c28a4b865894cd3581234cd729e1a`，StartedAt 仍为 `2026-10-12T05:29:36.607636623Z`、RestartCount=0。未改原脚本、原目录权限、模型服务配置或 GPU 分配；仅向已运行的模型发出上述少量推理请求。 + +17:59 GPU 0–7 仍由既有模型占用，GPU 8–15 显存为 0；GPU 0–7 的显存快照相较 17:35 有变化，不能据此推断原因或声称整个共享服务器状态没有变化。本项目没有残留测试进程容器或额外模型服务。 + +正式网页镜像 `adamwen/script-console:20261013-1`，当前摘要 `sha256:7ba1cd10360271fad99975b599264a0c8a1d1458ae23a7b0f44387079aef9c3d`。基础 Python 镜像固定摘要，依赖版本固定。网页没有 Docker socket/GPU，根文件系统只读、capabilities 全部移除。 + +切换前已保存 `runtime/backups/before-dedicated-20261013/`，包含 SQLite 完整性检查通过的快照、library、runs 和切换元数据。旧容器和预览容器停止保留。实际故障回退/数据恢复未演练；操作步骤及必须保留快照后数据的限制见 [console-operations.md](console-operations.md)。 + +尚未接入多 GPU 分配、模型服务启停、通用依赖环境、更多原输出目录、个人账号、开机自启或自动清理。普通新上传脚本支持当前标准环境；原位置脚本需要确认配置和依赖后逐项启用。 + +## 改动与证据位置 + +主要改动为 `console/`、`tests/test_console*.py`、`deploy/console*`、`deploy/dedicated.py`、`deploy/cutover_console.py`、`scripts/console_example.py`、目录配置、README 和当前设计/操作文档。所有手写新增源码文件不超过 500 行。 + +本地浏览器证据保存在 `.local/evidence/console-browser.json`、`.local/evidence/final-console-browser.json` 和 `.local/screenshots/`；模型运行与幂等请求编号保存在 `.local/evidence/model-smoke-request.json`。服务器脱敏收尾证据为 `runtime/dedicated-acceptance.json`。这些运行材料均不进入 Git。 + +本项目仍没有提交历史，所有源代码未暂存、未提交、未推送。Git 仅配置了公司 origin，不自动拉取或部署。 diff --git a/docs/acceptance-lan-2026-10-13.md b/docs/acceptance-lan-2026-10-13.md new file mode 100644 index 0000000..f391f58 --- /dev/null +++ b/docs/acceptance-lan-2026-10-13.md @@ -0,0 +1,51 @@ +# 内网免登录验收 + +核对日期：2026-10-13（北京时间）。本记录对应用户最新的公司内网免登录要求，替代最初的回环网页登录方式。 + +## 结果 + +- 入口：http://10.88.118.188:14440/project/xas-test-library/jobs ，全新浏览器无需登录。 +- 允许网段为 10.88.0.0/17 和 10.20.0.0/21，来自服务器网卡与当前电脑路由现场核对。 +- 访客可读取本项目、运行/停止登记任务及查看历史。 +- 伪造管理员身份头、跨站 Origin/Fetch-Site、错误 Host 和令牌参数均返回 403。 +- 修改同一任务定义得到 Unauthorized，没有成功更新。 +- 宿主机直连容器 IP:4440 失败；后端没有宿主机端口映射。 +- 来自 Docker 网桥的请求即使伪造办公网 X-Forwarded-For，仍被代理拒绝 403。 + +## 行为与浏览器 + +Linux 完整回归 14/14 通过，4.101 秒；Windows 10 通过、4 项平台相关跳过。 + +真实内网浏览器点击运行创建执行 7，身份为 xas-intranet，于北京时间 12:11:21～12:11:23 成功完成。浏览器核对 Succeeded 状态、三条进度日志及结构化结果。历史 API 返回 7 条记录，原 1～6 记录保留。未调用模型或使用 GPU。 + +截图：[免登录任务页](images/lan-jobs.png)、[执行日志](images/lan-logs.png)。 + +浏览器辅助 API 客户端携带会话 Cookie 时得到 404，而无 Cookie、明确 JSON 响应的直接查询返回真实记录。生命周期通过独立 HTTP 查询核验，浏览器核验真实页面、CSS 状态和日志，没有因验收工具问题重复提交任务。 + +## 隔离与原服务 + +12:11 只读核对：原 dengyuyun-joy-dsv41-trial 容器 ID、2026-10-12 的启动时间和 RestartCount=0 均不变；VLLM::Worker_TP0～TP7 的 PID 仍为 1578853～1578860。未修改其工作区、模型、容器或 GPU 任务。 + +后端镜像 ID：sha256:6b694273a33c449829f7dc5a777cb2b09c2df630c70035c45956673fa35953d9。 +代理摘要：sha256:0985e772fb9f729e6fa0980da05fca5d9c468e870eed43071545afa9d2e27d94，实际 nginx/1.30.5。 + +后端上限 2 CPU/2 GiB，无 GPU；代理上限 0.25 CPU/64 MiB。只对指定内网 IP 发布 14440，没有修改系统防火墙。 + +## 审查与修复 + +独立审查指出后端不发布端口仍能被宿主机直连伪造角色。新增 Docker 边界回归先失败，再改成共享命名空间和后端回环；现场 TCP 检查确认直连被阻断。 + +首次代理检查因默认临时目录与只读根文件系统冲突失败，指定 tmpfs 临时路径后 nginx -t 通过。当前电脑来源 10.20.1.3 最初被服务器网段名单拒绝，核对本地 /21 路由后加入对应办公网。历史所需 event/read 权限经 403→200 验证补齐，未增加管理权限。 + +## 备份与恢复 + +备份目录：/adamwen-work-space/xas-test-library/runtime/backups/before-lan-20261013/。 + +- source/：切换前源码与配置。 +- runtime-before-lan.tar.gz：旧预览停止后生成的数据库、日志、结果与配置快照。 +- metadata.json：旧容器、镜像与快照关联信息。 +- 旧容器 adamwen-test-console-before-lan-20261013 保持停止状态。 + +应用回退只停止本项目新后端与代理，保留当前数据，再恢复旧配置和旧容器名称。两版均为 Rundeck 6.2.1，本轮未改变数据库格式。恢复旧数据库快照需要单独确认，会移除快照之后的记录，不能默认执行。 + +未配置自启、定时备份或自动清理。正式 GPU 长测尚未接入。公司远程 Git 仓库待后续接入，未提交或推送。 diff --git a/docs/acceptance-native-2026-10-13.md b/docs/acceptance-native-2026-10-13.md new file mode 100644 index 0000000..4fb453e --- /dev/null +++ b/docs/acceptance-native-2026-10-13.md @@ -0,0 +1,68 @@ +# 原环境执行接入验收 + +核对日期：2026-10-13 23:37（北京时间）。用户已授权开放原测试，包括显示影响并逐次确认的资源/服务操作；本轮验收没有实际启动原 GPU、模型切换或长稳测试。 + +## 已交付行为 + +- 正式入口仍为 `http://10.88.118.188:14440/#/scripts`。23 项业务测试中，22 项原位置入口使用登记的原目录、解释器、配置、依赖和参数，复制版轻量检查保持既有容器模式。 +- 详情显示只读执行方案、账号、目录、解释器和影响；只开放方案声明的参数及最长 72 小时时限。原入口和相关文件只读，上传脚本继续容器隔离。 +- 普通原环境测试预检通过后排队；资源/服务测试必须每次确认。源码、依赖配置、方案或参数变化时旧确认失效。预检只检查路径、工具、摘要和本机 TCP 端口，不发推理、不启动模型、不预留 GPU。 +- 独立 systemd 服务运行原入口，页面接收标准输出、错误、登记的文件日志和归档结果。菜单支持数字选项/列表、y/n/q、回车，关闭回显，不保存输入历史。 +- worker 重启后继续跟踪同一次原环境任务；取消和超时等待本次本机进程收尾。Docker/tmux 分离任务和模型恢复需根据日志及资源变化核对，控制台不自动删除他人资源。 + +## 验证证据 + +| 验证层级 | 本轮结果 | +|---|---| +| Linux 自动回归 | 55/55 通过，包含参数/来源限制、确认失效、取消竞态、状态未知保留占位、凭据跨块/ANSI 脱敏、控制终端、300 个旧日志不遮蔽新日志 | +| 真实 systemd 短进程 | 6/6 通过：成功、失败、超时、取消、交互、worker 重关联；仅独立样例，不调用模型/GPU | +| 配置迁移 | 生产库隔离副本迁移 22 项、再次迁移幂等、逐条恢复后内容完全一致；runs/versions 不变 | +| 已部署 API | 22 项原环境预检可调用；23 项业务目录、10 条旧运行、0 活动任务，worker 在线 | +| 真实浏览器 | 1440px/390px 方案显示、72 小时上限、只读目录、逐次确认/取消、缺失端口拦截、返回及历史记录通过；无 JS 错误、无横向溢出、运行提交 0 次 | +| 原项目保护 | 307 个原脚本 SHA-256 与升级前一致，10 条 runs 完整摘要一致；原模型容器 ID/StartedAt 不变、RestartCount=0 | + +测试依赖产生既有 Starlette/httpx 弃用提示，不影响通过结果；本轮未升级依赖。 + +最终短进程证据在服务器 `runtime/native-final-validation-20261013/acceptance.json`，隔离于生产运行记录： + +| 场景 | 运行编号 | 结果 | +|---|---|---| +| 正常退出 | eae879ee835c4b99948b48fdbeaa28da | succeeded / 0 | +| 非零退出 | 6abb4c53215f4dcfa221aee43b4c4e0d | failed / 7 | +| 时限到期 | e6e5142ccb7c411d9d6cfb34d21fb298 | timed_out / -15 | +| 主动取消 | f5413e5e37144eb0bbfaf2651768273c | cancelled / -15 | +| 菜单与控制终端 | f3dd72ef551e4f6c933a0e4af2f0d4fd | succeeded / 0 | +| 同一服务重新跟踪 | bdb9fe7cd24a457aa79c2e7732778964 | succeeded / 0，未重放 | + +已核验超时/取消子进程消失、假凭据不出现在平台日志及归档、菜单输入不回显、实际命令无运行编号占位、原样例文件摘要不变。完整模型业务的指标、质量及长稳效果仍未验收，页面保留提示。 + +## 原模型服务条件 + +23:27 的只读预检，22 项中 16 项满足登记条件；以下 6 项的原服务未监听，自动拦截。此快照不是永久可用性保证，真正点击运行时重新预检。 + +| 方案编号 | 缺失原端口 | +|---|---| +| deepseek-suite | 18101 | +| throughput | 18106 | +| replicas | 18110–18117 | +| engine-comparison | 18106 | +| model-suite | 18106 | +| soak | 18106 | + +这些入口已完成方案接入；准备好对应原服务后才能执行。未改为调用其他端口，也未擅自补启动命令。 + +## 发布与恢复 + +最终网页镜像 `adamwen/script-console:20261013-5`，摘要 `sha256:05ad7a7a332a1e26eaeebff790e53c16318e547d3ad936e67aee6ff11acd1710`。仅更新本项目网页和空闲 worker，访问网段、无账号安排、模型服务与 GPU 分配未改变。原环境宿主代码与网页方案来自当前同一项目目录；每次运行记录源码和计划摘要，Git 不参与运行时拉取。 + +升级前备份为 `runtime/backups/before-native-20261013/`，含旧源码、SQLite、原文件摘要与服务状态。配置迁移清单 `native-config-migration.json` 记录 22 项 before/after；数据库仍 schema v1。旧网页停止保留为 `adamwen-script-console-before-native-20261013`，首次接入镜像也保留为 `adamwen-script-console-native-initial-20261013`。 + +回退须停止接单、确认无活动 native unit 和排队/运行任务，再停 worker；使用迁移工具逐条恢复旧配置，核对并恢复匹配的旧 worker 源码，恢复旧网页后启动 worker。配置已发生后续变化时工具拒绝覆盖。保留新运行记录及所有结果，不能直接用旧 SQLite 覆盖。配置恢复已在隔离副本验证，生产故障回退未触发。 + +服务器证据：`runtime/native-deployment-acceptance.json`、`runtime/native-release-precheck.json`。本地浏览器证据：`.local/evidence/native-browser.json`、`.local/screenshots/native-*.png`。早期部署记录保留各自时点，不代表当前状态。 + +## 变更范围 + +核心新增 `console/native_{plans,io,rpc,files,job,executor}.py`、`console/static/native-ui.js`、`catalog/native-profiles.json`、`deploy/native_profiles.py`、3 个原环境测试文件及 ADR 0004。配套修改 API、目录描述、存储、worker、日志归档、运行/详情页面、部署镜像和维护文档。新手写文件均小于 500 行。 + +未暂存、提交、打标签或推送 Git。当前仓库尚无提交，所有实现继续留待用户审阅；运行数据、凭据和本机辅助证据不进入 Git。 diff --git a/docs/adr/0001-intranet-access.md b/docs/adr/0001-intranet-access.md new file mode 100644 index 0000000..f72824a --- /dev/null +++ b/docs/adr/0001-intranet-access.md @@ -0,0 +1,13 @@ +# ADR 0001：内网免登录入口与固定操作权限 + +日期：2026-10-13。状态：已实施。 + +用户选择公司内网少数人使用、暂不设置账号。采用 Nginx 来源网段限制和固定操作身份，保留 Rundeck 服务端授权。任务维护继续通过受控源码和服务器维护流程完成。 + +仅不发布后端端口，宿主机仍可连接容器 IP 并伪造预认证角色。实际将后端与代理放入同一本项目网络命名空间，后端只监听其回环；代理覆盖所有受信身份头。宿主机 root / Docker 管理者处于信任边界内。 + +共享 xas-intranet 身份的代价是无法确定具体操作人。日志只保留来源 IP、方法、路径、状态与大小，不记录查询参数或会话信息。允许网段来自现场网络配置，不开放整个私有地址空间。 + +以后需要逐人权限或审计时，再将固定身份替换为真实认证；当前不提前建设账号系统。 + +依据：[Rundeck 预认证](https://docs.rundeck.com/docs/administration/security/authentication.html#preauthenticated-mode-using-headers)、[Docker 端口边界](https://docs.docker.com/engine/network/port-publishing/)、[Nginx 访问控制](https://nginx.org/en/docs/http/ngx_http_access_module.html)。 diff --git a/docs/adr/0002-dedicated-console.md b/docs/adr/0002-dedicated-console.md new file mode 100644 index 0000000..ba86af9 --- /dev/null +++ b/docs/adr/0002-dedicated-console.md @@ -0,0 +1,21 @@ +# ADR 0002：使用专用脚本管理控制台 + +日期：2026-10-13；状态：按用户确认方案实施，替代 Rundeck 作为日常入口。 + +## 原因 + +用户需要直接上传脚本、查看只读代码、上传新版本、配置执行参数，并在同一页面看到日志、结果和历史。Rundeck 的任务编辑/导入模型与这里的脚本文件管理存在额外映射，继续叠加集成会增加维护成本。 + +## 决策 + +网页/API 使用 FastAPI，SQLite 保存元数据与状态，文件系统保存不可变上传版本、日志和结果。数据库 `user_version=1` 为新控制台独立结构，不改写旧 H2。Git 保留应用源代码，不作为每次运行的自动拉取来源。 + +共享队列单并发，独立宿主 worker 拥有 Docker 管理能力，但没有网络监听入口。网页和任务容器没有 Docker socket、GPU、宿主 PID 或设备。网页需读取原目录的 root/0700 文件，使用容器 UID 0、移除全部 capabilities、只读根文件系统和来源挂载；不改变原目录属主或权限。网页仅绑定内网 IP，通过真实 peer IP、Host、Origin 和自定义请求头限制访问，不信任转发身份/IP头。 + +上传代码仍是不可信输入。任务放入受限容器；临时结果目录是宿主项目路径下的 128 MiB tmpfs，归档后卸载。允许的原输出目录可写，原文件不清理；其增长采用运行时软限制，不能当成文件系统硬配额。特定旧脚本认证仅存在专用代理进程内存中，stdin 注入，不修改原脚本或复制认证文件。 + +## 兼容和退出条件 + +旧容器、H2、日志和备份保留，但旧记录不转换或混入 SQLite。14440 上 `/project/xas-test-library/*` 的浏览器书签跳转到新脚本库；仅为已经发给用户的公开页面链接保留，在团队更新书签后可以移除。没有保留旧 API 或双写路径。 + +后续接入 GPU、服务管理脚本、额外依赖、更多输出目录或鉴权，需要单独明确资源和权限范围。当前服务不自动安装依赖，也不从任务容器停止其他维护者服务。 diff --git a/docs/adr/0003-test-behavior-catalog.md b/docs/adr/0003-test-behavior-catalog.md new file mode 100644 index 0000000..636b02c --- /dev/null +++ b/docs/adr/0003-test-behavior-catalog.md @@ -0,0 +1,29 @@ +# ADR 0003：按实际测试行为组织目录 + +日期：2026-10-13。依据用户明确要求：一个测试为一项，一套测试的内部文件不再平铺。 + +## 调整原因与领域边界 + +原目录将递归发现的 .py/.sh 文件当成测试项目，307 个原位置文件中含辅助模块、套件自身验证、服务管理和历史场景脚本。扩展名只能识别源码文件，不能证明它是一项独立测试。 + +现在分为“文件清单”和“测试入口清单”：文件清单保留源码定位、摘要及版本；`catalog/test-definitions.json` 根据实际 README、脚本用途和调用关系，登记测试名称、执行入口、套件/单项类型及相关文件。公开目录和首页数量均来自测试入口清单；扫描新文件不会自动新增测试项目。用户主动上传的单入口脚本仍作为新测试登记。 + +本次整理 22 个现有测试入口，加上已接入的轻量模型检查，共 23 项业务测试；其中 8 项套件、15 项单项测试。两个本控制台验收样例默认隐藏，可通过“项目用途 → 验收示例”查看。公司 GPU 套件的 224 个文件归到统一入口，其 148 个内部验证文件不再进入主列表。同类测试的不同来源实现归入相关文件，不因为源文件数量增加重复卡片。 + +同一个文件既可以是套件的组成部分，也可以在确有独立测试用途时作为单项入口；这体现不同的测试行为，不为每个辅助文件建立入口。总入口与相应完整测试流程维持原样，不在本轮拼接、改写或实际运行测试链。 + +## 数据与执行不变量 + +- 原 SQLite schema v1、脚本/版本/运行 ID、历史名称和结果文件均保留。本轮不做数据库结构迁移、回填或历史重写。 +- 目录是对现有记录的只读整理。第一次显示使用清单中的业务名称；用户保存后的名称/说明优先。后续运行记录保存对应测试名称，执行仍只有原始入口文件。 +- 详情增加相关文件只读查看；内部文件不能通过旧详情链接或直接 API 被配置/启用/运行。现有记录查询、日志、结果下载与取消仍按原运行 ID 工作。 +- 未开启 GPU 或服务管理能力；未就绪项目保持待配置。清单不是执行授权，不能据此运行历史脚本中的启停或整机测试步骤。 +- 所有上传版本和原文件仍按原路径保存，没有批量复制、合并或删除。 + +## API 与维护方式 + +`GET /api/scripts` 现返回业务测试入口，`include_examples=true` 包含验收示例。原路径保留，条目增加 is_test/test_kind/category/file_count；`GET /api/scripts/{id}/files` 提供只读相关文件。`GET /api/scripts/{id}` 仍可读取内部文件，但 is_test=false；这类文件的修改/运行 API 明确拒绝。summary.scripts/ready 统计业务测试，新增 source_files/examples 说明其他数量。 + +维护者新增已有套件时，应先核对真实执行入口与测试目的，再编辑测试入口清单和相关文件映射。不能按目录名、所有 .py 文件或自动 import 扫描结果直接推断测试项目。新来源和新执行环境仍沿用原有权限与部署流程。 + +升级采用新镜像替换网页容器，私有 worker 与模型服务不重启。更新前备份原源码、镜像信息、SQLite，并记录历史/源文件摘要；验证失败恢复原网页容器，不回写备份数据库。旧版本可继续读取原 schema v1，应用回退无需数据恢复；数据快照恢复仍须单独确认并保留快照后记录。 diff --git a/docs/adr/0004-native-execution.md b/docs/adr/0004-native-execution.md new file mode 100644 index 0000000..67a10d1 --- /dev/null +++ b/docs/adr/0004-native-execution.md @@ -0,0 +1,25 @@ +# ADR 0004：可信原入口复用原环境，上传脚本保持隔离 + +日期：2026-10-13；状态：按用户明确授权实施。补充 ADR 0002 的执行边界。 + +## 目标与决策 + +现有测试依赖宿主 Python、原模型配置、Docker 和交互菜单，统一放进轻量容器无法保持原行为。网页登记固定原入口，参数只允许方案声明的类型和范围；不改原脚本、原配置或素材。`catalog/native-profiles.json` 是管理员维护的可信方案，上传代码不能使用宿主模式。 + +网页只负责展示、参数配置、逐次影响确认和记录。宿主 worker 通过私有 0600 Unix socket 校验入口、来源摘要、参数、计划摘要与确认，创建 `adamwen-native-.service`。网页没有 Docker socket 或任意命令入口，既有 LAN 访问范围与无账号安排不变。 + +服务独立于 HTTP 连接和 worker 生命周期。worker 重启后关联同一服务；未确认结束时保留队列占位，不自动补跑。超时/取消等待本次 cgroup 收尾后释放占位。Docker daemon 或 tmux 分离任务需要另行核对；前后资源快照只是变化证据，不能据此自动删容器或声明恢复模型。当前控制台单并发不能阻止维护者在控制台之外同时运行任务。 + +菜单以有控制终端的 PTY 运行，关闭回显，只接收数字选项/列表、y/n/q、空行。禁止控制键和任意命令，避免菜单通道变成宿主终端。需要其他输入的高级维护操作不在本控制台范围内。 + +秘密仅在宿主内存读取；标准输出、文件日志及文本归档按已知秘密流式脱敏。输出保留在原处，平台归档新增/变更文件；固定文件名会覆盖历史的容量/成本方案先做本项目私有备份。保留采集/归档上限并显示未归档原因，不把归档当成整个原工作区备份。 + +## 数据迁移与恢复 + +SQLite 保持 schema v1，仅增加 JSON 配置和运行快照字段。`deploy/native_profiles.py` 对已有 22 个入口做单事务配置迁移，保留 ID、versions 和 runs；拒绝活动任务或并发配置变化。先备份 SQLite 和旧源码，再执行；逐条 before/after 保存在私有迁移清单。隔离生产库副本已验证迁移、幂等及精确配置恢复，历史记录不改变。 + +回退必须先停止接单并确认无排队/运行中的 native 服务，再停止 worker，按迁移清单恢复配置以及匹配的旧 worker 源码和网页镜像。若配置有后续修改，恢复工具拒绝覆盖，须人工核对。新运行历史和结果继续保留；应用回退不恢复旧数据库。不可让旧 worker 处理仍活动的新模式任务。 + +## 验证范围 + +方案接入、只读预检、参数/权限边界、模拟及真实短进程生命周期已验证。原项目的 GPU、长稳和模型切换业务不在本轮实际运行，页面如实提示。后续只有在用户实际发起并确认相应影响时才执行原项目测试。 diff --git a/docs/console-operations.md b/docs/console-operations.md new file mode 100644 index 0000000..93dd51d --- /dev/null +++ b/docs/console-operations.md @@ -0,0 +1,67 @@ +# 当前控制台操作与维护 + +核对日期：2026-10-13。当前源代码入口为本项目 `console/`；部署根为 `/adamwen-work-space/xas-test-library`。历史 Rundeck 文档不再是日常维护入口。 + +## 日常使用 + +内网入口 `http://10.88.118.188:14440/`，不设置账号。允许 `10.88.0.0/17` 和 `10.20.0.0/21`。所有访问者共享管理与执行权限，运行记录保存来源 IP，不区分个人身份。 + +1. 在测试项目中按用途、套件/单项、来源和状态筛选。一项对应一个测试行为，详情的“执行入口”和“相关文件”均只读。 +2. 上传 `.py` 或 `.sh` 创建托管脚本；修改时上传新版本，旧版本保留。只接受 UTF-8，单文件最大 1 MiB。素材、模型、第三方包不会随脚本自动取得。 +3. 在详情修改名称、说明、已开放的参数和超时，再保存并运行。22 项已登记原入口使用原环境方案，工作目录、解释器、命令模板和输出规则只读。普通测试预检通过后提交；涉及资源占用或服务启停的测试须逐次确认影响。 +4. 运行页查看持续刷新的标准输出/错误与文件日志，结束后预览/下载 JSON、文本或其他报告。历史保留本次配置、版本和摘要。 + +托管脚本工作目录为本次独立 `/work`，通过 `XAS_RUN_DIR` 环境变量取得它；将输出写到此目录即可归档，其中 `.log` 的新增内容会进入实时日志。原环境测试直接使用原文件、目录、依赖和已登记配置，不修改原代码。原输出照常产生，平台仅归档本次观察到的新增/变更内容；多人同时写同一原文件时无法证明内容只来自本次测试。容量和成本链路会覆盖固定文件名，启动前把已存在的相关输出备份到本次 `previous-outputs/`；其他方案优先采用原入口支持的运行编号参数。 + +现有 307 个 `.py`/`.sh` 文件包括入口和辅助模块，按已核对的用途整理为 23 个测试项目，不再全部平铺。22 个原环境入口和已有复制版轻量检查已配置；两个控制台样例在“项目用途 → 验收示例”查看。相关文件不能单独启用或运行。原环境复用宿主环境，上传脚本继续使用 Python 标准库、Bash、curl 的受限容器，无 GPU；不自动安装依赖或启动缺失模型服务。 + +“已配置”表示有启动方案，不表示服务已在线或测试已通过。运行前只读预检核对入口摘要、原配置、工具、素材及所需 TCP 端口，不发模型推理、不预留 GPU。2026-10-13 23:27 有 6 项因原模型端口未监听被拦截。整机/服务测试的影响确认只对本次源码、参数和方案有效。长稳测试最高 72 小时；原菜单支持数字选项/列表、y/n/q、空行回车，输入不回显、不保存。不能通过菜单发送 shell 命令、控制键、密码或令牌。 + +“DeepSeek V4.1 轻量功能检查（已复制）”使用原始 smoke.sh，源码摘要固定，兼容环境不可在网页修改。一次最多 1 个 models GET 和 3 个 completion POST，固定模型、最多 512 token/问答；禁止重定向和重试。新代码不能直接沿用这个认证环境，应新建脚本后接入。 + +## 数据与配额 + +| 内容 | 服务器位置 | +|---|---| +| 数据库 | runtime/console-data/console.sqlite3 | +| 上传脚本版本 | runtime/library/<脚本ID>/versions/<版本>/<文件名> | +| 运行日志 | runtime/runs/<运行ID>/console.log | +| 运行结果/源码快照 | runtime/runs/<运行ID>/artifacts/，下载名称由数据库映射 | +| 容器临时文件 | runtime/runs/<运行ID>/work，128 MiB tmpfs，归档后卸载 | +| 原环境运行与输出保护 | runtime/runs/<运行ID>/，原输出仍在原目录，固定名称旧结果另存 previous-outputs/ | +| 原环境私有控制通道 | runtime/native-ipc/control.sock，0600，仅本机网页/worker 使用 | +| 切换前快照 | runtime/backups/before-dedicated-20261013/ | + +数据库没有保存完整脚本、完整日志或完整报告正文。容器任务有单文件源码快照；原环境任务保留源文件摘要、实际命令与方案快照，源文件留在原处。外部结果原文件保留，同时归档本次变化内容用于历史查询。历史归档不会因原文件下次覆盖而变化。 + +共享队列单并发、最多排队 20 项。容器任务限制 1 CPU、512 MiB、64 进程，时限 5–7200 秒；原环境任务不套用这些 CPU/内存限额，时限 5 秒至 72 小时，真实资源占用遵循原项目。平台日志最大 16 MiB；结果单文件最大 32 MiB、总归档约 64 MiB、最多 63 个文件另加摘要。原环境登记输出最多 4096 文件，超过时明确失败，不静默遍历整个磁盘。 + +超过归档限制的原位置文件保留；容器未归档临时结果随 tmpfs 释放，原环境工作目录保留。容器运行检查磁盘 10 GiB 下限及原输出增长 128 MiB 软限制；原环境不施加该增长限制，以免改变长稳行为。固定旧输出备份上限 64 GiB，且要求备份后仍有 10 GiB 余量。原环境对原目录没有硬配额，操作者需按原测试规模安排磁盘与 GPU。 + +容器任务取消/超时只管理本项目容器，worker 重启时旧容器任务标为中断、不补跑。原环境任务由独立 systemd 服务承载，worker 重启后继续跟踪同一任务；状态查询异常时保留占位，不误判结束。取消/超时终止本次本机进程，最多留 120 秒收尾，然后确认 cgroup 已结束再释放队列。 + +原脚本通过 Docker daemon 或 tmux 启动的分离任务可能继续运行，取消不等于恢复原模型，也不保证远端推理已停止。日志和结果保留前后资源变化供核对；控制台不据此自动删除容器或他人会话。正常菜单退出后如观察到新增 tmux 会话，继续跟踪其结束。退出码零仅表示入口进程正常退出，业务结论以报告为准。 + +## 部署与恢复 + +网页容器 `adamwen-script-console`；私有执行器 `adamwen-script-worker.service`；容器任务前缀 `adamwen-test-run-`；原环境服务前缀 `adamwen-native-`。初次部署使用 `deploy/dedicated.py`。`deploy/cutover_console.py` 是历史 Rundeck 切换工具，不适用于本次原环境升级。原环境方案由 `catalog/native-profiles.json` 管理，配置迁移使用 `deploy/native_profiles.py`；禁止在网页上传内容中定义宿主方案。 + +当前没有设置开机自启、定时任务或自动清理。整机重启后，按 00088 操作手册连接，核对共享资源，再启动本项目网页容器与 worker。日常可读检查 `docker logs --tail 100 adamwen-script-console`、`systemctl status adamwen-script-worker.service` 和运行摘要；不要输出模型认证文件。worker 配置只记录认证文件位置，秘密仅在内存中读取。 + +本次应用回退：先停止网页接单，确认无排队/运行任务及活动 native unit，再停止 worker。用 `deploy/native_profiles.py --restore --backup runtime/backups/before-native-20261013/native-config-migration.json` 恢复 22 项旧配置；有后续修改则工具拒绝覆盖，先核对。恢复匹配的旧 worker 源码以及保留的 `adamwen-script-console-before-native-20261013` 网页容器，再启动 worker。保留新运行记录与结果，不覆盖 SQLite；旧代码不能处理活动 native 任务。具体版本、备份与验证见原环境验收记录。回到更早 Rundeck/H2 是另一种迁移，不作为本轮普通回退路径。 + +数据恢复须另行明确：停止新网页/worker，保留故障数据副本，检查 SQLite 快照 `PRAGMA integrity_check`，将匹配时点的数据库、library、runs 作为一组恢复，验证文件摘要与引用。不能只覆盖数据库，不能自动丢弃快照后的运行。当前仅初始 schema v1，未来结构变更需新增可审查迁移，不改已执行历史迁移。 + +## 本地验证与源码管理 + +Python 3.12 隔离环境安装 `console/requirements-test.txt`，执行 `python -m unittest discover -s tests -v`。Linux 检查涵盖进程组、符号链接和 worker 收尾，Windows 会明确跳过不适用项。依赖已固定版本，网页无外部 CDN。 + +Git 远程为公司仓库 `https://code.it.aisuan.cn/wenhuadian/xas-test-library`，主分支 `main`。用户于 2026-10-14 明确授权首次提交和推送，后续 Git 历史操作仍需当前对话中的明确指令。`.local/`、`runtime/`、认证材料和服务器私有 worker 配置不进 Git；Git 不会自动拉取上传脚本或发布应用。原位置脚本按服务器路径引用，本仓库不是其他工作区的完整备份。 + +## 历史阶段：2026-10-13 20:25 导航与点击区域优化 + +项目详情顶部提供“返回测试项目”，运行详情提供“返回运行记录”；加载和错误页面同样可返回，长页面滚动时返回按钮保持可见。项目整张卡片和运行记录整行均为可点击入口；详情按钮至少 46px 高，返回按钮至少 44px 高，保留原生链接和键盘 Enter 操作。 + +修改限定于 `console/static/scripts.js`、`runs.js`、`styles.css` 及部署镜像引用。正式镜像为 `adamwen/script-console:20261013-3`，摘要 `sha256:62424bf4b9c34c986cc6831b8fc083e821fa78bbd5da8fbf89a1d9e897acd7fe`。1440px 和 390px 真实浏览器验证整卡/整行点击、返回、滚动、键盘及错误状态通过，没有页面横向溢出或 JavaScript 错误。 + +本轮未执行测试脚本或调用模型。历史记录仍为 10 条；scripts/versions/runs 数据摘要与更新前一致，worker PID 与原模型容器启动状态未改变。备份在 `runtime/backups/before-ui-navigation-20261013/`，旧网页容器 `adamwen-script-console-before-navigation-20261013` 停止保留。回退只需替换网页，不覆盖数据库或重启 worker；未实际触发回退。证据位于本地 `.local/evidence/navigation-browser.json` 和服务器 `runtime/navigation-acceptance.json`。 diff --git a/docs/console-plan.md b/docs/console-plan.md new file mode 100644 index 0000000..7751423 --- /dev/null +++ b/docs/console-plan.md @@ -0,0 +1,52 @@ +# 专用测试控制台实施方案 + +> 2026-10-13 目录展示已按用户后续确认改为“一项测试行为一个项目”，内部文件不平铺；清单与接口补充见 [ADR 0003](adr/0003-test-behavior-catalog.md)。本文其余存储和执行边界继续适用。 + +日期：2026-10-13。本文是当前维护入口，覆盖此前 Rundeck 方案的产品范围；历史验收记录继续保留。 + +## 已确认的行为 + +- 公司内网免登录；只读查看脚本代码，上传创建新脚本或不可变的新版本。 +- 登记三个已知测试目录内的 Python/Shell 脚本，不批量复制源文件。原脚本保持原位置、参数与工作目录。危险的服务管理脚本仅登记待配置。 +- 允许已登记测试按原逻辑写入原日志/结果目录；不修改源文件，不授权停止他人的模型服务。 +- 每次运行有独立记录、实时标准输出/错误、退出状态、源文件摘要和结果文件。文件型日志需登记路径才会采集。历史结果有独立归档，不覆盖原文件。 +- 数据库存元数据与状态，源文件/完整日志/报告存在文件系统，不把文件正文重复塞进数据库。 +- 上传目录 runtime/library/<脚本ID>/versions/<版本>/；运行目录 runtime/runs/<运行ID>/。 +- Git 管理控制台源码和部署配置，不在每次运行时拉取。没有提交、标签或推送授权。 + +## 架构与信任边界 + +FastAPI 提供网页/API，SQLite WAL 保存目录与队列；网页容器没有 Docker socket 或 GPU。独立宿主执行器处理单并发队列，启动有固定标签、限定资源、无 Docker socket 的临时容器。可配置的工作目录和输出路径必须位于已登记的来源目录，上传脚本只能写本次结果目录。源文件挂载只读，只有明确登记的输出目录可写。 + +所有内网用户共享权限，可上传和运行自己的代码，因此信任边界是允许访问的两个公司网段。执行容器限制宿主文件与设备，不能作为抵御恶意内网用户的完整安全平台。API 校验 Host、Origin、来源网段和专用请求头，拒绝跨站修改；不接收任意 shell 命令、环境变量、镜像或宿主挂载。 + +运行记录固定版本、配置快照与源码摘要；排队后原文件变动则拒绝执行。超时/取消只终止本次容器，不宣称远端模型推理已取消。执行器重启时只恢复/终止本项目标签容器，不自动补跑。日志、上传、结果大小与执行时长有上限。业务判定只在脚本提供明确报告时呈现；退出零只表示进程正常结束。 + +旧 smoke.sh 缺少当前服务要求的认证。为保留原代码，在其运行容器中放置仅服务本次进程的回环代理：凭据经 stdin 传递、只保留内存，固定上游地址、模型、1 次 models 与 3 次 completion，不重试。真实验收最多一轮，保留失败和截断输出。 + +## 实施和验收 + +1. 固定 API，先测试版本不可覆盖、目录边界、排队幂等与单并发、日志游标、归档和取消。 +2. 实现目录/上传/代码只读、历史、实时日志、文件下载；快速样例验证成功、失败、取消和结果。 +3. 只读扫描已知来源，配置一个轻量既有脚本。新端口 14442 并行部署，旧入口 14440 暂保留。 +4. 浏览器贯通上传、新版本、运行、日志、结果和历史；在模型服务仍正常的条件下执行一次有界 smoke。 +5. 验收后切换 14440 的项目入口，保留旧容器/数据和明确回退路径。未通过则保留新预览并如实报告。 + +## 前后端接口契约 v1 + +JSON 错误 `{detail: string}`。修改请求必须含 `X-XAS-Console: 1`。所有时间为 UTC ISO。 + +- GET `/api/summary`: `{scripts, ready, runs, active, worker:{online,last_seen}, storage:{run_bytes}, limits:{...}}` +- GET `/api/scripts`: `{items:[Script]}`；GET `/api/scripts/{id}`: Script（含 versions） +- Script: `{id,name,description,kind:'managed'|'external',language:'python'|'shell',source_path,source_group,status:'ready'|'needs_configuration'|'missing',enabled,reason,version,sha256,updated_at,config:{args:[],cwd:'',output_paths:[],timeout_seconds:300,profile:'standard'|'legacy_smoke'},versions:[{version,sha256,created_at,filename}]}` +- GET `/api/scripts/{id}/code?version=`: `{code,filename,sha256,truncated,redacted}`；GET `/api/scripts/{id}/download?version=` 返回只读源文件（含秘密的文件拒绝下载） +- POST `/api/scripts/upload`: multipart `file`, `name`, `description`（新建）；POST `/api/scripts/{id}/versions`: multipart `file`（仅 managed）；返回 Script。 +- PATCH `/api/scripts/{id}`: `{name?,description?,enabled?,config?:{args?,cwd?,output_paths?,timeout_seconds?}}`；不允许更新代码、profile、路径来源或版本。 +- POST `/api/discover`: 返回 `{registered,missing,total}`，仅扫描预设来源。 +- POST `/api/scripts/{id}/runs`: `{request_id:UUID}`，返回 Run；重复请求返回同一记录。运行采用当前登记配置和版本。 +- GET `/api/runs?script_id=&limit=100`: `{items:[Run]}`；GET `/api/runs/{id}`: Run。 +- Run: `{id,script_id,script_name,version,sha256,state:'queued'|'running'|'succeeded'|'failed'|'cancelled'|'timed_out'|'interrupted',created_at,started_at,finished_at,exit_code,message,config,artifacts:[{id,name,size,kind:'text'|'json'|'file'}],synthetic,source_ip}`。 +- POST `/api/runs/{id}/cancel`: 返回 Run；GET `/api/runs/{id}/log?offset=0`: `{text,next_offset,done,truncated}`。 +- GET `/api/runs/{id}/log/download`；GET `/api/runs/{id}/artifacts/{artifact_id}`（下载）；GET 同路径加 `/preview`: `{text,truncated}`。 + +网页无需外部 CDN。中文、清晰加载/空/错误状态，脚本列表筛选，详情页源码只读、配置编辑、版本上传、运行记录。运行页轮询日志与状态，取消只对进行中的任务显示。结果区展示文件列表、文本预览/下载。默认突出真实状态，不把模拟验收算作模型测评。 diff --git a/docs/design.md b/docs/design.md new file mode 100644 index 0000000..aceac57 --- /dev/null +++ b/docs/design.md @@ -0,0 +1,31 @@ +# XAS 测试控制台设计 + +> 历史方案：以下为 Rundeck 阶段记录，已被 [专用控制台方案](console-plan.md) 和 [当前操作说明](console-operations.md) 覆盖。不要按本文重新部署旧控制台。 + +更新日期：2026-10-13（北京时间）。用户先授权网页脚本库，随后明确要求公司内网少数人使用、暂不设置账号。最新要求覆盖初始回环网页登录方案。 + +## 目标与范围 + +Rundeck 提供任务列表、参数表单、日志和历史，源码准备为公司私有 Git 脚本库。当前只开放无 GPU 的轻量验收。现有公司套件与其他维护者脚本只登记来源，不移动、修改或开放执行。 + +## 访问与信任边界 + +入口为 10.88.118.188:14440，允许已核对的 10.88.0.0/17 服务器网和 10.20.0.0/21 办公网。Nginx 固定注入 xas-intranet 身份和 xas-operator 角色，覆盖外来身份头，拒绝跨站来源、错误 Host 和 API 令牌查询参数。 + +所有人共享执行身份，无法逐人审计；代理保留来源 IP。访客仅有本项目历史读取和已登记验收任务的 read/run/kill 权限，没有任务编辑、任意命令或系统管理权限。 + +仅隐藏后端端口不能阻止宿主机直连容器 IP。后端实际加入代理的专用网络命名空间，并只监听内部 127.0.0.1:4440；代理是唯一网络入口。宿主机 root / Docker 管理权限仍是信任边界。 + +## 执行与数据 + +运行器接受固定模式和参数，使用独占结果目录、源码 SHA-256、UTC 时间和结构化结果。模拟数据标识 synthetic=true。退出 0 但结果无效仍失败，重复编号不能覆盖历史。每次创建独立进程组，超时和取消只清理本次组并核验后代退出。 + +Rundeck 状态与业务状态分别保留：超时为 failed / timed_out，取消为 aborted / cancelled。HTTP 成功或进程启动不代表任务完成。 + +## 部署与恢复 + +只使用 /adamwen-work-space/xas-test-library，容器使用 adamwen- 前缀。后端上限 2 CPU/2 GiB，代理上限 0.25 CPU/64 MiB。无 GPU、Docker socket 或其他维护者目录挂载。不修改 Linux 账号、SSH、旧服务、防火墙、模型或计划任务。 + +当前为 H2 单实例预览，没有自启、自动备份或清理。正式 GPU 测试和多人资源调度未验证。公司 Git 远程稍后接入，不创建提交、标签或推送。 + +切换前源码、停机数据库和历史已备份，旧容器保持停止状态。应用回退不自动覆盖数据；数据恢复需核对快照后的新增记录。正式脚本接入前逐项确认维护来源、权限、GPU/服务影响、停止语义、版本及结果判定。 diff --git a/docs/images/job.png b/docs/images/job.png new file mode 100644 index 0000000000000000000000000000000000000000..619da78d58218abc9ed2e724fd3cc6958b7b594a GIT binary patch literal 72945 zcmdSBRb1Ok)HX^>fda)T6fX|NN^y59R@?#KG<^rQn2;zoGxjM;Hym6boJRM1_tD`4#(SjT^uVW968=UW z9u}Ts9*6+sK_1ffbQk=x{l70q!<4sw-wGo5!yx=O?E2RBzhVFX%kXRhFFYflJ~}$u z%W(lO-=!nNV$3R0fK2X5%>fa^mpHp48ngVksz-R&hev6r5W&`oWq$Dhu z`scm<{i!K5oB2woo}ionyML#*!=6A9IA@A)CzqEG8z8+{Fs|iZk8BJ~OrVKOmp{U` zdtN~yYn*OhK*RA7Z(xWyfqN5J;s1V}*V=H}rPWJ_cslKA0{4Q!`~G-hti$g9%BouC z)s5D;5?Y|mKNHtZg+&OSf!k&KVui0RYCLMLv6hp0+MdYQwXo`Kh=VDz{#_0R=6X?= zgK;%5NoucvSCU!2FFWUP5oD%FdWA4Q&AEUFjRb^gJ-cb@BwE%A%f9^ z`!&%aB4lDKLo|yZ&Fk(qfyH-e@f9q9|7NYFwwv=4olUVefwr=vw|f)lxdZgPGhMw`1>i}h!-9}+{$ov;_WQ4wVYe)$p{++zVx`(s7m zHV6BQ($*t9r2kykVPE%`4(A3y9J;7HsTH6M(k zB_aM$X$;{@5L`lQv35kf>T5WLhZG!{E zY)SN3Laj7{O!DehfFkcnq@?EWk3lx>*UKOv z5NIpHsLObJvl%lc@C^9&E&Z-qMFsS9F$H2_soG^0C8sy&3k9C`fKF~bF6~+$&Is;~ zd5)WnOyBcAUO3!s_@J$1WmJ-Q-I#3;hFMysP9}<2TkF``ely>D%8_2pOQWKsq^6*l z2!pzai7_S?;Ix|-=(TG7diMgnW7U>^IjU;XWftW_U#GnH6oSatq5bi4 z*DYSX#rv}01dw(=g$m_e7J&-oR&7YAI5BFq>wVkvBYi~l#OzWVaM{pqbNp09#AE`K znfWzCW+XxppSwba9&!|fDk5~ZJCGM&N3kVG!Ovp0barOtVa>I*l2ch;7v(Z?9s13Rtftu z&J4QUo(&2bWNN+9wE6l0pCN0t$MfslP0!7#0f)^~1Tz&2I5Dv zV`j%XkFpBIC2-n}Cz9?W92FspbvDP#_wEJ;Su-bySg8?1+x+}G)N;w0_d1VR!MIFQ z@%{14t$VO7E&kivDNo0s=h-%p06|h-t<|En#iG+-v{d2EOd3el#E8iKsNwXYJRQyp zpKRSPjn6%F^z)aql)N-z!BtdZ-hfaMa_mAVyx1o8t5;Za#tJgN$hx{|E-P+Dg?nR^ z()<~uVJ~rerA$|MI-b@3bT=<;c6xx_dMP;~qM$~{(FhR>)S##dRPl5*Hoh87Y1$2b zvCkmJ+8JeCuUqg@F|^ZmsB1kosHn1I`stg5NfB@aat?a1!}9jWL|LDZTx#{)wQ0HZ zvqq`jpQX#p;*d+cpyy-z6X?rRq0G?0Jm8a4OMqJz!SapKye=+F8gxfS;zgMS)jKmK z@Fm{l;_pD4V71+^iB7Ki6tT1v$UJaF3gJ8?}(b2APJ3`8`u zd29Qb+vP}R=o|;<;o(8R^xF>t$?NX%44<~!9UlDJcy=p$%L8MTdu;dnqbzaohtKU| z7W|HAEjJqi{I`Z|U^`A8o^1&3c)Tx=A*{2L3|}V0E@-iC8v&IN|BE4doe}{)K6H4x z3-2W#?oNng^E)ucp6(SfJ>IX{vATA^u>r3RGF-r>AqFprZ^`14iUH6RdA*_~s1`&J z85dV}7agl+7A-n0O3CKbcE`Kxp}kDM{~f_h)&R#MVA8Vs z#FBS*K}t1iLVHD(VR@YPEhCNVen5 zU?z5ZsLykag}~$LvlqYD0|f&H59fvJOV}Ro+Y>iFH7&WvT!X%3O+UOTO+wk$JEbYB z#Q_l?KLXSBk?!oNay=1UH>2L|A4$2$Dxstbe{Lz6%7m* zv-xzb%9WrujS(&`%!V@G76e`aB zHY!j_Gz;?rdb=6M!dhPGrtUF_52!+Gj*6DaDd#qWE!ZDE2!!_4a+#Nw=b&f8y=tQAUi5NAbmT3esC z20Tjd-{T*QrzDpO3ky&Fc*Ph+#aH)o^h<*Hv+1X(j1CC6o9P`G2{JQPCSk+FmUpr6 zqRR79X7V(%ZHFkEpW6*nJy;z%qgJA}9@Vj7&!)E1SD~j?$ z$=VS3!Si|B|t!669vdX58KH}WDG6~U%jcKj9Bvx}L3>>c&c93%H!ZoUl&5f4QGm!9U6vFJ# zYhBd20Woj3Ud}=YD<)L({pM#jHnBezu@)h8eCXSGq}h@j9jBYc@$5&Hv00~1mcIT@ z#WBl`)vwZS(^zxxbF^P&&3N!&%Xe}#pnYa`_Ji}S{b?j6a>K{Yi`{2V&%0qXfd^L5 zQ_??})(Z#&#?I&9I=#LQ27|LQyd5B;Qxm3w-F+q>z(V7Knu?R76Il}KTFAd4W78oY zc;g44w=dF7&a&pB6B4qTO*;7D#K3w|hgZSg14C%)Vz-Up0=_sLZs zbzksANQex+c*bdT3XjskfhDy(>bL36kAuH6Soeg;aW4*Eyh|cZfQ2Oqb-s>CyG2($ z)LhdMYteiBL!U_+Lmtx$WF!CA98M%%_h|P6u^yi<%Sgb8;^?&!3f%lDg$Z`qllYo* ztoDAtcF#7Je39cEn`l}%-rBNec;~yUKAHf5;$BZA)6UeQQ%L#9io0%chJFB9gpu7+c)6?nU;gGS<%#j;X|J4HWY^EWCYN{%5BJacAzKs{W zaC#a9Yp7gOr!=T9MOn*S1`+3XOk|K&|BJj&pr_{qo)@Na3KMX57mp9O!6sv=Q$%^7 zXD`qDD=FD!`Cxm;haD5wN1&LB3LEo6iB{bUk#PF}O9+aIn`pz4a2GaxwlyZ*<__Mz z+sx^B-DnX;$aU98VnWZ5c5#N!Z8`Vtg|Y(cs2aU)^s;8q(a^3-w4TN09#R@N1#Y*Z z(m<_0-TBOazrB-qmlf=|DgGXX5YX}|BLdFIAY4za6p+&;@aV`e`wEFjt_umEjdqt< zuAPZq+xrF=kYA`j8E~|G-&9r>7865>QZnI+MASDr>ij}dlxYQ^q@^4Krok_Df{~Gt zG|&^*a;U){zOlA0ByC0FQC?ng%IGPSR+GkQXTI4xa*@GyP0K+1PYj5SFcWg^4f%)_ zC3iR-E2^!nO=Lzb|3TL&TdZ#N39=m3zz}NOXm#)N&Q>Pr>g?+9nF{8_r5*8K<97|K_O7Y{T$l$E#g2&MUhX9Q=nNY*~Q)NuG7Kfn5c5Sj|Scti1Lx9ioHkKQ67Ema!rm$l_) z5F@n1ipX;SCnuD`Qh)qO(rZud8)a=zWMPfSxQvvPlxe&PpqJvyYnW@@I7V%FH0P`d z6zaT{|CvnxmomLbXez?=>F;BWuama_Cpi)E|4jLR4eLMzo@o9`1_MJhk0q>!HrbIP z01ExPNV~y1S>?a))4N3e&*SsH;r##QaP#ONwZXtVscO|)@_BHczwna3?%}9M54R3~=cXHEPM|aZo?bBe^yFkDZ>+h6#q)U@5ifBW12ZbC!e2Gt z@DTAQ-*QTD&@>)7B99*mF2KkttDA&bK5vfY)){9;MESk_uYlv}vai~;Nw~Z=&M@AK z!yV@KWAnlL(3iszVKtI)g>i!L;`h{)_=OtDxa;HZ3?*C}R#r@`)R=yUgO3>Ur&7zl zoBmHUWl>oAow$vt=SSDsh-N8O2+q$6vx?z46&cN2ei}9rHD{i;fguOd9NQp1Hq(W- zCTBF0I!1rb4USczfdfU%-#)m|Z8=370i~R!s43DdJw5b3`{B2D)OKA75Y^t{(8#li z_t{oeio5}BFpPv7V0#$5=Xp6Fg=@3&KHv@wY9v7{yHND*&#LJc@w01C9%oHmd$hta z-TDdB<<&)qnUXN@nt9~zHhU|~UX6*gL7k#uS`5nK93BulGnV)O+&b%#28ViTX$59Y zTQ6HvVkr%NY89RMF)SgW&=Hr@7>=`=%S3_bqX3pQlXZ+YuuAX zdA=PZnF~rmD#oqSYz=`0YWI)8Nk!(U9}>sF>A z;we%XNT-tGQ^D_cQ&jIFHTVEYchl%0>lrK-x>njd_STki@ACQkwe))jk=6YaWKI)x9wcM9r5yTK*6|=n}r1O*{wed)9-jL zR6IUw=#>0G8KFR=wzvop6_umET3m7qcLj7#9uwgiS^k%` zECtP4NCd{)KOlL z-CS;Jgq7t^7?;O4OKz7rX3gb;Z$jFYFm4e?EuM2KzF3;h^8~Vb0+j8uCNd%U6^z=u zJYg7TNd?rOphcrNGpaSirTdn~Rz1c`tZXbME9b){#U;?^*=L#tGyUrebu^4eV3R_M zxid+VqWXr>YEnvxQ=0-KS*aIiRMs&BhiLY5Gs(vSZC@Is ztX=j|IBA9+{w)6AT-@H($^YHS1Lk^?#Y;)uf{GGl-W_#$-Dx4sncMcN-MDW!IIZQ$ zdG0zR^`ZtWal)(RB|yCU4Smg&gDT}h`Nb!OW|BS|Xz2hH99<1&qRgZ^T3KtLg@iT! zF+COgC^dUZtN8`w&3TqFS@Cn~iIGV9Z*s{HR~4q4vy)=rNS&s)mv~ZXb+eWOfhySG zJ!(-#6PCO}j;-~?J=2lrf;@T|#;O?UPv(Zd)cL2evzVEgNw?t<*s*gC7!^_2n@Wm5 zPd*sysm!jD?eK{Wib2iA)Cy=Ub=B3*6hl@ zzlL0*0`_8>c-eRi)72a>kZ-LT_A)98#+REKbofZ*-r6o9=dL3z-(LQr`8r`agiWj@ zDxZEaX{ zF9P@9u)AiXtUAj2nKni;puBiTQ zxQ*m!6C-tQ?I@NppHjuqBE7Mzqa=IMkVrj?AvxkI_KsBAqS}rJ36Xm}V5PsxA&r%T zzCA&{KjBwHQMS_4fc!I~$fV#KSRY)8o4_M?2tI=#YN)#&S!KmX4m!pcrLyYe7gOc3 zU#b3btg87Eu}Tv~BmQu1t^!+8`<_JzOkGk^QZFFQGHqSQHsi2r|LS1E1Fr;(qO~j){Zb<8+hD$Iy@{s!>f2qA3cfaNyxbE^le?~7ydwWKeSuo~~8CGt~ zBw}zYGd=JbcqgbCv-nn?n3?E{{4l z6;jwLc3DC}^;+Ndgvp(s=hev0aje|Y#p0PtfsFU8=66|pCAoKiW;>;ao!e4eEcRy| zktgf?4maxXUZ>yhv#GS~!d%Ng%?-W2#@ zO3gX}o&8L2gT9jI-k;*Szd#&UB5DCyEN%}NN?Zc^&ZIXHI3!U;zohM}ZLQPt&C!?h z-aR;R{v|Lh<>iUp_B@dHxs}RMfl>#fXmC3|M$ORot`fQZK~AO{TsBd88!DzA9{F}y z11w4`{rPW6a;dRX!`hBx%h0f8Q0&-9-)rEBy?)+i0mSF6y$<_m$HFooFJE^34*Aqj z{C#M`=|QSkTaNA-nsHFN@bduiYfa}bb_DDJqPQv4PqHY6PuFc}yJ<7cPp4tHP?824 z^tF19+|ew*Req0VsNu|e{m!brU6vV@31<;b(}VHeuDnr`qpYR`CdczDXUp93hv=%R z0bc|Er|&?PLw3X8A4~i&sXYC_jZXCY0MZnKDLr$NsLeqDhVi5JounL~*^#WN8De?} zgHT~husap+nF+mVt+M2(5b<}LuQN$#*$-bA+3u6m=C?bE3{22I&J$CUvl|eS0fIet z$_~gOL7_(P?X)Wv@bGEQh^Jg1OgrX_ML^>&INB+EjR~wx8mww==tPVHinh1vGe%fS zO!RW^Lpu;~Rs?O&IyzmZZY^9WlnE8WLD{>X=X1+2P!m{XJ&9Aqd?W(k zIao}b$;wWr68AVRiFiuNyu%z%-QB>u)2u&(tIQjUf%m+#S{9bDu)$*sE&t?T zhWLRboQ|5h6-qVT?HNY+f1j(pOZ0b_H~J> z0yA>TN&NDa1vz#?v~KIm_49!i6+u9ZyP84n?*KdAA5eI=16V?Qu_+*9*nhPE;2)j+ z@DJ7Gs4(2l9q5&rRFAJMo8%f-qc2xP!3w#sm0L>FJRsRR+)s{2ue17gBXFla3s`ax zWV|Lv){pOoKUb(PCe?|Z9Z7V@3N`60ZU;U39H=Q>y&Kyq*8D2g-{9CV*Ozqy;Y zVPbL*DGk<%WK3YHBhZFw3afDB+KPnZ(*L>r3wh zgI2A$D1C!dkvDJb%Zg@>KGq16@c+}S@i1aK-wN(=H(k|HK2nZZ6+HU(cYoLRg(~>I z%L}7@MRNvNG6BM=maDDY_lPErtqk8g@}9{46Jk7dfu&t7c70F+3b~hSc*u?#pB}16 z&@ODs$c9uR?=@Z>l2_uyua@P^Ho3ir9qAES63sOqGCqRtGX7SNEJRL#Sce;5hhmrq zRgS9e@wv(!2uyz0lN}cGS?cyk*~Q<>soVN>a&v8S|3`FQ_He^!m6#;-D0)&+R;Pp} zpKp&*nJsn|8W*54TN`S5KBXCK3NPFwMH(lhm6MFL_LF4K&P&{koO!!oeWuX2Vejzt zb1ow&+}yT8?RQjG?@$z;8d>6o%nhr5EPb=P-2m^MAw%fsn9>+y17JB?8RrsQg}=VT ze24NbQ#X%(#lp2R3?itd;?{Hnn%Gy2uZKHLBsktSb&YK#DBPI?ZElQB;C8074N)yd z-3uS@sJzQw-S71*)1N1Nt=5EKS{>e4FThTfluyO9(#Ca(lbRgQHLnoc{;eL_|O)YbO+xm0NYu;vKFnuYLkE_%vc8G~A3mNA`X1mh@PUql6m*eT> z5ZjQJSi!B zpe6O^SExp(IzBG|)w?!mHV!kZ0SX_}Ldk9-7@ya$kZ&)w61V{rw!FW;sF~CV*-U`U z;j&vF9bznpr^ux*WrqS}c zunuIR^Dd=k{XGXCOMZR0S2)<^9g<^fJZsAoh^HRrUZDM_k77;~yg& ze{r5dX`LopgKClMJ84>GB94K4&1t`(pw~~}%wkKosSkyIA9%;`yhr;mgYczR zW*E3qy(6*kc5{Hn8g^9V+6L~f4O1`@$GZy8(Ow^t7_6dkpPQ*PkJKLby*#}G@0yA1 z-1cDW2j7x0liuQ!Cu$;!YP;5$+c5m*&!GerB(si*YNW<(_m;|*e0yh@JMv&`6}Bx+ z&GA0ZX6u2Pu^>7y@aE!jJQ2*w(iGs?fptouF|SFNvzV9#SGiPQc8xnVC*QXA?QsHS zFSNK(Tyy$Dhp}WLzju-*PPL*)cX3i2s_c0X_bBGL?UMIZ93IM}Z$;gDly;?HE@mda zkRZ6-9#ox%`dLecm+u$jRzhd9xG_yx+MK4RlSXdL=A3XDju5kfar) z2V+^@=Fd+66!6`gC-L6E-;SuThO2kBjs#dW{bJ^nhLItfsHs)PpLbmgrN78yrD-*) z5HKDDHl$yvmh=RHb^EIdq?JAe(t{wc%9v+VUneXC49346oBUd(Y|+tzZ~FQI=*7hAdN zJ|@r|Fw++>AfC)cqjQn&N*P1Jg~z#K$faZwA`=Ve0B2LQ6?ruRGge5yi|;Pxz+8?+iJZQ}O4YEDaXXOcnW;yWzSa`nxD+@4 zfK@<~cQ1VDW39PZ;jg#UUiF{TdCqqSKnzPBKhfQvbEH!bdo4K~#4Mtb#FEf+y+(3K zg<4crp)c39)fW43ig$~tQ?IHJFzwYG0`UjWOXr)ej-)(Nomw@Ldr^z%80tQd@J1Yz z5i?StWPfA{=0V@musfeFGIkwXUQ>#6Y|br>M+O39f`iAf-YHZEuJbgyyYKobyEfpz zLKQCV9YdALa<5|NIYL0Yb|dcJ_*0K~Ii``0iFrS;wIc=iHi^6zaAY>dHx>6ljGJ_% zd<`nmLO$JUXNEAc!^O)gss_0NH!B?J8J^tGK*B3*SrDx+TNZay<$ZQFBfpQ6o zv{lMZAKR`jz2T&x>lipqqHvz;q|q^V0$e?&%6!N)R~82B5&OP@$yP&e-}hco>qDDk zpr~#yI!Yc|wo16O169I^q0o)N>pnUxE9EVUUVFr^>SArZ@0kl&TkUE~D6`rF%aNx_{R>7X14{%mEWw%aiwPkYnu~$5uTaTO&K;h|e4BgkE`A?`dxv6{ ze4-g#BH2;|G}_0r@-W9HZ8vli!!{}#&SJst1vyNi72>p3u6>8MD@WPr6t9eIE!#L?VebNG$-f!ex?V;FzwLKSP(;>urVkfWi3lz_!ad>|w>i+`NjBZ_QA zp;6$eTIs|g)bgEAAMQ!~0+z-536$3Br5>e}n_vCGO0f*mjJX|QND=#eugKVIepPN_ z?i!UA{>ZenWIQUp!I2tFyru2_oDh=ojRG^m?|g~(V0dr?*GjT!w3XQj(QRsWgKDa| zv-21{Pg%qc`5o0eSj~jHb1PBo)$^@#=uBISrM`g+;aBK!&Iiqu^VMIL_*NBX$+sKv z-o5_eTM2DPCXgLgqe^LMa)?brS?y_^87TRrMUyXXCjk|YIbdtT(^DVR=oovI_mG;J z<+*FzpzXvCaiqj0+6?CNqg4#loKIOu>SnB7OSq+b>gXm;G>>TB6ThM&c+jD8jFb-9 zB1l4ab=>Wzf>0xTHb0$P>KuG$ zVlr+VD^ERnC~pbeg?LGQxn%mSFV z3yjRPq<@EW&3?2`R~pOwtf77)rGlci{nMqXQhmDWtBBr1r0?lnZZ*!rd4SBZ%swg= z6>U}cT%+slJB8-afk1=jV}T7WCKvr`zbuLR07cy}4D;pjfY)(72$36B$PKJTgFh6k z>F*0Pi-p9Txv1;ZYx+|&PERu^s2M4^o6PKcFzsFWpIWu#h-!$T`pfwM6@-Wl==*v& z->b6zuj<#@IiJ$}odhIOqg_WYTxuFBECR{O4fU+3(bXr?!=e{k`BIW^c{>@KDY(A2 z;Kn3>VBgd0#CnUJ0NAdvWa45yFv>cRn9-~f(Wtoo;E!!=LBf+fzqX#`Wc$bFdFB2W zc*Q!mUHL!YHQYZqyZYA?-5#wXD-v{z-AmY7EU#Tdq+WOjg;s5$4r6XN1u!v1EuCfl z;id3P!q50e-!*HHt5Ik!-Il5-V>Ll;J7v|249JnN5d zxWDS|(St4+ZV`?vAhpokBaFoo!0#dT5sRCDbkPPl(scC;Tg@T!u!uoz*Z zAehXlZ&Pb2j3V^GyJJ5VS*`3VO@5BAy@Z`W-m95x$(WYRiM3xn19YldrP|y!N)Nnb zk4_^GC6?myM!&>>{5)mVw>Ip!Xm(gC6`tdmS{7CKyW94Rn?~AJvSkB99LyN(iW70UYST6^DcijKVrqmh>5R$}4; z<(N_RP-1S7HtHyLmwGWpSo>F8I?Xa|Y451e&1BOe_&*VQu<~rbzuuLWWK59~(&NJW z?y;i!FVOoTAuI7U&W@yC%;$A4dT^_-n^Ivv)__!>N+6d}T*Fq1N?+8*Ck9g~wF!>5 zQ|CR~8Qw~~dH#s|HH{~RF~=GewqXm^?JbS})dKFDk8wwzbymqZZ^TNmyGw_OYU2lr znTJk-n8MaW1Y6zFdCQJs zXnN!Lbpt_~1TpUXN(`T>=BAG=kqCq(b(zvyv&ra~y~ZXoQ>)nh8Zi`=Y)>pxs&!UI zniFipd?Cf<5tHQL$>Cyq#YDSo&X1BZK@M`ZuduJZ8FnVdKStQTH~i(i;OpXMZ0-m2 zeTToPF4_#NC=+`XjI%$prruyIpJ1=A0X{J9F)}h~=UQ!jkI6^D3vdYPO>AbFK7u7u zQPB?YRI|?Au=5&iBgSmO<6i`V3`OCwjG1dHkJj05Rdmyef4L5zk4Y0?Qq*Q=Dypig zf24Fa8LMPQ&ZtKVd%PMP@-=agb4a29op*ZRCo59mO-K2NR3VU*$hnCL3^yr@WLJ9}iFaY| zuJ#$R+qaamMomUSi1F9G_;NVuG=x7*UA>1NAv3$5TX;)l?X%q9va6qY`=n?esag9% zw#$YzZd;PAZY>S-?!ta&CvkIe{+_8_>+{`5x8_*J078CpAkSr zrI`ET#xMPx_$xipTb4uN%F|O|cDD&(5D!_*j0+z6hr8+q!B)xNG|N~O%>ID>Vfs4G zs4Nuxi1*`=+4C9p*WvcSc zkJvF^P^{kQFp1qrr65S^gADm&CTLXb9HJJT@{%%XLwc&JF)!^Z$%BG0CzTK*D()#+ z^d=9Cfc#RM*dRiHKqT#54TiL5h@M>M4WzYY(i!wGLpH%Ym?6w_lFAr{mDy3c&3Cn?ErxIu$&D|TsPb!kgW1V9_b-8pTUssHv^cf2)I_4Q(5SgzlK4#6*pYgZ!p?7~ zU0j^k2`GbxvF8zss+{6R%{P=+Q_?1Gq}}e0m(UkaH#KMZeanfiF%`!sc8ha`qH@<~ zWM(POn6vnTYVB)mhEov6nVUuz%AIrV3B|^W9s5e$CN$WLs2yHSu@{t8&BC~NNlm_@ z%3r@-Sokcj7!lb4RpsA)XYirDNA*vaS|Wlu_T~ z=cPy4I^!zvU=AegXelw-ITe{Qz6s%7PLDC-RGEL=a$xjp+K5!SK%MwcXGrhddRAj_ zY6#@EQw;iQ>>NyxPJ)iu6Qi&=+$A2n3#!D+UocYdZA04k#cwD6ek12AQS;RG*G~=S zo7Gg4{Y?Y4%nGXLYp%2`-(FH+Ge*~3!9MmDqi&4~7xeCF z+A^5D!;&U$xj*l6Kcl-b!PN#*b0`AEPIAC;)6tQn+0YQh)hLn=~CF)(yZga2wf z?~s^_K25M==3r?{hHL!qt>N8LyVm{fESg@R}O z-1mp2s3MdtP)+$iX1b6fTtI-Ew2iI`o3IhmCypR+C=h=?0f)~V6f~R;wlCN@*=yth zw(dUI&<=`z;&pEeV2Yi9`q5Kc&xhvbOPq$PRB!>n@rl*(zsQ`QBGa{)nb>O$Y%j7|d<^wBc%WT(Xl=&<+Ka+oM<2Gv62?=Ky$KE*A9WLg9&xT4uKW}YawbJ-iQU9^?GIieq3uz zG}}T>2O;r2mNtz=gWJggRMpK@E#nqC=JnYJBsZgp4nsy{+KLMl_h}yA=q8h+<$w~&+;Qi1WdUZ1fo4`QlI%RpL0+;MK{DI9lO&gXI>Gjt|r&-Qu= zuxuJ&2;!Zk@#Azutsz5!k3GRrg6=qF+>cWJ3N$e77K(rA^Sz%MPxA38H{>*O!?7pFgr&ht%0Bc93cpNKWaYu|7yZStq4{3( z4Sx&jJ;tO=5MlCB&m z!M28}sLm?2XCJA!$rDd*UK5+qjLlz8#YPL$Rw)g8c6PZR0HTxusZWPN~7J?69lv7$W)ClZjD(F z&L%>uPyCEVO>%05R)--@4q*#?EOgy>-wr~B#h%oN!>Hq?N=VzHn=cMogphY+kNT9~ z78a@O_?K|oh8Oj+7~Z^968n)=$|}H8B+9kA@ilX7_l0~Pl<0J6%l?I^o9|ws%GUVL zFnneB#_xnHuT97T!82Bc-Ghn{<+pZM|JdyS)u?^bu$uIr8wTXwF@O z)c;Jo9J&22-n;_?NwA1(B;@NfT7q)eo|G)jg<+Qv-;l%hE}FjlH0vSl{IRoHOQu81 z(58qVKzZ!%%dH*$h1K2`-AJvha!QJM0Q2&+d!w<%F6nZ_d*WL?U2gd2mgz|t{}txF zFe|M%H+4J}<_aPbV!SWig&S+VMyrrYA%upl@A?aC8R7_>0j|ky4oJ&iE_Vm+ecFr@`zpZ8w(FqYWBPX-+5zO#k9zlsELmniV#7?^60;24ORv`Qy(yOu7e-XRxX@Ql){m%I8!-qkpB}b#Mc*_m;%k|6*by9?P_`(O89=D;IR)G64m)CQ8CryO zC!~z__SU-?W1C}3()D&ZjM2>yu7ttOX;geZx$ZS39H{4dtmy5GpT<@=9;#wUEfr;& zCLG$-u{H+asc&?ujNKCJ^kdn*s&v1*bT@33aM_C(%r{&^)IMbqypBspQQaVlf zDWF5J&a_3F`N0~C`fbmVND@BYX^US&;aGr|w!E_p-E0Dh*J&<7T_57A!Hk8DvjHsi z0{ZD20kJxIUM-X7@a_Fs@m5U23hT#4x7H(X3|)F8Y=G-%9ORaP-k<4-Ajk{V9KT;hs48F?Npzx}`y7GJeDuO;AxJ+_r_aKL?7GB7Io zbvQLL?U`~XEDu*eiTHh2?sq6jbBLR4eZmqmt|KKJ;=XeVX>DtnuUvUS6sGjbWy|Vg zyn_$k;^{L^%eJlkcH?S%-!iPR$IaI;g4sPDtp#LS_tFH~K%Y`Fu z<*oRB@cEZdz#I1kmIT?U)-lYHcaGagt0>!U)L)_Gz}7Bw7X;#h`f^CSUSM==!F|~2 zIVQ)nVZO}0<)s`V!>(KqaCJKI;B#))F`A-fxE*p3>?;`Osk zy-8EjQ%=9qLnd6VF&vmMoIK{y)XaHrs(qa?s_)Q3AQKyfuC~X#4=2VMLe9h({Z_ks zSWhVu$0a=;G3;G3=YY=u4;|fbRDJz*4#{?3Tg!I*#y90{lxaMgA+V>7fiVN=M*B1g zLclmb+`k@2><)ZQNP=`-D#y2_rh`5Ld7Ghm5C;< zDf!{Y-MFB>1jQ+r;b_lD4m>6}zU05S^@{T?bACDwI;3>O44YlKW;BGbd^VitluppN ztz}zes(KZQIIHGy$-~eEFFH!PT3iIu9*cxdp}sf-Zx{j-JmoLFQ_ ztc{A0K8MND(-^**Tl25=(wOH44uV(ZboW=13IdskkA=>jYnsN5=Uk=lu7H$wNxUYB z*B_HcISR8!Mq8`6j+r!2@W#7}Z_pU^Hd2<5LEQE4GD&XlH~|aSR^lA~32U!HzW4Bz!O2epse-{KJ*bz^Wfc6H)zun|(YszyYX-PezX>-HtbrTE4Se zwYDgosTFs(a#OX6(a8UL5nwzo-f#}PBMc)a>6`VnMLln-Y5X){smft z){?fXw$G*`QEKADjgPlO84)If43CO8l>0h#mev z|DDGF@41byKYdfl_pb9O2#n6I=4#oRyD)=DDxN(oqUT^y zGikc0u$U;>MQ7&Rlg41OQ}cy?4(XVshZDh99-wrm4m*lSs%^|EXpUa|6S3>rHhu_T zpU}KaDj5h{zin4mr@wnkuL6)07jC^$>z!q%>`i}=bHbFc#pA(nhrWA;TMwb$B6l6; z2R=PzI${*QhxP=Cm||{W6O$Ykar)$dT&DMx4{SAa+M{0Ax8FVXvJS4AjCv5n8|`<> z8pc@WDQyCvPYo=mJO`|_Y*XurL|Huc!L4;%J?U+uQNEtTtZW=k-hTk~R#o`P+1q0y zVYbCy8Pjm92>&K@hg+1VpKvT8c4H36aAM%@+}0s)J*8$e6hU>Qq~!@O zmh~+eW-rZDzEv}1q`8I z)+5|iqg_D`aHZUW=f2>4@DJma}ue+Re488MZ-9h(!cCay(6AY#6YSXEdIf5 z59ESUWm&8hr+T8l1*-FUks}SZ3I>^DMZY;k>37G zqnQ!SY)nucmeUwZ#YCk4kNyH>iQr?cN~!~lX8x^?zXy>mM+GG%Gt#+- zr`F^v1m!(>qAtnHvbfi_k$^IG$$te>LTs&0Zk5*rU`8~CmE9K=--PFJE?;K~TN7x^^PKe#pJDv!A6Nq{gK6yDEe$qGLvySK(yrWO^d)_4JToaiD zW7RcN%0YQ@?8mce38IMXDxL9R?05&JDFSpnNkT7}i*j~#H5eZb^OSfo3#+o#=^9JJ zLP;;+)#h;0>BmfRP0=$uNw+=!oo@X+FB=efMEs@IZv+%UwoJrZREr}uR2$Cvb)o+j z9q6wRUXp)t!l5ySjU~PcVnb0H&&9~f*Bt2YTerY<7VVFNOc#6x^XslM;Cy$wp}bci zHp2k9_fJN#>9oLR>h}kgA^5s?_}noGSgSQ>vzoTh9 zQ-XP!yx(C$#rIWm%v7K{vqqz=Dhfh7+FI>Qe6lQRnRN9S)8b%K%joIxX>!R@4Wtr+ zwFhNc9&#Be^xvz%nlBPihreiu{Sy}Cp}6`~Tbms=gjcWy?cbZ6=KV2gU}G2?7N1~w z9UlYbn8PAjA$mDFAD*||iLkor*Y|rt7QzHtW3NNZsB-*GX^(e_cwF;Ch_o}qmu;G? z8?aQnmlS+Oj*7ctafn92EdEH2mGcw2Cit01NvK1PzQ&1rp%J_-V-7`RY={4rT4#C7 z3q|t^p!l2=M%_mN4Pfe*TDwamkLX)woeKus@a8ttlM5^x4AGuguAc+hp>Nl#oq|B--|zw zIol`q&>97#axQ<=nHg0}A-d7G;!+m)j40N+MaE(unxci%xGmLtcC^Nr+UAzso`mD~ z9$wUY%XU7M5gCZd_K=*-yVLi&JL*q zOnW;x)4Mf}cnZ zK}`svCgQ+F4#a;Mi^FP$^=gAnV&QeuJ%aOIyGGh5@x)%lDeR&Dtg$1$x&>9Bz;c)M zv>J|<^#(?M4SrgI|4wpGwilnFIVg2eRi&B$YUr{c;E6<=wMkcQv6l28zU;aSLf9PF zJV-C)0i-UPa|s8#-yyi)ae8NcV6vmsf4Y^4c+)E_s)fOh?C=OCqprRf2ex2NDu}V`X=v~~3M(@`;m;$-FGa32y$u|FF?u5^MKIbldJ#pm* zn?aI>#)r}d=3>jR0<)U(SQF|#6VITEo4B-Q(u>#i5%{mn7|tI~o)uFW*E~U1(=i+t zccUwk|7`A0_AAlsI54=}CT6u1nDmeOhpV{SQqzYy-=S-&pWX>%5RGdYc?1an64E6> zO&9lp#1UZ^KADx(nf4U9RLrc&MZ;Nc%Y>EE>rGV`ke!`(FO>)(SZIouF3)QG6J!yI zfuYl1+RKr&XNk+9PaJxCtZYRRIzT~H%Ov^R{6C&0ZMNI!{Nrk3Vbcam;lC30MsPzG z0bz_*C;Yknb(B+x$L}f**nvnlT0v)c_?)ml6L*Ckr^!lZWUkCQhja`a;(a5hx!DIP zdG}Pw9s3wmJD$7IPn?e+9lG6*4-o$xuNKq-wcYqUk$jdMViPl?^a%|U1mkO|pv$83RCxzx`myR4RTB9%&>)fD5LDuRHrKmTjJwG_s8w*d zAeGJQl`pQgv<)gqHAz!oA0QjmxN-5)J-0moKL&WlAr@46&9^Hpe#p2>D)Pu7khRWP zuu#jLok_7#{bR49v@D^(NvC^<`{E=7k*3Ev>GDaUxYHQAF#E9Yr*DxT7F66is`ZCOIfJP>!0K6);TeCRrF2 zv1F&5y?2#Z)${S5Z#k}ID&>$MkiX+i$j;tbY=bI0wu&BeHYtDliM#kLmz3&g7}1LB z5VfN6e`(1pv}dEaA6+GD^?Kv3`&_HBI)l7!qNe=xHwUDrV2nKyBe6PS3?9$o=$$|4 z=n*MWr7Mh=?WUILW-6G|3uT}L*1LfJ(DohVr>~K)Qfw$yt+NkjB#H1UAM{Y}XFB$~ z?h!4!e+Pg?GGm0`5WJ?@*36>#%PWQ1XNY~OH~}go8WALWiFN|*`|!&Ae+alOvyHnR z%W%WSSfff;`y;TU8ShQzRZdl}>K10m8Rp|#pE!n$*{DbdR1v$3b2bQU?#V{gDCqTL zf6JjuwOMnqleJs>f0+Vp$&1nmMLdhZsm%3#9`(ZXc<8jQtT|@q2~7Hw$@2t(F?x39 z?dTNj_Vid^H~akj$zz^i0xtwa3^5^LiX~Dc10I1-R%C@dS4 z1S)nio8%A#O8&AV6P5>))h2X|~c$D$nxqhyDur8cXU zjo-Pb#yU(74qt?q&uX0M;(Jd595nw}Di0JI?L~S4l^xybIhsOeeFK+K|2nIR49{3% z(pcJk5fBcS&omIQC*fTSu93?DIk2z>nWt~gl%To)P@(nz@>)MLrO%T;)xq+#7wMUb z_Ai#H^g92HW}h&owfD@?USxv+u2J3JE<3Y)&3;<8rNX?HNf~$PkJqMlU~$QdVvUep z{qzNHG?Ax$yGE4gJwdqh9U;fN$>gIeg`p3!O(k8{z? zln?hNz9T$D6HHDalFj@pCYRho?u)Cux?=vwBkmuR`QXd6!^xI#N9}PrfHc+8Lb9-i zvs@{zfj`-x_^QUfTh_|rHy_lNglqK*t7f-7Ux1V+IIBNRPww|YDykbtH`s$D+34m| zZ4(xnB2UNT)8K)O63bs=ZmY{|W(KWGQ;sr}W@Auaw;tbrS(*<`Ve$2>uroNJFlINl z*XVbLzo*`_r&LO3a&Ss5w2KFB|Lu8>p>OW{2Q6CAGt%Oz)N7R)V4xbWi>g*=oXo^( zx~^$!J1g03-rX*^=hM=PDbC>q&0-j=1=%ufteUlTuX@_<=PKy^?Y?*w!C*qYgO=>l z2hmR@>m_MV=Z~x)(t8hmT?F&+wrA36?C=zV;rBeHA@9f3;EUr&W3Gxey5ymg_7}y5yH#Sb*P2G6`%}LrL9GO@ zDeT`%?KHPEW>La;u%^LoR{sdYon7#8?_p8u)N0Pnv-N?Jwrf$(e{Mt9g!xZ)V zWW$R=I2uPKKqg>|{$%}~RuFCFnpa8g`0YgW^}*`&g09LJNN70st+|*mK7Ax1jUy3Y zK+6$uIWiL~f|Ax|^W-#zQZ~kE)L2=P1pVT52L7qDGj-&ktDcW6Bdq@=14+Gf?to0Z zAT+Ek^x-|@4%vD&+a2BX!?AP~Oz~3MJbEj2l)xS2RQzL} zdFYh3%5X0Yc&E1DeH>I>Nkwg=d8N)6fuUigtUUR_QFhM zSl)7LAdU=nsy4Q0!MH_Q2Da>A_~kW;ah-L0$JdC{%mqS1-PaNtSsip<0y~>K!%Zw} zFQD-Ymz1GkMR^((AIrk;8FioALD*9!&wcXT*<*G-S62U9Gpl3W~25WKiPrM*mF>GB$;1mR_s zs5Vnp?^9t_hEiy#89w9T@%JRkOT`LkRfgY{(<9X=G<{X@EY_-1F^8zdd%XF5A{xYE z%}s$l_bJj#S5|RuQ7XS5Q-3X(vpEc@oyW+%p(4Hbc19t?Q4M;)6#s7{1NY05R|u)B zIa4xk{Mja(H`{^vHksMrN)Nq39*q$FkKADMPuqXPZC-Mu?q4S*Z2H^~L-M-B1zv<; z-+ku9`ASs%!=13>_lK?HbP$4Eib+X7`g&Edqwcpj=M9 z1H zs@*?Ze>QJYiD9g^i~Y15eTsh#XQl|kamE#f&$REQk8M{p4UAV+3x;==;iwORL2^Cg znH9VuzHxD}hMEaIJ)_<~e27~?pVDgeW1`igqr0qB%_k3(!*&|@MG5%c5{=D#-)d}c zvv5CybMAhMpUvU#+5*FV9AeJ?QH7NDwKThY0k0(=C@1oN#kG0vUov?3Q8yRdcw)6K z&D!W7NOBLYAmBcofU)eJKY3xLUYm@jFNqnLcR8M07g%xr6IB!C#FuYES|Bv!z!Djc zlG1&zprc&VlEzLrezCtd1?l5JC2Z)i2-|o%GaW6d44?3&{^=60NFKG4+>%?(7C`c@ zoaBaH7!Gy-z_?9ki?qwn>mHk|TqPz;y-LTZWm5rF8FMk7UYvL= zRXN`r85djO*9J+_L+%p8T&JXi>WM(dk77+PBR6T&j^j;ONba{B&@)gSYjw;Xra*X4 zkA3fLGP7HrcRC{gz5Po2IfWYtPbG5y(B$e%6Q9};WSz!5Ci#0dwOSYzRlXs-0VT4F zctqJzU~&mH(g3|tFTyPBBlCovQjpA;*Pf0GtIV&p?r$EnFHKqP46NCOF%4+;!+;q1 z;kdX0wPUGT*Vd6q z7p8m!NN(Ya_;v!YBvCCybX4mvM*9Z!?3WDN@`#NJ*{Y0segzs?9rl-gd3B{L%(4xtXQ&YsC{{n zbka)R`iAk33O*Ac&#{#7x5rzC`@^dA$H0h%N|+M#l@ML+0^AN!plUwE^%S|fOO{h%@>KRDjymL*!EH5LdC#)a!|-u7J9$)8-kF7_ ziG1evSVbDdZx;2qD+UEXuF0PB3i1rz<{I0Bw6^?|cja4)dgY6}DQ#cO0IP#m3JUY{ z^^bR5&Au4uXD^S|UHs8F*stNWk$stj$m7HEEq zriLE9LwP>WwjC$qNoqsm^>kY2`RJL+ppGyiAEu$|a}#Bp7>!KYcN|ZnatQ{$c3(7o zDF1`3(07^OMQSf$T{OZ;uxTgsw;A2@pfnr%&Z$q| z&4LBxsq_n@A_;|H3wK0lbJ9Z#pU!i;Tj)B&cv?jBLh(oNO}RFh5hY9u2mM64yx^F$ zj2sxFxU+HO-VRXajY%DxG21^ooNN5XE3<)(|4*}!xN(I*-MqXJ=!|{E{co0T?w>+d zL2KVp5VC(q{#_4U&l03s1fu)B2LJr~w^hy<$8~|$CS)vgz2OEec&#GBq10GCGpd6I zM&72oqn>v#ilTqeqCh#9dbM4-AF<4_UGM6)(9|OeZ^;PK|KJ|1MmxKQ4!cGdO|P24 z8}%q$@>5kx@9Fx-q*9;LxrkE|&ivZua2DVC0eCG03{;q&tvIXEy{fpe6$`(*f7vo_ z*gNC60jZg_zRbv;F5I;~?fN*v?P?cVvKGHbaYoOv7e}ADTwykj;2@O2cvNc(&qsC7+(3dtn zm#u<^<7a(cQ0o`>-e*QYa=Ia)PaH^02i{5l!9I0$b6`2!z$9&fClkFR7hN_BXD-&B=o+B>QquDRmLNa}8E;vnTeQ(W;u;kV?ih6RD;Wdgo zx}o;A5VFHva4rOh)cB{ zl{A9<+*i(Lg77g`S)JnyRO0pVH3JC)^i-vp(?wdt7D-WqzVhX&k7XGEe&OwH;pB>@ z41#tm$0bUauThd0UztZ2S{MwgJIo(v{$RJsy(>?mYL5P6F`8k}CHT&0#_s=W0Y!_S zb5!w>G3%;;poKdG{%v|dAn|^DYa={%jisbvgE)8E2 zsUBWsXJ(BAWbyzBy+Pn;yoX(B>Ju^P^82G)4%~XzIBhvWYEvf ze!chYs*3?#zU-%*GO_aFE@oqIu|m4>s~LLOZ(ajv2ZXgqHbwStygf|-jC1IQAzbPQ zbLau$4KDLDU2dLZ$!uE2V|y?`Wh0E9fB&s}eYS>&=52g<(Xqx@nZPNRjysi(XY%za zSxKv7JxfLL@HAJeEFgI)<;J(T{2J#UecLZ&)R1Ju&Bn**AZS?UxG6dI$g`e>`<|+v z(tWX)+w*HJEU+tKwosfM~jiK#XE`YENxcezOr7Yk!w zzkgfP$-p6HNUlemsYH)>mzj+XMNtcaQZ}>aMG)7QsI*eRKO8@~5dSG`1i{y8wF|2n z_1eDU+F*EF(0r^}*?~g4xmO&Q-4V*mJ}A`~$riA(P6DkjP%CrHhJWXEXxA#?^bV_b^HsHO}`($le7v%k- zOJjyUO6dH*@l6}oSAD}!mVb3yVb8Imt+{`avAtL!DNL=bFc;{!> zqt4`A^M@$gvwc1)GbN&BTUPA|2^Tx+Wn?sal7-BDWV->Isn5Zwg_$>Qh>ox~Xw|L^ zz2#v_TPNhlzFrT{L!=^9aq~n#m6d(07MsbW=_9C5yWo?`pQF!HWd1LZ(eW>smuxp) zjxpJ$cP#=w%I|mkGZl7FV<^N&*Vdzr@-u^V^nCOxGsvTX?nk3{ zJ6Dx#Q-p2O11YtJpPndV`CmaftlRZDz*48kCy9;sld?PD(bdIM_VAO#ZKN`avsb}Io1_)0)m>)xuZXf zexkf!^AKGc65}4}AGvCN%#7b!qIVZ{QO-yFT_D5<*{6_*W5X@g@=@mGZ~J{vyy)IH zlxH|zoUwk|JV!Ky*~%H$qDWoc|1W^ zZeB_^1ci3esoIPl(r6onY+CEDrh4V%qnqVX2$ngeWL}f$&4&K8&ntK&-R=$@N*N%L zk`Q-fHFgKJ9TKfee!Y`VTN^rw4LGkvTx3A;H!N^_!SL>5^b##BV4!p;x#+BD(bdWu zIVhaWHdlTpQR&;`;0h^}5nyqvg$Vm!-nS7`;H5NUfn4E7iwjkGs5{0cR+|`i*r_jF99%ee5)B zHh;@cbrX7=FKIJ~`I~6pWDkH8hOdh!#(Nb)n6W+Q#Vm}gvW_5Lw0}S9bk}P%+4v&F z{dFjEo>|(!$uwDq8z$X;ax6h}A=;K5X28L5dNLNdcwL|gT1J=x*2aT)oHBs3-R_VO z313~|#bh0iNW`{!FktoF_4i6T!ID>Suy1T}F-V{q`VP^-7!7Ob6zg;`rcAAc_Z zM~CV+LrM$wGu+R2LAITzjH$k3716`S#<)8_spXChyBXjf0GZMn_dw4cK6v+ze|ZJnXS;p)iM>;TFAk4W%0 z(IjH4am>EAJHt%@%}Y#LM$Hn2(TiDc`g`7tR`L@*!@gDh{3ld9fR>qWLbe6lo^QbZ zWBEPP`5w1vMpM~;kF6Fjm>-rpnIA>D2j`m+f|Xe{v?n6^F1?)Z-e+Jh)8)S6|tFpfK1wmf82^!c74)8fouN#R}J9oE83J&bme!$bH1yQ04Gqh4=YY(Pom z0R3&>>9Jv;Uh?UX7Zc&jv%z;m!aSQz+k5<&@0~FM9qW!s>6>rblPh4ZWjbwl@iaR` zz7bq;|0wdm3cldM`zgAY^0Yj-=A1X}$@<;f{-@*le#XsY3Z?u0Vo>|%t z-n8++)`Y{-vpBjOBFj{7;ARqfxuRFd>#)*d(Z0dk6dEzqC}17MmJ9NJNXCS%smi!P zVq}s+S21mr$;jS$EH0m8j}m?{rbQa@Rm))4Bb>t`iY8u8OzIYmIfnb5F)S4=`yrWc zWwGzuyAK%&mK%@GaTZ~0KI_gJ0`~iQy_(;3RbK_10C;brejXEwgbx8w1PirsbdURM znI)GXj+tR3`NtKSRnrlEY5XA4(aIg9jAU#l7CKs1rYKok-aKyiH$B2YhB`Lyp^M|R zKAB8xewhJshrwhxai3u+LC+w|t4#st*oJ1Oq5YMHfZcMLRYD*Lu_`y9BLl z^&->hl=WAs$71DBe0Ar%Pz3o6ZchuboyeU9Oc^_l$Lz(_f8y=0oyRK+EOa^=h#l%U z(3gc49zTidP(Wrl8-KuBt;F2UJ24>lj4x+<3|pbjl^x3z6z6->D5EugMUkb8p*F9; z+?q%8vm}ZfnCZJ(Y+GRiWu*EZpQw6qY@OPL7r{A|s@5lPvD21r%CyneP^sh~{B&nsv7vucyHL-jlYfj+tYR9 zT_(|;2eBkG?a$vALn6&2VL;|;QjdX@UHhQt%JND4&qMhXEVn~UNqx*{@wKOhn_$(f zaG~IrjRGess@Qmbc6RVTAN$X%Mv@?<@N@q>m-WLwg19pN>aEq#FsrY&i{i}2zZblD z<2F)D*&&qlrT;K*%rudC@xt{w{pXwiom)(T&@XFDya#e*Jzv=LY@1-|FY- zI{x-kf1_l(4@az#S6z$Q)YN=N{v@i>Wk1?kTZYWQUd1TB`KvSD(+m2y&;R#h{kR(U zUgt-9xTLJ$vxm%wsxxyZ!?jy9^j9+b-8x?HAtN(0PWj{q8B;$+x;qfHoL z3yJ;y-;3TXCdWaZ#;eP@qaeVZX?;L8vng&|L;=C|K9ku%ci~~jI3^x z8)c*!S#7^d_x}%i{QCFVP6boZ843vAp8YTtO`M7)Vi#*k7;Du{@wglH@5}v?_rFw` z5cv;R{bqx8J{X^n_=zy}{)fF2vPx?m8z)%fBsAZv4pOdkroaT!;Uk={B+BJ{8V?Z-$TG2@`oD zHrT_wEbUwKtEF!)>_W^zaKM;T3GaF)CxTdzb7AmJ6z3xi+#5grbR_;J2LmWYXkytX ztg15yL*ZD@(tpU+8p(fsf!0RVu2-O)vb%KC43fF4X;A#yVQw@ zcK<;7`W8ipt?yO9tv&aByf)#U6OjPV=t#`;vg%f0tNaF~z2m6KG1D1gY zeSMDP5>w;lqYc}f;ES!WasxzSbH>@RtucZ0aZzQ}g2q103U`EwG~?;P!jOMZk9;DT z`ZY1g7f9R9L1Gl&R_#cVWBb$2t7(bWm&PkEyn`c}uVn?Ex-8-Vqtji4*X9F zMJ+^`Y0_LV;S$T)=CoL?2yHaNzwYFnYD0j{U}ih{ye5|y|&0* z5xS@HSz@-}`6flMHt~t=Oq*HZ2^*?d1)w^o)@JHzy!x*Bm)fb6pG)wY{v3L0rX~(M z82@Z71Mf6|<#`R+t(XMk{;0VqudD1C;N}q#8MT*K08*M;x$4c^rC{L@$nY@-eR>j_ zZ5(9Z>Rb8}Bx&E@TTuZL5Sft4o*r}b(69vnF8*<2bx6WYKh8emQh5OD&K&D_%DL1H zSZWTthRDV+KqDh)&~jNEDqc0lJy=aO=}o|8-~`JQn7`D4t2$3SgbRnX2H9U`P~Z!%@71wTGO+$HrCo5&6dSgA_J@G_jGR3h!OTaPRuCy%yQ?7l}|%EEyYzyLpvGYW-%jLzJ;Q?6YW)NC`HnOJO?sP19qU zuy1p>OZ^Xo{AZ9I;ZTat;d~KiCMP~o=nm%6*_CdUt{iJmutT9 zXHSqxlqYWfWYR_aGwg>LT{-UBYebckt!bxHhmf#qV-R|Y)UATc?(&$|_LQ}Zq(8Cd4>#Pa z`%N(uOt$?~><-S}FaqEzL$9v_03^nmL_N6`y&_!QPg>e6xVxM=)IpjUd+n}PNjOt_ z9I>0P?I@9va5MaMKU?hV>ac7tO0O_8I|$!;zi@Fk8qwoucWM6>4QbpLp2~V40sio`VQz&hA&xtow8npwe^|4h@5xL2R%2cK0j|1Xz_5ZyO6avcQU9mcsU>?sUF>9s?kux z@lNC7*2(LFD*Sq$p@-Cb0@re*+aE)LAJxXzbaQ2~&`!EjE$IJ5)tTKoyOq1lqQESO zYT(D#y6YR?_j_;P;hzGjX*DTK)@aH{x=|vMfz)hbW?5;pX)O+zien)|U2d)g|w{<-C3!WH?;21lt} z?JMs4rxVy}3QXaN#?f@tD1!9Ft72w15()84NU+KUKZ&tseX@()iku$B)J7Gev z^7z{|N3JKMl>HERmzWmz(Vz~Y6+A|jCjw|%a@y+_c%uBjkMfGqT=M9~q~;%gI9|Eoh=nYe5?&C4CXGj?O1<>5VjD|0<3)cb+A;f_;_Vh(I;Rl2b073V`jQt2n_XLNGvhmU%&3fD_cDPQ!*-xm% zC^g?2lsQ~Sf^q{}q~z}(xJA~9)yt{8=O(+nbK5*!4Q{V>(zQhU^QmW#<=HNK#0cBW zYfYz<#JJcD!VqQKkCtxiUYj2jeK{(d`yb-y>TH0T+RV+nJm;-{vwWaCPLC^RWjGbc zSoD2hQ=dDvCBItf%<9+-2@ULOy{T_*Pw&XY)tKaGnNZA1B}7l5%-jXwA@@WkOk5OO z7k8JN4>ycb5tLp7t`tf9L0qmEkLWcpW3LY~OkSMs?+Caf;vdxv=T zIJ41YO+YrATv_i%S@kJ~1?WcQ{1fyKnrdoka(XY;lvh^*>>4%;*Z#s8>tMLp^}d$a&O=h1**N^lU57G4_$g9Z!KC7;HBfA5g+{Z+-PhZTJ zTKGBvW%z_;o)}qpOE|KqSZ5My)^8z%Vxu}`A&6u_6pWB^D@unMbDVDTjOenGgx-Kmrg#6ee>x}Teb1!K5cMbFSPK*G z)Y!I|NN@x;O>b6w4O--L(j7TCPLTGk>p7G!OYvDr-d-7ScI6wIdoyZKkk>r^s~ek> zXCpi4O^9xgq~2qnueWLoIH9H3PTpX1R*c#dQ%U?bzTLaMO0$5mK*`u9ZNJ^DkH%TVJCTn zL#t;CcJ*|V>-@6A@*AiRr9uf2tu`$E`3J!4(dpF%yr+;6oL&@>NoR@QiEoHATc6Obxyv`Dc2bX~8{QO^3~_D|DUBYp;W2bNE%&J(sP?L! zbxceR#eHN~up69K-)m0|py=J_^!BOi?CZy2Hq!|Sc;AWXXv`7o zu=`B^xwhIZSJv;}*tS0@Fe(Pbn%FjAQ-cp()O?k-JuEpBY9d3!qrhH{a*}qo;`eeH zj*yPrj7)V5Ha~aiv9z(H6V~bAnug}&ZqJ5iuFcUL`Ej!%DhiQ10crbWC3=3-kmHSV zxvPw%KPQ?}Kf6RHNgc1aDZd7@i+?c!VPYGqhb9_9$l}0dHbrVbtNi+Xnv1`O9p>Pq zpiRW`YC9+APB@!#A*?>!Gi^8_%V!jDCActXoY3rs$$S#2Y~!KDqSuelll)CBt>sJx_#hcYy%Z(2jR|o&+C&)9$yjdJ)?$N<&vf2m47&>vj;!Vx zvq^?wQuq^e%;f#)ydX=-S!o3EJ1RAU-Mgq)Ak0+q9b8F;6udlQwY;}G*_py=-$QYm zKf~%!G#^%b?Mlwr8~F#n+r*OXIuRIou~o=-=Ki6kp~K-i8Cc)`gJ48RvH+-;7YbGx zcph;J;^xK_k9qzaimojg&T;f3Lz^YShNXGLWu(O~ja%!I0~Bi72S)viY;Z%^n4Ikz zelL%U!J`?CNp<=ibml}d0gc_( z3O?nXKZ3{Y^fPvlKtD}yiSKCIlY8xm3N%olPIJw}x6qyu?tNZu6GBY-alG-f(1ldI z<1I&eOL-T)U43#wc3Y1zf`{pf2f5>XUhO9>$M~us!s`Q&OU+mudR-w-*4cT3P=>DV zs(gVk8zG*bZYVl^y%Y=vDvqIk` zhAwip1WiW)g<;e-pLuyK;sZI_(p!=82}m=VTaJj$E#~b)I&kWKA3`-4B|3X$D8;MI zSc{w)$$uAb_xT)nVYGHn_BS7p(Jm(b9DF@X^gp$LY@!EDPLeXq_B3}HNf|ujIRSj< zTHjBfoFj$k!K~`A{3UQ~NuCHjVd+hFEc7Hu4V+~QHYxual;$A0r$_BM~mzO&lS5Dm_Q z=IV4)pY1_46m&NrNi?BjF2`4iS+TxvcA95J#ju{A9P`o9i9Zh72SMRzt?E7`oY^@T-0% zaeb1x)!=YG{dK%TxV1T`0&_-D5-dvoMygCAbOb+xxnzl59t6cd%N51&HfO`L==ZCt ztsP^hU=ofS5E?k1NL$$|y6lQ)pQIV7HqA4Y);DnZWl$$}CY!JLdwfP#tDoNyrsgZ3 z$-?Uv{iZUjk&^+V*`u54Jsp13Eeog+Mc~fI{ zeVI&x!;}1WbIGRrTM1a;XrE#+robx~2TG8iFpv~-h#vMwU4A!d z^th@`PL{pqz+zcLQBloI_^l5P^dDOXNEhL?@A8l*4X1Nre0TWFX+$sXjK_PWAOX zV}2(MmuuEj>1EEg6}}pZ#1o>^1j6sWXGwetu@b<&(u+fp;V<;4qY~Sp-|5X%kj@Q! zgn`29V6h+uT6G)l6KX^cTM4%{%)ZAYuiPPDh^*{V+a-DanEF~lp{&hR5C;YvQPaot z^aSO?@|Uuw$r;y*+2Zu&D^Kf*JBTC2*@`ylIv45%t$H(qSpwYRoAqBsl%(KQy)%Pvr z@n5j0jQ4`wJtho%^8?rp@(osJ=`3j5$;7+hMMUysW|U&ek{=i^)p8$sAooBEPl9jx zy!uEFBGinz39jLi(40PE) zWAaNKa?IF#xU5s{du!J0^1*IImM+P?*ZB$%=~!>&Y0A>5X1dnOYU(^du&#IixRD^4 zzgNMj;dCbV$@c&zHq>(4!@Y`Me2B0r;j{7xZs(UHR)S_+&e`zzk^wLGp_KO6kb_~t zbKBD)Y2U60!a{D@6yc7G2x5eX>Zw?6DxC%(nb+(wDgP5(gt%=sh5u$O?^Q}(gX%{R z4lz45h1eyYO36oF-gd(Ck5{w_D25mxCmyUum)=?dbZa?|kBRC!w-OJxF$nU=v^9iy_esQ-#2uF_Cn$yX`*4v$WFv9UAH*l z0b23LRw?3BWExe}Ic~Q_OZT6WJA48H;;CAlP}6&%ODPPmDa(<|3709zoct8a_xi0C zd5X7P4`R>P1#P>RQo`oN+o5Vt4r?AzfRq7#dDZr*tYswxW@)bvMjriXfh*>ycF%Ye zecznd!!@cMRtl&mo{361|CnjH#$&h8C(&=qB$<%L=jd5foI8-#lgUEV;f>f<;FSx3Zp63(EyT(Zh6iG+hMCf}P zW(rNv#2!_6RjZvqs7dS2EAJib?$e1vs^OKl(cp*575-u)PalIKJydS-g<)w11u%+D z&v}tghsuM8tL{X-iqZJ+3$3yHyWheeW<#FQ^z-}-HFq)ZU0EoLyw19^eL(n^n6rq^ zG0}Bo7#@{ESP&9v0p&isbl*_8Dam$*byUXQc1@SdZIo>AcL5 z&$nGg5mV0Jaoo4mdh>^Pf$Bm^2P2G|CTbNq)l}iF>??}2)aF8scFvz>KNSeVo-?`F z)Ua}A7m^0t^-=zfXDIIS$7{@V&*7KW=e##a4TL7h8r=t1J}kOpfS`AxiXPCy5M^DY8V4WV0NUhqNh|M(xlT1eG+~5MJ0kIKlxdtuS-)w{v6%&12Ij5 zQ^?jB8aCpuR2v$r{tWLqypaN{>5PIL-JLll3})V9Ra(@kq<)#Qy83bcLJyu-rlqAw z`TPv&{N88mkX=&~9b~)ma%!Imv}=}TgI{mMLHWJ7QP3o^f0l-LbNc=Lt-g;s^q0dS<0BzTtF$J3N$b&WBi@#7k3m?z2 z-zv`hc<_-h;W-JBOh)+U>r}CqUcT>YdBQB*btZdrWR0{dDEVAgmYSz>gkgit2X$M< z)6=stE0$e@C%6n`ldanwr3aA)`wlPbhW11gJmQ56S27|qpQddokAPg8I#y6l9R1#c*jfkC~8c2lH=*Z4$CH~Z!>N1OUPRe=UUFdToHsT zR&yUd&EX5bZ|fC%E&5KDiO|F@R;}BpF*QR2(|_&ou}8A~_4Q80(i2od>d4`pXAK47pJNO?)Z1jA#SFSo z7i_2QJ|k5D>Mg=`hld7dwj~C+lx-i;VaSGqGDX$oP-zT0> z{WZwqE>a%qawbt=LgL~XV=~GYBT=a*-~8Dd81NyCQ~QOEjH@lr)84n0jtonJHV>W( zRMOkswWzotZ7JOG)BPwIC$EhREM}kI0m+|A&Q0Bn&U#$gcU;kSTlQkawwi(BPPezY$*+l z){8&(GdXQ{Jw7TK`UxAQ!{p%I4#q1gvgVP#D#%;zU(B}{&RqE>Byl;l5=a+4H1O2I z42zko+-OREvhCHLGv+*49eAqJ*=hLTfj1joDwb~+%Zj;5E(pp0D(8#*-GTHg_l!Iq z&KJ7$#TV5E;p)hq<(TY{mNZkEkDB^BY)=;6sTR#*A#o|v-1#*7)o%A)o-D@`!G+HF z_bF*^GKl~gntPV!c}5&u9(A$>N@tSzkF1q>Re~J4`-K@D7Sj)}gOk3^m^rA7@mUve z;o{;2kbXx?RDAKsy{6`&o#&~-TP99`E>ALZyy~)eJ`ZhEetv7tdqIZ{EuCbp_;3-* zc2Qik%jPIl5@oeSIV(nGqUQ9N_ z4o7|QMNjsilX8f%NhX#k%i((4-qKXlK=)Mw{_bXA{|YOW8|QvMM2mBYCAG!Q%~r@` zS~+4Y7jPToULKLWCuBB4JtHS@-bS^ydNP_AIMv?CRc#&&?UoyuW27d&=Uddo!)xQQ z{ADqwY&dBnlkmfsX=BkdP*IUq)}j26p6Pnygh7_s_A9>>Oj;FW)Vp3IYN~{ImUf0S zPYKtV4p3=j4tTgCV3f0n-WmuNA@=@b{p5sv3&gW)b+z$Urd*Wi!cohC5EQ{8O&q(y ze)u6R3?ty;$S)1*ysw82RXKmiY-jTpz_}}+4hnknk|%@AarRF_bdrRoB8yp;+rBEJ z)jg)Ssu%u0p}da1Y_)bQbm@lMPL>DdLmf?C%wn zB4P_P3JCcwd3807$xkMxQy6Dvw#tuo6#fov*@}UdSiRGeif>hKH90j8i7UOGv{48A<>2N^!NZlja zP*-|LU@deg0LufXVpp^a!PDVB-q-tRKIIzW z4v%})rT>J$jziPdC1dz86`|EEhoHyzIp2nE3Fd6R=;-<6X4&98_KftYC!Ei-t!frd z+j@OC)qfQT?W_*V9{ed8uDNJM-!VqtQ9jXrjz0@LPZnj+Wh>GI=Q3i6a1CCELvG*) z!Xo2yetjc@`BZFAqU?6QPMB19M8n9G-p|=>L5I@HZQcQMNM(2~dMHr_v;4Z6*6!-b zORBuntsm;NthKJn1~XfQY)VF1j9YRhd~e?4(jCrP4Y*$Ze21)dLo;X)kUqG_MHFt- zcwBCvBRdMN?n7MDk1JY?` zZsJkBw}+Bssa9K`G?tq$-fGfo<+2gvj*B%UC|KP7dKR`_5yjBv<)h-|Q(|F00v9|Z z@Za1iF$WyJGJFOLX=oT{FmL?nBpb4^6Nv>blQr2kWs7|+5WM_(H45u+O6u1#ld?A9 z-hUcL6S{a{GdkLZerF{2OaiIi@@uo?)vpg{X3>U1$!)d#HXVnOOwqriJ>*Yw>@-KZ z9Bpv1+uR2`;@XxKQtvQnBq=gn3@5J@7oxrfyUgm%06zr2!s`-1YtI!GDvpUOMX7LJ zXh1V;H~A+I$ls55@s}&6#rD<=59YDuux0Z0PA7jfpRU(NYDh7wz$#y#kQ86uztEb^ zRKLY3y?&O~Esk`sKUarPQ}4Of$i;0rd@Q>@Z>XW-o|_G<`zhq?{c&z7ACUJe=42gK z$H$%6`PUFpo3?c64X=MP-Db65&1G!0(W|)+&167)K-~Gkw8RF#bD5bvjOdfA^z?Dz zI0;x2v7aM9JJV!ZGIM8Hu6yTI#0QQx)`t}-`SZ}nVQE1rXY6)HlMdH2{BYMAVR$Dt|xC|dgL0J7`ot2ryNQy zzRN-FBP`;1^~+8$`M51mWFRFb<)%J-OMmtW!NyIr&uMI0UYso!6*KhHh(tzC`%uOx ze3!IP&B0Qln&`SnRnxCP-u8Sepu0j0bZZ!2?%w$ZmQWtY8MZ7JmK@}M_&R6qGA3B0 zDeJ+r*4FhD4Xz97ga=mj%z<5`%X9I#93sIM6run_3Q=BH6-Te4vaG%;tE>gTi_eptp zt*))*t&EO)ZRImYYd7i++9&S_2jvfTD;FR`_h0TA^ex#sJZ4&mDHZ>N;4lqZ(g;>( zwUW%%6q}*(pA?2@$kq2DQ>a?=d=(Vyv+CTl`UDgtJ{C&SnYsXK)8Koc**~9hee8LB zDJfxs{a?XgO1a;AfwPz8JpKk|+r--CZ|K0rXmZIrIXCqJTk`cw=KV*b94FS>G3*Dxj*Afm$|iZ36$TbQ``s%fr=(mk|{+p zbS8ra?Nz6Ed*w?cRBugH-q??}*p~fvPe`;7z2#{Fe+s}w6CRTN`J~9pY9-u;J_8Ce zQZN=kWC*|`Mql`t9SU4->sen_6))aGT@)jH^OlJ33BO&2X;J&7OHjUJ#C7~Yv5tf) z*sDCbGx0tC;M!_*EbTU+Yg^^H)Xv86(M~sj6Q}N-9xgQ-5X4;zRPGz1=K{O}lHC)= z`Gf8nCB^wh*{n3S&QOO941us1U?B-vqgNcFjyrG!W1z37>yR$8f}19yy$qw6%}Lbaa-Guy*)~yM)W@rP1>LRpwOWNHeyOhvM@3wQ^MzE z%N-nhxysk4-tQ|}PnX_Ta{n)iL56xeFaE*PcHknh{Cg!O z=;xt<_i%oLCT;OSUH=fFdcLH+pr($D^icD|#ew5_+rNXF{8jtk@E$;V{zYuQ4e@~4 zI5sJTdk!|H6^|WZrEL9mLAAgBvr=6WN;4oA9MYP(^T2!wGHQzRAKR;ylvU1uuumG= z|6y?_R_Qzb%kqCELn?9lXQlFkB};B=<8g3Y#gAKTtRWo#6hV}YnpL(ttmJ`ds-9E4 zs^dRg>W2O;+l0mg@x+&dbogiVi`(BVC89 z0k!QjhR13M4C-*zmEYQbh)B;py-lN=y+Q6zTVtV^9zWP~)EGY`iOKJ5^LfbJ*v8)2 z{nb$2S$}E^-}715XFUFpw2V+>>(s{MAkMLA6+iljkmn&Amf*EZ$1BsO+(_@n&C+z96V|wI!5amM@6egwJ|=bxib z?m`U82IJzkK#=FZUuu5_FZ&O^SNkdjV!X-K2iqY+Qmc^GGV zUa+|v#*(a+3a-28F-R)-Ie+*=#TAxyU28Qz*Tb0gND#<7mpX7>?#Wy*A8t^UY(#IF0>7{J+NwY%5p#vZKTX5;i&W>0YoXPp>Y#FwX19}P_~D7Btg_=h zI|kNu=m(as7SAS`_4egPuD^C#u`PCHftPFcBo>*mkGJ8H-5pa+dadO%{zZ6PJ`ubg zQcmYLv~EK{zT_%^C+WuqSCGP_tilN`Vgq1+Ti<7Z&5K(7h5Nsf=)Pdy>1zpCFWn#g zU0rUU<=2v%Oq-lL^Po2THPzWr?1dZ>K&udX4yCuS?RB3SjlKw$#k!ME!;Z-78V5za@QlN0&#Wk#IU@{*HubM7$Z0sRN0{3+9phmQ75Fxm#?fifx1kduU0OUAkqW z53OlkxL%BgrtK-gnh5IRg8X9ZO20ZMmv$;!3cPkb6e0vQ3s4>)HQdlBW>q6bPCLc0 z^+$RNa_mpa4XG@Z?xr8(>iIV&Uya548NoHESVg>lFI-=}0DvdLy)L@ii1s+SK8hqt z^`A|0Lix7wrTM*j@zf8}g6X3D*qB1#buFTQkB(p2DIvdxH}~ht>+0%W|1M}~IG4gK zzH3y~GoiL8bZokTbTg%=x~IOx)FV&Mc8Nt+MIurz zI#-MvJ=(xu(*m!oAj8vh){RC@brL-Dc0E35JGEL-v3+V}6#4RV49~MKY^+@1qSt^})$UsYc?sW;$u@VlzUn=HPfnISpKb@xaBUeN)00^MhWbDgl;3qg3;H z<&Qeb8T34~gq4UK`K;k=`^OFJUzfZmL?ZkUxjGKIlS1_=Rm!>%%L&)uPXj9pF#v~gVO80{(LdDwcKVa%qVhaYF4T(_7i;{?h@IhOQJveuyb zQlz!47Dl1z^Y%w&+C3Z3UN6?V55B9#Cyt9$@IIi)aloZdaMnqTzpwk4$xt*%# zI&Vq2hFpKp)qv*%90GOZN6s3$UQ&;u7_Q9-5Z?J>zw?+^<1{{jA(ciub zr)IAsUDr>1)a-Ad&`o+^7F){b&4#}NLm%(o4~5Yc!D)8rHJ(&g{n^*^$JJYos6=$s zQ3?5dn6k{``gLE0)YKjHTd`6Tl zMQdy6<+?l%Gg6K~Mm_-NLFU$mUi0d3Q3s^ndJAv20NJ`VfDXMa*1o)5{Z(H`$G=NR z3~;2k;F_MxGc9SlKlp{n$4B!m{@{l+*peu_xY6~WpkYOSl?Y>S_A(zn%s)63Jizz) zd`5U&S8O;n-%QP!I2IUy*rtOZ4kZH(I#&~3-4u``%& z71Zu_xx2K|hFYGp_JH{mIw|DTqNalqh`NwSbG*!WyOQt`;>> zuT6&^3%gNr$k4}(Ev@+TY5VUWOc=qgry=8#J^;UakWk&UpW71KhoRw8(T{)}!R@=N z7}>W;$sZzlPU&cAD;=OW#8)SK?LB}wuCP@H^)`v7EPwECDL6Xm5+#rs{%;2_=%dGRs*nU+&0CKVl@-RdL9E`laS1 z*G=vx;)iP8v>A6j_l|E_A*bj1)NmHY_i}bsl`0dTj6hAL2=HXzpJ9fT(~66BT;Z)$ z{dvZj`z{^6zshJ<#R2zw*cw5`$>`Sn4EP|r>pwM4d?Q&XS-!YeABWp71)?tmDuG){0xd)+$e5?GC&F09$&F|869yG{j*~_RQ+3t zAl>iH6Wv<78j0^)5T9?kwG*c4S%q=+&CYK}>q#hDYr`Ch`?y_bc?LZkh1h1lE$#R7 zd03_cD7)J#FU+#&-)o-4U+?9_p)N96z|yp|N`WRGaO<^0=u~oKk_UQ3ydta2&=bCT zVDXMnON*rI#fSV;YoT4p6a&1)bYDuLZA19B^vHNmEwsg^IH=yiOLL|>MkDJ@5fiBC z^F_j1X<${e$n(ixTN+8)UmhOD6CoFSU7quVYjc#V1NuyQ){yM?QhWW+jvhA`4BZ+V zdoqp8NjjgmrJqhXoPACjYY6aEt5yG8@cq%G(-kWON1r2c+Ux2A_gKSX%Fa|Po3g8* zg;1-*>-wr+5$jQrR7qTO_538kZ7LO7+Ffr;pEm1{*uv|F;PfFkkKe#{cW&Ya&sl8(RE5L0=8$9O>kZa?&RFE3Iy4ahA zrTSLsOh$AbH+umttrJdt&OG3pM(4NI#}hlNQi}}Ojhb#qZ>_9HX{$2}2V4o3fQX*u zxEkh*bvGazO)t~*bSFq%ZL>VNjxL8L3yfW_0Zo(h9%TnCM&|`l0QH$?m5MLDC$pc3 ztX>?SKSlmDo0l`9Y2nDcjDX~iFeELgaZrbN32PnP{JHhhLaP@<9=X2^LJ@<--s@ZV zOui~_1cQ6!2KPyPuxsCUkK-E6NOE5=a-d(2Ivah5)$fIw8PEA`l5yWCpmsypNwz0eSI(1?wrE>l zGmu%ImcX4I9%KxSjm|H&gnTde%iWnsd3?ORnRePC?y~VKeObT|O6$ZU<=y;2~^gd$)&;y7<7rttBj;uF@?|( zxO{k)K^}6fp7>~dY*5Hb<(F!sMK@th*X4^z>wM?Q8S{6sMLX=3N0*;eao4wQtGKVz zF~?`qFCdJ9teNvRM8JnDF5hxn^V>sEiK>&|dMVB~apZg?_z-rmR;j^1Q!(eB3PziE z@k>Jv7P){cC?og9I&^E1N5cR%3g6Rv;i*I^)YEIfA+E;-x7bq6ZJY z$AA|ky^zD-ry!@z&tW`?C+r@D(C4`NB^Qb+;{$x{DABGD>P>pW^G)?#2Zbm%>Wl<*d@VuLnv`5DGLuurpa~ zdGun-Wd?^ujuT+ihtuhBa?8?$=RBa2!(ez+zzFzA?{% z<(g6nt|UC+7vfJ^Gl1nk!)&JE_KLrfprhQHoJ}F$5U1z2d#w#ERnkMMEp_CV;s&L5 z(~+t^4B{YLKSgFWGQAa2QTK744!bAwO&SPesc(j{q4aj?+79YFTTJ!Q_LEpeB`skf znz~tgxe-D5C`AR!1n`0`Yhgs@twc<@SRA(W239V;%0~;eu>wOg&nnIJzpeXQIidK8Kt(t> zx}LjRz;GKqz8eIWm> z6W~3ovk#`4zO_2lUV+pR4Uk=BAb{D4l5|g1Adh70Cc>jdM6#6jh&|LAO z@={ok_1dpz^Xl$fnnPY)NW=s{i1~u#FL!6KPScn^a#88;`S=LuV};;-;pCniZ2>l0 z7TMSdVd+{o7HaC=yn^co^ie@bIzXE^ynA$*M&A0k#(dH`i|er=cu=SO0Uj0jYhexP zm$=(E%v%);mC9J7mXIQ57pW2!W0 z6i;jvwELM*PY^@B02JGc8-3Om7BBG3h}p;CiNl*|<22V-7mD_N0qvaxHUA6J*Zm+t z9YHQ{=DHTH9x`QSs9qp^tb`RK5jGzP8d)Dr8VEwiVTm&Xk5+;SUdhO8hdyJi;SFoS z3I{l@op}EEK3({vbo}PFC}+GkJMKr166uFldWTnwDJSL|?Je7s)H=-gvY`e7d{+GW z!{ZXUzUtmA+conpAb#*46{oQ~nl9(H&0h0(m+pMC;Z$FF?qMu+*bbIG9R!;y17kJzEN`}N&D4%;R#w@lxnVLY&X+>{!%Cm2EN<^6*l5_U%ENUj|7W$+=HRG@Ml|uI(hbS@qJ9_KND| zf4=mis;Bok^_1h!1o-)9cPF$GTYUXlPr3pvw>PL7m<9@|sEoOt9$k6Dw<;Syv{$Q* z`9Hs5vc}CEKmBtm@JMl+`MRyvI?Sdj(x_+cdI69$j?O%kVYJ&lpa&}Y28h!?KYvNH zf|WNM04=p|@JkZ?=L_)jz#d`T#fdJxyzD`FJp0X;C1_9lw}1a@P~b>tG|cQ^LBxrE zQvdo1cG{Xqq%07BtlQ}4`uo9uWF6i8*pNrb_-~VNBcbYlD-efhV4e04_9$g$Vc{bV z&Jq=y5zW=ss9QQD%K1TIQiy4_wkfKfoYKvVw!F&5EKS0gX%T%0olDPN{Y16a)b*HZ$~-k1-g;`gf%s~A z693^dwAM02^}}5pA}VkDY;E#?ng~%3XzS0@tI?z3$VH$ua&G_ZYisVXw&hATeZaQ? zp@MYX+KgYlh^ct|;;WFnWzxpJV$=Sa12UlsQ@WbRJ?U%%l zl$GF?;0~OlWNSOSy!pg-KOd66zn+ngZ+dA-S5Z;%uINr;_HsyFr-W8kg;a)`z)j?v zsIbP{4C;y(JlM$ok|W}Ar(f6bk|m$LR6j&}s!Nmmt*j8@J|C0kPmX-egbl=0ZQ;ON z!+xd&*r?h0g}o-u@57yhKtt94>xhUYl6vON8BD*PS(53#JP`P4(p0a(vyIVOQEcDfLs zh<3!ru1yh37(zmq^>HaWRGyhCt?>H%FmmU?U*BkzB4E3f$f3vZDsiP{_U+rql$1A- z4ikscOTP&qJ&AT0NsrFEMkltL8wWvCe^&1ZqSQ+sRy*x-a4l*nrfV`RDUr{B4tBgu z&=ChpQ`=!otchLlh>EZpiOgJ5A6Mi1% z{j%eG)8AE%CE|j~YO(@M^VX3Bj^rfsZx68XJ%3%lX#_}mt+44l*z_>{mpT8I>xi*R zXg%xW-4VWcy6#DhOWmUO1mr|;Pwb!DaF#N>kGejUNBaD95;wdPwIxkeH22@FSw(kA zz1f@`aotSm`a(o#b8$lENco>Hy|w>akqvvacrLU4yoJ#gG7${r4vFE3>SydQW@*Vr z{UC<~|4TE21CR6`kUrCWvDFkp-fx-_5a2Vp^!4B20;f)a?@$@La4z}sz}a!9Q0Qwm zE#x;QQwrEzc95!}>vI7&_|FIzI)y43_wFkCpx}O}^UpFur+vZ^p&sJb*tgE5(lE$i z7ZNghS#^9&X=1xP+mlD~U(I5L_mB?en~_~z_#uQeXGe~;Rewmj&xCa&oW$4eM3LrF zo!*ahINfFNzqTg(?`cF~q4I@r$l(r*4)}bk=Bh}oI}K1emu=H?pyRjJ4M_HQoMx_7#)GyC2V-fEMN?H%DzPbiw>+&CB$OY8YV5CLu|JL5o(<#;}DkD!Idu&9BRlU-?h<_jPXEoc# zKZmudF(4HjiDvG0g)(tDs9+8WL+q`U183Q((|%$eK* zhbGonW=Wjle_PCv?toL|*hRjtxa5S)rh<4!_y$9ne%&KKr81(_67j;TO^ka1WNS3_ zK)>@BshLKK+^p1;vg9@SSES)~R>FqYu(>|< z^qiT4=1oR&8nnD@amtz?P!!^V47jTQJu7^3ml>{;BE1dUc~CSVy%s+GC@-PO`5L78 z$|aM*#12^Tr+Th}5DE>9I?1xd~EzT*1F< zVWJ{)BZUMxU1#2DupV+>Kf-9PP3q=hMAQh<-swmQ!mt);~`XCZ{Z$Q3IWpC<1Z= zuP_(ua7{go1XcygqVDDT=A$1|l`Dh?_LPEOH=DElPSP^2B&v}#EvQsIXg|h)SdrG_ zKWIotz`WnyM3qNIu!x5-lz*jJIdjLv=6yj+Apgn;YJRX%vfYklL@i1EX>D_AN_Q2l z;kZ~+2m$6&f45(6usc6ZdO%gh$Ef8kZ6GI{4%~*yuuVhd!(T@8@T*yuo9-8a#Fh6E z!=|H3zs?wGn3=-cTUuN?>ypS`V<|c3S-}4AjeHw;q!~)g^*#*dpYTt^CAVBCk*6}j z3Nh`F=0v{Ywpx!*$pvvdniG3Z-MWcE+_-ua)+ z`}}0bM_x8<{X^Wxe;&4sx1S#ams@)kE{YihGt+26L+@ZAg!sIMH-O-A?qkQd-_|p~ z`~+oDh^d@y+sM%}=Zi@`)N2!HjJi2|J*Y-ckH02R>bco7^5{|MFnxK)7_*Hw#orzH z8w#+H6qnS7j=%3W`>ECg%9VxLm&I@~-&St)0{z$rQtCWh`s}ae$>fj+<+AbVis+Vd z@7v7{$UGC*r*^$x$YZz*TK&;-#l})NoA%_7YsJ<|P#bEg&W%p2PS~`tv7ekUtrzMv~t8Mff7MI$8Yr(?3nj2B06X#~Fp!J`H4EzM%zvSBS%9 zskFI(8|A&}_NZaomwy{#f_{X$^=rY4WzL`*ubt@1sbsRmyM|=boDe?)*fP9oeVDhx zNrB9=@S>sB9blmq1t~+Yv31sAgPcmD21z}j1nkp|Ba%duh)_-Pjh4P z_@)RC{poa&nBuPX02ku=G=qYR7r*&Wn&~`M0$(xP(ilP3x$XeUDP(AK!)k=T9>AsS zn`Ix;RX3qi6-gLxN1)9QvbG86_Fdfc+lS646XlxBcO?~q;*zs!%{vv9ax*Cqc7uTa z$1m#_tJ7S}{{=K*W$6*f_~WzDeX{g+Uo?2T04TmI@9;Ayt$QY7$hp|$9zLv{&(-E_ zRl;*a3v|@gc&3><$Kj0SzPw^)Q)0}m^+CPu6`ACC5o5vKi}^GvADd)9kK=8qHMk$M zzXpUZ)^e;j1Oc)rhExID=_yq1*BxLLfAPbc`zE4)ygY7QLLp>HT7Xs5=?`v2Qw!QG zHNWMVr3`|ko2*JVGHdCK>*akQt+i(6Gt0vB;vu!qRc39heXHGC{*yl)KD22#Mv7BE z{bR+kU)VDBMcTbf$cbkNERnS1&+*g8^6=cH5fwo$=HOYm>=jDK1@$hTJhD>(JTj`U zJ#yzlSoV2~LB}8s&ODL&r)c0g{C<1bUI*Rf9ZHQ)KV@ixfBwE-l90pl<2%a>9ejuH z0tL3k_ghW0vxjq8&nC4Fwd~&|$>CpDEtu$KFcwCCvyGXkqm z^4~ElD^HIDzZFp&-})bi@>!0JWUSONd-$izWu1ryuJsOUC2GAH1p0f$vu|)Ij^XLY zgY7h}GEye1r`!~bJkSME0hQzedsOAxqs>=|UV87--U;a^O#0fQ&}z4wk<vMx}zm zv4vZsFv=GH?K!aqjPB%|F; zcR;wL!hS*wX;{{_I>F(8z5t!;&pBh$~2e&?~V<@m5#moe9K&N&;7%us6iw zw%|7I+0x9t79uh}G>vYfgls6U zx5va>MXCwuCu`kYc5Q}+i(d}(O;`*>ssqSHY)%*SfD(RP%^bGPCy53qi_@K_2BlYz zBzSpI?keS;M`u!!mo`@ZP=WmUX74?>+f;-nvNL4A$QbjbeYniTX3)yS54+@ZJ{0i^NT1ZQd;j~Gay4XlkCXNhhuwZp?z$XyqUR;5K9 zQpK$2P8hRk!=@s4_P3=lmB$ebOHC-aPc9b)cAsroy8Kj`|6A@r<4BHj(*73pt(qH(xEyV?P-<~dok}&fzh1{~>8875vVyMJhnwmmv zh_lm=gdZYmCBNLgqighE)}sb@jYs<;({j2}$6)ba=9{~VC3G1*^v-uO1#Qo;e@JgN z-?oemdbwY<#2B&a*StDy5^nWWf#VN1nh5|MCQIpW*D^IN+`P8Scib8!kkg8p3+fGU z1byA3QSWF9p`*&iG1$}8ESIw#!~D=Sy&$#2$cw1477x|KdaCznJu*|gC^vRCn7r@TJt`VBq`7Y@d&u{~)M)vn-^N9Maq)?CQ}MNT1rNV>YUYp-ea{y6w% za{fHN($5vXH&F&l&cf*J#t(rkjd+}p3_yLLiu;~A(Az;z7^x?Oar{G;i>tSdIo-oE zWRuv8WZteM%m^{?!NxoXI&LAC=ZsJ&88*(tB_yKK9-m`un9^G%X-Cu#&tE?_mUu6_ z-EUmC?Q)T2<|l8IZRPDd4PqH8AZmGUt~`2hWCZJs_(bB%^1sM949qM@8ZY57qh&F)HX_l4XlUtDCUU`2e5DW{FvwVUdoj?Hl zD01EPlsNn2bqq)M9iNko!)!o!1fj8vwNyCJhQtqz*~yR!c6?`Y5l*A>INP;6fY3-1 z3m!n<7~+jcWdbe7c;<=3vVBffH+{gKyDSMn3XfAMO9AV4ba_8%$O{@Ml|OWH8{=YS zc!7LlYY6_0s9l}@H6Ywo9(}O`tuZX1de@ykUuWbC)2T_NvUZjx>R4B_v^?$y=}K>6;6wBfnO*C#kR{rsvA~{7_@p8sO`9G1 znfkLgl;6_~MjC1v$036cM9<{G+Q8#%GRz=QhnRn(zBfwC?6oc9^u^dlisf#-it2Oju!#XZaypH9x8Lr42 zOq2uxn;^9H1pTkNG6#)mP%W4CRA_(m3oZ|Q#0|2(N5%!}dDv2yX&HDy3#=wwS8u3n z+I<-*U#$FU{j%R2LyC5s-t$g!xF@YanAl*SgF!s6@Xcp$V$($`ynATBG}GW~x8Go& zi?MENE3rFROx$F9EFFjS+TK#?W@b!^*!f%ZrIU5bLsX^OHgzW9dqI4pWseNJGa)5g z^BkURi~{xMi}Pxu#D4hh&$pDvbXplWPSV%AmsZ{oC5*jTYH+iOPi#Lk%pX#I@9kZ< z^GY#^6y6MvdKx7k$qGC&b{@>PFE!*SyBX@G^VPUD_^1!uRJ0v(H`1+k1^~L=C7wqP zbBRi}#rRyT;F4c|zQW)^z&E5C0?=;)^z^{2xOpz`f8IB>>2F}~d zTToA4u&n=b_{)yvMjqQwmVeJgobUoK)^bFI3_!>q-)S1S zbhs-$JL2{5+~9Ms*{{22*Zw!?fq^sNxgJTTfO~X8|D-6*uu+9$~r-D-w90;?F*a*viXWO}l+{KYh_~dlkjz zkJ3l8F|=lp?iC*UQ%^RyV(Fp14>CfuR*omaZbjA?*_N~@fXKPL%nN1KWq(XIKuX_f zEUM;MjLf%oEe>-j$4PE9T`$JZN<*pMaIbS;J+md}dX3$Ovz~p%!3KsZ83R^(4!)pC zj7QA+B0ppNI@2)~Rj5yM81d)lHp5~Ut~yoGq6C4o)Ohl7adIl{qNR$S#$zKC&0N9o zMIne_nR?vPeipCElACl3+?Qv&B1I&$S+D|pxJ)xlSicwN_4zbwEQKP!`{n0x_T^DK zo#A~$sWP8wuvF^*!`^$xHPv1C6MB9?}#>?6qszqYGU`27!1X?nl)RAcEIKYOo@XQxin^%0#>cg^?7dU8*s4 zfMtm7gZ|U)E~McO2F`rEn;Kdxv>|-_iL?G~x9Cxywb`hYOrjX9+j*Zf2OIFM9^y(~ zJztzM?T2on_O0i3qkA3o%h>#d>c@>Cqx{ySje1c0leAh(pP0ZZFzsfgWhX0u1Nt@8 z?Hn-pMnkkzy{2~}MQDpDA$yp+L*XC8r>gB)%(2zux_Vrb)%JQF;l`twnR>zc-Steh z8!Tx|c@)AQJS2pwJA6|$k9X8ceAc%sJI_vg1bcd=y*DGukBUT{`!L^vE28jf=g7oL zQ;$YVdBsXqgj^VLOy8lWVe}5)@d}f(t|PaC?X1uG8>V}+Cj_TKeqZt9iS-zFc&h7K z5om5k_qL`1bNuc$PtcJxyH!^sigY-T*xi~L(R&}VVg+KRF)z%su_t(?{Q~r7SqEI> zgZ5!0p3twdJslWzq+62e)ly-VzK~e8KV(lo#~^(fXSCPVpqC~kadftivehntEOmw# z1aCe@0!bP;=5IQU&{EuVa(e$Kz(RV{FEThe+5E{E2r%duE|hc3lYh+BezS$`X}{Ts zF9?3JxqWOY&3W?lg;kJsQOW!X5+8GSuc{&cewTe7(cgh zhNp?NWBIOqAQQ}zvRAxAcboi-)6D~0!YG4kc5eu_%p2&Wek$CTy#pZ7hS|IQrD++?js4S5Xzoq76y=0U=%3shI9YvY?pL<$yIlh1gG@!u%fOu29>iJ}b+d8WxK zTScHt(uRLfQC($NjbMs4EQ9i&F9vH>4&OFZ0$Hl`QUA6UqD+>!e7aV{ar!mJvem6k zyEGriKt|Cb+*0nX6Jh~6rtT=N-W*F6<2!co-sx&8F^)|HEQtxyZpLfCNGD}YAx*7O zrL7rt{D#rFkJbtp=N&p4C#SbIGM0AeukCWS8H4$BA+sYC-zT-;^I_ zykFdu0?{tZ&;&f%ppzQ5hXov9f;}g*4WX?uRc3m6RId-Cvi#M?2{_ozYzCEN;Tzt* z88%!eJYRg7iVc{UfN@8C_4_OmL#|uCBiWiKT-Uld-*k$rgVW- z_p%Z@FQ1A?RGZ=LJr1j424M%IIw?rMI^>G-UAQTAgmI%AU81JiYvh&T@4#9Gsr_hS z&3=F0aC2yEpx#o$_O?d7mfXANkXFcW1y5?3$7a@Y@MVo>x2^8=#yyGn7;+f=HDf%l zsVO~nb^aZapu=rav$#wT)C??gzrR$0+RS7Zrfv=m_Xd7X@xl94hsj+H78B*h;+Z6b zq(lTZEq5!}mY|1x2-Wqkx<1b$fDzY{HTPCr^(XKd6c^6-{Symdaqu@Au9#!gk}kJF zK|GJbd8SoWRScl=fakykD&dP1K@p$CXgcE@muIAF^*-jkHBabnFdJsKzWcZ{Ifk7| z2Q`&yw9KzB&h2w9c$w8<}l)QP-kR|@lD`h^=7T6W`~P)=%b9Q9p4QCp)uqy)Y>wSWn$`kInu;e(wJ zfDWjl1_n|DT?bRH+KCHCmH`7K^uE&MM(|}_MGjmZYwO!i zmP8>H5+G)Nv^<=j|EfXn;PR9Co`c)E7~i8ONeP7cq2MmpE1`SwyxZzyYY(3o*Kkfo zKh#bkRDy8LW`m2ZpEh}r><$SM!U796okB~~YvFMEDEl7AcQrLrQp;iWk2!$X*wH8N z15SpJkESLB&Q;FT)k?h#TxZ7F4bNy?FD0<4V%?grbmz+|sZFXc1!VY}%Ml8$wXdpi zZ)3lSnQ13@D{Q>t?jCq>b%h3Yzzj1*ABP-8gUJHe52d_xA;|Cbhi{Awnhho&UYU=f zD)1_bxm5jq>-xRj8fTF1tPTxdh$-4XZ0L;{=t;h2Hg2M+iQu)yQ4ou@<}fLIFZ=RJ zs(6-8lj_)UeXOp3cvQq@0MKp54_;1Ad7RtNH5y`tG0Chw^!Ie6O`ZyHD?B+i$an8t z%-0WgHLJ{J=U}^`p+4lSI5wi7zmRm*OjEz~tL3N_tCWP)^1T?orl{E1`+2uhJv2)9 z;v@Kcffy_2E^A{=deCDp&pZCoEnmLz~&Gy$yM$c!9;9-T}#+#f^S(JpIY}0;q}#KSLtoaD+pt zLf0*e9wlK1uOl$bFf}m|a1!)GMfzQ$FVQ1{rkWnfosEN`RWtSYSQ#R!@N&9yya7-A znbm3}$bs(T`N7|*tu-QX14cWwQNyZGt5w**84^b9Hog=AK3iZ21xXP#6^^9M-e}iZ zw8Q!_gU>zyxWf5y#9Z#Vw@qW&3d()mce(eO~ID-{!Z1*nCg$fNmwr@av9!}*;AhS3S)6P zGt-#7)dkxQ={?Qz&vWXImoplB1es*#9XO8PZ>v! z2rE4yYEJC&NZqzl(H!!MWb}1IsER!7Zf4NP+XdWV^bQb`vtKB)8Gwy=GW7WpebGHS zQ(go15Fd{1ey{wy|2iKp~+<0@XL%MF1EO}AT!h_&Y6MO9Hh%2UDXXnleYhwdww3KN4v`J?O}l3nns;QlISOS*?fM%(4$MSGW?!r z3ysX)KG4pDX+DYK<{-wqf)VRVK&bfzygw`VukYF3yX}>MzFP%`xum+exZJpArdRu` z{WW)CRfL^Y_t2i2=8^i|Y5TDlZSng3;M8j-ru&cycQeiCm@2Kmj1JCO(7U}0+i;VH zhx#7x8l#cYE`5=X=PNrFa4$EjFP|+tZ~4SK0-Noeb>8nU`zli0`&`CE^rc}=Yptk68g0Cu#C^C;J2PLd*3 z7YA1`v29Tbi`b7zw!eP%8%KC?ZuW)p`8)ZPnR?49RHq6Q`FOB419ev~H95h2sR)L& z>qq6Bce&#fZD+R)N#YN-^>FO=A`<%{aBr9KDtK6Pu1n&CGZ9}A zad$;}=zfRp|I#u$#qY1~o8-@l|5ru+UrKh4dEnZ=wvYZJZw=J;uT6*l zrCT(;@`Kfka2RzoN19)Xti?@L^Nc|MVJZP;mgR5`7x|c_p>f)&=j>yUVFmdV2MzP5 zi3&;Z)*FA7FvFy@hOpi3X)Cj(sho<(@~3_i5&(>Vf+MU}fw7Q-+RDv1K1-I=A}J7Q>&`Jdh~( z>Ji%!YjUJ@JDUO5On}KVLf(bmlb4%(nRk?NCnxJM1l7g3|AtJS>~vohJ!Z6ey#GZp z%C;5F_9*c6b%7e6mu5EbxVOryj|Y-ss`Zy zpXA{~0vN`EK6Oy@Cw`qVK79XBK)=S)`(1^oKb4P{PtS(j^7)a>m!a?+mE^#LFPaI< zvvTf$m>wjLPxLLP9kCvGOm*p#%mOQ|iX6TWqGA1|H!&|QRhmnEGPLC2CQ#%H{SO*i zHJWcqH2@VxvGIKjwnj~fUrJ$((95~wu}i>Y)!INTza+=R#1tFKko_Iu34WhZgT9CJZh@hk#D-C@WvLxz;91bv0@9&5Jc2P#j0Az zw!rnZ$(smW>mYL6;E!C{A1xqWDX6(g5M6h-Xy$_liPvHR{?O5057nUe9QoK`nI}+u zj!hJL^$^L~FEJ$Ol_NhLJi{u2OO|r)VhiwGqFFNPvA)eDV`p@tAH2&CJ&iq^w(5== z%FBMxu-1AIN<%wy-YUi4AnGuf0*Z6Iuel=={Ow7ikKnyGknVOR?#Ju_;CmSC={IJe zKgTgwM2}~*DgW3jj8NuMVY%%iz+IZ5DfBsSFseIy-^D)+9IN_uuo3*Os_y9;EY6Be z9D+&f$fTnD=o~EsZ}w?TX38Mtq^4@5({={dN3Xgl&nVn!e=<;K{VL(P01UOq1DNB8 z^Te`dr|r|$PoIWLSl~qMOrYr-x=R<}(S28sR#s+3@QXvD4>Cd4wt2T=msNg#p%fpL z{QhXr_F;%D^H1I)e1j6`aqeXmq=(J3KQ~gp)xCe0l3dFw-teSHKG4`GXz*e1S;mJi ziY=$DoDaKG)FD5W&CuKRm!a6lFiqPR(d)KRt_lZ2!pOA|0B6MBq}o>)rTs(ZfvQGH?9R5luX;Nm%RpuO6kjv zwVxflHi}wr|CaJIQ!npxdpjLnqK~XOJ~~wJRS+gLDz};iSP36i7iUuNjTH3<^s!;K zQQ!K7g0-S9su+}pRh2cDeJ|p_O5OnXWVL}ANcsFIW}qLU(!v(qseI+GxT&^of{5>{ zfzvSi3~yF@J5}wPo})VO;dR&X!nLx{=~{ly)KAYXv`r2HzhX8G z${r3HUPO8JNid7qVEffBmG%9DMfJ46Ecf;MOezPsgqg~k4pZ{vFaOEty(%2TTVMd8 zir}PwH=SPg-e=PBC9&cYhV^cj%VQ2Yl`yl!ly%BM3GgCBV?tmxDy2flqF49L)h*{P zRnLi1 z%>Lp~W;RcKmZ{_+<}6<yP5E>ghj+iym)u0R|0G`gv1a^1MMXuhrI z3kciGZYXDT58N6B-R0fR`S$i^4m-!OQOtFw+p|0wQBx+3os$YYsuD@Um`zq8)i{l@ z;Vio<4ZEX<)mD#mZ#Q;h*c~RS2)BKdE0mTZg9W{Cu8!K|Cf{YcZJP&tq*eMS7J#g3 zvo9?!(Ig9x5QfHr$$Dqd$E87eIK8x_#EU+Mi5)jPyU?4mZ{8SA*Me!ur#1NBHp`e9 ze|`0-TU|(WKZmU3M9PX{60o#JZY#fNk^$#ozvEj@K>9VSmMS>EqtKqb7D|-(rObBp z^RVykQWVSVw^>%8f9>H`=IJe7BBYJ+Mws)meizHP+piS2O6E@GB2{3X`A^CBkgceq zxPHyHIMTF1GqSi&^tpnMH+Fyab@!dx@xO}*S5yR)-3(p?{ZHIa;0 z8vqXJ^lPK#;tjopHW||HHPdFhp1T|{0RV!>{|vL0Ifgxgo#1AvdN^Y_f7Su5KOPQW zhZgFZDg)ndn}OK>?mxL<`<0n`wo4=_iEoat4cwT{K4S(@l9lH2qVJ;Uc@iOSMaXg?Rt%^?aYK5q>yb0Iel3U^d@4F6v3OkB?9=r{Fgf5ee|-ogS)|MV zxOn4Tw8g;j05$4Z73k&{30d;u`X7Om`pLcoU`_xdxVy;Su(mz`yxI>A_IW?q7PBBB zUM{Yy5Sm$Mm$iTBJ3rFr^D-mOcG@Cq!E?;<0G;F`=g#n7ZvbG_#Zueh7>kILMF40l zbKRmS|0xQnye<=FDw)s-tR&EDZ*xH3ef?VD<^TT5sL(IJOpQ#r>^Wf6E~u+Lh7U6^ z{aW(6L@7$&EeI4n(A^|Hf!X}UI0_@q8Vl10ivfk-i99g>(rr3qNT38oP!{>o&E!kI z1~ToJBIxJhLjnNk1zm0d0?IE)%M4a}9{8IyH=?>uHtAneM@&J1WR!!8Ki%hM$soKR zO6}kSvsAh~Y9oEXLbJeTT~>RlM#_4$V4Pg>&Pi}ue0XqxOU27bm%DJjtI_p&$I(dehke`S1c@w6Y zi;m&AS1x%LT}v6IJ^AvJ>D&PRaN)(Q4x@)=vxd*@VEW8(_3f9cZ6pCGw?c^0MTaYHaFJ* zZV|l@Zm0j36;41N?|j7U$#^OydYA|qS!sX&n?gEnw}U%X1qyJvs)@Y%Z15(##|^J9 zcBn}QJbLVJcl`EbCenXzs?E4wl{i#t10Fhc#JglF z4zW%FSNuL_)O3rsnh@;Yy~!@1UmMB0?+j3fl{J;hzlk&WYdpu+@*_`xcRSL|#iEvO z*nd&P@3MEFW%PXFQn(9RBoEe)7WJiJ_mfkuYMtp^V7<$S^JI;PhLM{VIJ$&4)d5FE{oq~zdIbh_oR)HQK(R$EHA=RUzSWVDXNqQ#^9OxIMT_xNw-bb_jg}R7lo53MwsRki1`pF17(gIG` z#mel25uE)ZoZ+(MPZL4v(Q6+}hpBHihH+VN^fcDp~ zBFud?03ENPC}XHBZTram0-4#^@tiEpJ(jJZkdJjw@5D0f0a*KmJedN?Ts_mbY$MHa zJ?V3wE%>)<7#f~WW3vjMpP&d7wp{d}2(0`If-mc~9#4DyKk&+fO3t}+Cp&w!O0VA9qMMf{=NN@D zz*{jxvTO|FMczo2NE$=z{zKPNvPvIxK}vKpK57jVRxjZ0sjP_MeI z`AzIN=JWJIYVQU)dDtbl^(tvjUBCZ}-JdO*Ke4K=>ivL!kr*q0LM(X&eDbWFdq(I8 zXXA44y3PPu{G?ECHc=J4P0BUs7Zm2Lw;zhhrBuo&bY&5DocUVPPhM?|ib;%~mZ3MD zEjrKSC)66yfP9g7BIq3b;*GWZX-Ig1lGO-D!znVxxpR)2PF|pP+ns~{~wLQa7CUc2#0NBaJkU=b?EyQ#G+-?rpX z2B~$gs*?r|K&arFXfm#3$`>v>_A<{7+tr)*GW$eOC(|0qc%R{i*Z2$&yo_X{ zdj964`Mh{4@GL&;Wt(Gy=-MIc2I~{k-H+Au(@N3>TOC6|GcIdtfmW$AnAEcwuJQ2Z z4^yFRWT8dH^+&{M_Iq36RLHLE{%Y{ai)0L))?Q1{v=RyGk}S+x1oPCH)GRZME9ETu zm_I8dOLis#QVKZMuMtfnHC-ddHNeC+nhv@Qp zl|OjS;DOB#{#e@Z+wPCT6G3)mUivAiGb=~z)?GfW{8cdq znA=vA1>we-*IK5`Oqq?tmF?+T@?1H+Ee}yd04I}9q_3&8`BH-Ed?`eR~fFypz8r)RpauT(s+dO>O%5(am2gc^Y zAUeN%Psh&0_l+(AAIeN@Ya*KvCMmv$bu3g8lh4Y5R!0QkPIqJFwx_D81&*fd3kzdn z)@Zx`wd)LUqaSJ%Gg-d|hp9g6wVA2gCH}>@IuDfp4-pFRoPOkS#~206_1*Esj8KE~ zognfIZn9nMB6{LS^^OXO3qh|NZUvhsg@2|XAE0@a(W>HH-n!Q{PF#SB0xU zog`vI#4Xj%^`|cBp;MoE_0*a4bB{DFY-WSd#8B1^6zXSEg6YXKy7A@kO=CBf(q$E- zJGQ5Fab3YCPa8Rpl}Ma%-Z;JrI2O;< znOIpd?1NP5VG9MnrLM0zychQLVWn|T8r;ejnO{q-SbBCzm2xS^I+x82_#o8BaRfCV zH1hx*A#>geHkIatfM0yxhw)3g@82jS?F=1~P4E~C@cD|&x&7Ku=loJXEa7-$oB9r- zMrg`5Nno|Fk=;eJ=05zNSip(-;)}tycoOhYuG*k62VeZU47G!nS8Op)Gj#77fP$`- z%1D$C!0Ha4o2zI}xon7F2yKcC<*iLU4#xQaq#B3k0~^bBcXm{=6Au%s-vm2rNgUQ! zy}DFaTT|=xNXGN6SF!u;)(90PY^uOkw-AF2<-*RGF{+9PsAe|`%_wWmm3z|l9v;SD&ZAWn=1YLg&h|DK>tvUUJLwn% zXUxrc>-(ahjtts(K}<+u8_v#czckR*F3JYW3sYE&nbU^KP$ zBdPASU|OZLcDz{nK_xcju)C&qq(%pcBw&L~j2f$}E@P!#M%GyyalDXJ5J9EM=dD42 z{p$d&)=>aWr+5(YCnKTQVCg{AO;!T#_Yw@~y@17n7mQ%+Zkci2Qcv&Z;!uD#C0c_jZ;P<6*a-M^dH9~`%?K~I)^Y%b zClb%vN{Cv>9U$!~DKP%886U+FVQG=wj?1jBiwO<63~VS=-6=MMb%`DQOGwCDTf6K7 zHVh*2p(#@puCF&MvvAsFNX;O!D{pF-rm2}CdQ_k=jcaO#h5A$@goO60=M=j4HbnX+ zyjz6ajrLbY)QzeZ0-74TjH)*dfv*FeQNpe$)|5cKPK)*C&@Kb6bWnp4rqVuGRh?(_ z8ED+vo%{S4o+c&0FX8#b>+q+Pqd@?R_eO;Qsp10ujg91aZi$JpZfedc-^2eHWS`t)|1Hbcq-3T4b=?otBOgI9>~6-B>YT5F+`-; zFv|UicMi(lxER!ln8va5@!IeC=y%I16}Ho9C}gvMPO2caMeFyg*F-oB=5O?Z)DX63 zf%d-D1TFW6;)%qcbhX#-fqtaF`caM?>qm(E4$i{XH^3^aX6l@Xr_!#9B6fq4OM4oq zh-3&VG&fRA$V%P}T@@rdCQW)A^W+pCrUNpTAwW6e@4ki{sWm^#s?!(clACa!Ln5|qPylYcB%SI!Na!YvmwQdB>N+M!RiC_Uw4I~9bdE! zpTrn~;2x*-UCg=-wIzm*bEKKN^~9$KGwf^O+k{4m2JhlG73e~XVR%3E<7_fbgpb2+ z=dY8j^xQ1cl4(Sp&!z-_kk-J=aqIRGR@AXCaqffG+W0J4-7`k+PZwdcZ>SwmM_!Us z-LB8Bqe5)A0xs&#TJmVm^B=n1=hnf_f;F*^=}#}&K<$yy83EMNqgL(bvJFgWqES;N z&ZI#aHU6oZBdD_NU^%IlLh>20gZ7o2Cpx>;E|`PQ_pxC@E$SOO>o0CsO27)CU_9c4k8x!%nxc)Z0PseT;%)`0=?$TLWKDzbG{8 zvU1vZ=EqXY2hDvge=Jd3IR!e^twj58h3^|#Ocghbp~vmN1{!$DM=IlLu-rE zyo%9C8m->hFO!1l%d}ZCaMA&G%ca4|#qDQml;M3p*-w5JGKlK@2X@uNZD)p^rYWup zV;xK2lk3Qx{SvN4NpGLq z!i)&K40DrOU(=+#07bq>c9i%yWeohjyD5119y`FMP8=^UUe%KkHaos_PTW5qqlKR$ zq#kXcdxCpP(_jm>sMUZ>$CR)4!-t*;7^5O!uNAtwNLPY{9O{XaEOU*STmI3lI!D>L zB=++v8Of${D*nk+jI#tkX*Me*dn@Fql!^O4D5fhkoq} zpMIl*40boOl>=+KV=|YP8y^oueGH!ZekSDjw?Wfp&pS@8QBBF5`~eRg(Nf*kmXhZ* z5Z&mUSqX7?3^t4*d2lLs+cnmjJ+oCe~#4@zCOuB9T6vulFG zOH&59X9!~~Cfrv@1T#^QYNth|LMn+vy<$B*c!EW#CWSE!6q>?ygia9=crLTcW6I(* z_}y7z%&cHZ(w84d6WD5~kA79DI{Vl4repXie4-+- zSC=UJD+dRN2MpaM5n9ZTn@dXB7BG0y^OG+=O234n3*j&+p6xf<0{dR>KX1 zi_@HSI=FKl93R7IGOlG0W)r8PA2|W?TFW1C-w@K3B<4PyU&UsxX**)M`wW{{oNt#J zo8I@@F4X&Yd?%^yS@2<#N?{WHsCwOQao)x>V%+yv9azd4UsaFr)d+%F{kbV}vFmS6 z>882u?(S@UV~^pT#9p{}&ic$nSNgvpoj;)^k`5?G#g14lZ0g+RvSaCrGOQU@7h+*D zMcshUrLE$fbC`Lu`>HD|$8qB38x(wKZLp@;p!vu|BjABWxa6)ScGiN~cSoXjh8Qk>_U#gt6cb6RaehwrxQ-LH_z6s0FHe?; ztgBYr`>CLHO*JX$o%==r4(8M0-n>6kQ4eC4s3L)B*Nlnyu2)+JiSfQp`$+8iZe^uG z^N#vxu-M^A0hhyRL|rxR%g$hq4r)ziPe#O4I2UzeSpIOL>(R@t5sTJJFgQfmPLw={ ztK>OUuub)x3{Q*?hzhrllN7?WFvzW0n)r;bYZb1x-2LNA#)@DmVWr|zRGLE+yp_fo z7eEwoe^NMk-c$;Ej^C)34Roc1YAu=G`z|eU5{Blz$Jbzguyfh;#B23?B}IzSIQ8F9 z2R6lAdgG@s=gxUuGb^HVKf%Ow%mbLjo>gA-Q+G_l`F*#ceA!v)W2OW466FjjnAv_D zr%H(%XK{ad?BQ^b^8NA;GciG4=rkt3cY?32WQ6#c>}Io_b1f^Uo0Muf&w0^@FPVUV zFHbwWUMbUlci0zWxWqMEU6OttL33w{Sv8?#}y1X`t#Uo zH9iTyh>#zw%Vi^Bw>FI1BC`2)m@J2y_BY!83S9rZt`v-T^w*4Ucf%)`;Zb~FBynyF zTq8=9kI&JCCuCv)AfOue)jnr7Vbo<|nCF%G6;C|u`?Pvp%?F+p|0RQxb3#KBfAx4x z?LoDj?XrDyv=m@V4D>Ne;A>b_;C(PwjEY?(re%A7Z7u$WokAZ%uZat{sZ>!BWh&D% zUALhI^J2pohr{&!PBA-LT`I)Mx==zEtm^a|6wD-X7AU`YPY9D4E84U+nOm$Mg=F)N zA^n6;Q=fTtRqXi)yF-r#H<86^5+%>8CQ4D+6uH4X(Ke`S=)6P0$Mk2y4ux)=_F_8? zx8&DUy9LxQo2&jPhpTQTzSFhCCslV}O$^Z^@!APT+D;04{~?WRbn%-N6CNO#=X zQvcETo0sx$A79@}GuoXQ+p~Lf87w!Ktc}q58#m~+@zz!ai zRWvgcOSszBczb3aR(gykeWKcqcCgIt^L0o|6@fXA_OdnOs<&rJ68XMaw!>v=yr|7l z&yz}2Oj=R`v~=1k8dncGO)H(Q9437z&=6gI%~BGvnUE;8H)e}W+poNsFM;+rJ!$9@ zY(VKg6u@S_M_VY}d-BeA%1>&aXMAR6RHvnFKhAw)9O*KF_x0tIN+2KiA|&TK-?X`n zPP%07rF?_9;nCjxgz&};z=dW8iM#T``>N=nR&+E4h>1mbpwaPcTQElr;oH}@B9Ua3 zHn$diwxstG8`H$z)_FtWaM6B@0F6I7-kNpipRE~>)_m3#w!MqVDj(h-cjQ$l5^r|X zA5iNu7J#ZO&U0Pjv#WF(Qd=ug?%UPZJUis6bWEw=EW(tI`{d-c3CelrPM$G1CM2fZ z#bv4#`pV!7CZ~gpn;6ukY>$3Z0Th1O_Ls*EHz3`3A5?kv&1 z3JsOez3-uUAVV`Z;WZO1;>{!A^-w^dE2+Jm5%yNOZ}5M&qYd{qWqG7(!2HUO4w;4dl&0xO?$HlgA5vhEXm;AZELgeI}{a zTx;Zl+**mjQ)i4jyVSS07Kc-ZK*%?@iN!y$fYhcmiB+gbpHZ2$1w`L4RS>^$G|(;T zV=7}v4r=U$t3A0`c9Qs}P;DFLxTQENCw_z8BPm~wwR22b+`020k@|^>OSZ8Pe|hTu zS=?eSyASBtU!ndQE$;x#vL$q|+yHc~Adj#3_0fJa^S!>Gvr-6~#GZcRjBisFht;lx z^-9L-5OArd`Kf;)iz1!d%J+(LFyW;B;Jq*;HPFO&V5+f8*~b!}vp$Db3>oLGUkfx$ zlfown&lqo zhTN*R66v_?TH_?67QRUviqy1OPxoDU=i zsXb8$doEUvTG4Xs`JiWizDgG#X>huCse9YGQ`J67aD`~-%)u`GOCC40L2Cl51Q`8` z;veS4B2~SxtG1V^Q3~GLU`S6n$x{i5V`q1>cRnd-b<7pAr834`T$}!3qanN>!toj>v-%AJQ9J*Ub&4k8#WKDe7h4 z=k4P`y65gcW6*TDs-7OD`#Ym#Jck19X|+JpXc!gF&+GlrE@tXFeVi0_wO=qtQqs9w zK6o{wt3$*DZ9f-pK$vG05&W9`R;NZhUPqQL?lVPqn4nwsmKf z9H~+7>Cvky#aFj5{<&d0aS9|O6YsmnUh-;%IWt$;P||+UfyUZFrE1Ngff`}9_tmkw z*{u?-XOwoL>3G4sP@~ZeK4p*zkNx*Nck3qo0sL~_Ss3buJz0Yf=V=4{BZCgjsDf{4 zoyNfbx7=Dw|Ne^+a69EbCxiZeUJp-F(CdE8;|%IQ2H&QUvEXveBhZPg;Cvo&ABU|N zeA`DZ#G9Tx@^(NS>pY(k6MYN>c3n`PW84`&1$f1g<7VwA9{`{lVDA5025@iIM|wbS z{DGI#2s$}i10dv^3D{NO$qPV`7@6La@=~RCWscT-Bg>L8RI@Dr5SPFE^bhX?3R&&V zyg|p6##C`vPVT9_z1~7HqqgJuC9Nm(H$Av`i9jr&*$epf{xz-_2y5)A&BS%jmipp* zVdq?H-b41xA7&0>u*v2^l)N7YnN z0u%^t8NJq98Mf^9(Or)>?kZmL zDmT2~)vRVDnUd@v(%*Hr_omH|Ws+c~_0dt4>Y>t^B){`!$>NXbz3|QGwnY;OE(tR-5=s9-#;s|xp&`}lY&v`aC~C?UFyZanVM*_ZcTNQmg>pc=U7W7p|oo6_&}z@s~3>7!x4d3I3TvVG8-s zhFkO_+}t`fg{YqL_@3X_v@PBb=EYssI^>zXa>I!#qKssr^J$k0xVCdu8@33f^es1~ zALHg8buY|iATTzN*9ImY;ledRa4QQ@bQK!N*I-+{B7}fEB-6%#zXG%ZO;C?%kckv2 zV&xv~O2)8F<%!bB0~aq)1^OJWPAF9)Y<@XAX+KeLd?yS{^#y4`*Nrg^`5OZBSE~6V zH4Qn)^D`e^sPqx?o{5Uy=Ep6&jcN@;@^+Zl!e52AFgX6uDB)8e^CmmCqVIgJ{mBR& zIZjiQBH!`-Si4K%is)erCz%A#BmKia;eUQ$>VLLKo}mA&q6hwEjP(D~fe!!KRbX-b z$I04%q!9T3Q;5ueuAKi|IseNBkfCV{FmM;mcy&|6>E%`Sw=fk(I|$os;*B_Pa*W7!{*A03p%p~f#W^q8%BDPK0wRQxz5 zuKUxcnX49ScXXTK6+9ew5PLtRj%4aE;fqo2#;#H#(3zbuVXj!m2WIjMkH%-8ZsBA4 z3faSZZRie5Jo+Cwr*R*1Vw8HBCnpip+T7fT>5RWcNM6fa>3faeAS&oQG}%U?qU*pl z8Ai=;d%6!(uzJf~1dNKV93!Y~I9*ps?Hu>X2}-l%d=NbV_Vvb@q}~peoQ*N{!+hR-QYqnz9 z=!^gusnlBUQD-HSxqF-Q!Az<9ohb&z9@A$M)(3UY+L3L){p!pW)8JyOY2jn7IIoo$2q??{yc~8>{_XWQ^$$)dDRM>==jf%fo}_b{kVy-k zeK-&O^Y10QeN!o1^||P@RNehSzDsi9=v2i!yvfgeH#4BPv^jgV+{lv8auJ(4D=EDD zFs5vV{%0J@bmN8kw%tFYYH6j<9Z@~F#TuPTaAK8*VJ-$ft26* z{IFLSmQy`;MrhNUt@v&uuh1`FyQ)@Sxt6*F6(;NcPFE&(dx|!$i8$U6b4O_6)dzX3 z0*0MWQH+Dd3VDqvaMa*xKTUn7Jlph^*Q?4^UVz5l@Z8!`7pY!b$EDD_6?vNP=GfqV zu2yIL$#9RjF?tj5P&AHne4JIaHBO3Atfu@3uJ^?<^b;ZwCyNoTp^=)6ZVG2k`Namg zIWU);05O&aO+Eg ziDQ%m6$7{a^>LX@XS)tji>*)cY1~%{7D%X5%=F3P-W1iS`1E?j;$jAGwvSp3@+8-D z@Weq?qFyC0bA**9@O-;7Q7qaSI-8c-TzZEi+kWj}XK@NydM(}c&U61V>(Qn}!8Cpu z-?JZsm&EUW;Jm_$P>M&i-@~n->U>on&L#+3BPFz+BzbgaIQe-Q`JN9V34@P@aaf<8 z33RN9NAK?}wXR!zxG-_4riA^*e7#&Fz~RAXVC$&}XtyGEPNLrM02zC>MuSW~v${MP zOnmm{q*pg!OrMUat+2AB*}@F?LQdYr;?TH(-t)=XZ5-1yl+#ThTFPT*k~b2uJUOn9b~JQCq5i^fnGz-* zl?Il?qn~3Lcr)P{TDuM9)VxMSga+c-(8pED%7g4%v#MO4r<1faLgO-(E^S{A4h_?c z8`xcbN;hh8o}OWYwZ~QODU%9mUDiMx32KWiq=2cw2gZ$>lwh@bO;h~aZS=}PeZW?xm3 zNh-C+M+0ECMV%zvz#q_n*PQx2Dh#I=$hn%*)oor%wApC`IqJdLBW=f&G1O!c*-RJA zvE6LSj#?Q~Osv2=xgzw)L z^-Ll%zN>P$T!%uuyHr_W+nb|oti?6&*UOfIX1qrOc{o6(z`dQcVihK}z*M!_tL)cAWVK{yhQQO6MN2WP`sXNjFo;@@j-9xQSED`9Z zt7G=3V-B;UniS~IOFzan6>L1+T&DvWIF9&>-u+$=j;*kkbWTS-G{uqbDi58fNRyFqmb{XKZZg zv)!MOOg;gNmusnzJfw|yIlSm2@{R|wSNj+YQ!+gdfy2cPrv(djrv|Hh2wo*C+94ppu_9^k_L6X8^1m%pK ziJ>A=2A;RRj$X4?HobLTdt4lE`VNtADPQRrZ*0;m_aSTVaV9SmCebKw*ZcPz!(qFB z${QN_Qt^!u$1Y*D6vAdsl!?Wf^1A-+l*0hxbgW+_EHxT>UR7mlaVW+jzuOreOgcNy zC*b-^)eWkOH!uV^-`rezF=u%~U-PMd70W@UQoOMn3R}X$Vd6BXux~wp@WkY#e@4=e zNgwqsu^cpR)x6BN0^1H0glm+2v^K{m$jOaEt&0s<8ce1*#O_#)o-a8XO|3S)ywt#q zIPdS+di7QUI{}Q?1$e%yEWZq>g;&i%NlY?(IkUi7i~U+MT<~Ed6%9zYYVKl}3>Lw0 zTCl4gT}rK3e<+_GVZausUF0Q1+UURZSFPefRDzrFRxmQP_N=>oF^6kgocioA@7rBn zaB;@8)i^b=HzE zdM~FDSd3~g!FsZyO;)+i@)6BdAp9*JfT%Fq9}|jBOA==fLpXbH^AuF!#OeqZg1R4q zg_UX?^M_t$TJFaw0>|AUc2EqXwE5j$?tBF**rQwge|UTly?SOtKZ2HnVn&uwL@YMh zc9dg3YyH1W_wAgSfxnuU&zo6!Y0Z(mw41*#e6=?3)t+bc_@CrwZzr$r$G_uE^;Xvc z1FPYDm{3qzjtf7f!fDc z_kIJm@_zkzwB}Zy+&%+)P=H?vO}zJm)AD4dByjcdTpJZznFW7eAKdu)=u_W)b}NoK zZ=DKiZCz0UUhA|tD11%i*1e_M=hgCA+~xRvyBQ?4KrRckBaZ<%eGO`2q8}IXU!H;C j|9_bP0l+XkKI91X} literal 0 HcmV?d00001 diff --git a/docs/images/lan-jobs.png b/docs/images/lan-jobs.png new file mode 100644 index 0000000000000000000000000000000000000000..7676c13f22f25ef490c307a0da76a03effba0e30 GIT binary patch literal 128056 zcmc$`Ra9I}&^8Jo2>}8G4<3R$!Ciw}@Zcf1yK904cXyrO!C}yZ0Ko?ahrw--!JUCK zk@x$*i}SB_?#{m2YfE=m?ds~Pr=H#s?^I+l(MiyekdQFt<=(0zAw9`QLPCK)dxW@R zCryrwg!BSQ{;hEhI$mP1SDcKl(CVQ)Fh>)rAc-d$hrW{SFXEgk46T2 z5Vg&^&#~TbRPtAvHu8>^im)-Kg(TzKQ_(ahD=0t<_r5%wb{-CMb17dI4jtYeulg^0 zFL^F`ThfViUADUUo^D|xI{kB4jRA50od$VeA*22~Z}5G_|L-&(BGvuh(+3ofu>M`P zx&$VutgQA-Qp?5~b>(X6>dGVKpEEKs>FMbWr@!ei7Q_239}*Ji2IzKW{m~j&Ycb;K zy5%J(5TmZGO^3KXI5_y4nw^sWMY~DQ%&))wt+4J~A@^g8*^%-Nf1D^jevGtK4F-%s zS`yBBiH4s2X;GYc@5~MiO)J>DmZ>z@%IH7ZYkn> zzaQ1q)-JR}?-r8i@_Bjn^!I~;L?rfi+ev%^m%XGrbt}GYY`{{;{RM{F_-l}jVDGD< zKdm7lRUIfVt?P(+Cnoxp@k`-*KfB+YwhwS3vNwHHh4P=a#OqTCHOX(XOGyo7y_o!t zV!TeXhO-=vgiTTvPOLxiF2xpARtk%WiBVHWjq&Zw)dTA4aIJG^YK)g#ocDI8#GX9* zo-cuNa3IUT$a9(AXq^#Mw0kzdH#c`qsFA)gEv=gOZ#Zr&2Jz#Y9SQ2tKDc5H7CY5v zmmeChBbgeISf_j4xUG|{fVIv=fi5oS%{C4WO+M#?TV`ZqdE54Lb?f)=@WtIwj5I6? z;dZlu*NTc56X<$$D?2vUhHt8VoQSCt%u9V0rxt;zu@PF&xEAGQYMKDdwUTzHT08) zmAh{5vktx{CMDgjNq?%Yjs*hsnjKDRp2y@zMn!RP);-1KwC#wM`a2#_z?2f7T-Mp0 z_fn~{zO_q1O^uGG=H1Dr;(#nO6O&4=FdnhDuCg+Z&~3)2PxteU#uvLKknZ5+w#%R` zIu}Zx6PjS{>MXJD@MuB|ek+Ubw=V7-$fza@&JEv#f{hl*g*>8eN!$;Y3>6i@Ka1H% zga(I(tevEny)wC+9aYoV4BI=1qDkp*iQ)ZX+Uc1W`t4qy_$kpagnW-yRs-)(DS3IP z7gPJ=z%x|~XWvniEQZtBS{(!Kql^RL2ZJdUXIyXbQs0=8iQVk5GchqGnm5@m$Uhi0 z**V*@o2<(O0>Am3E0CnX?@nv7c&iTP>cfX|aB&@mGkK_m?|#e}-%iNJkqP+hfN*YJ z_*Xl2UcY8%UtSjbu&F?4e~`NzaEmgsE5|BQ(?Sj{Ff)=iYV08$|NP z8c9!@)=@`sv{2F%BUC;~{x&(?E4WW_O)HaA*f&+f;LhcImq1PJ4K{^vB8!q3DnK=S zVfMYX)mKFaKqK6+Eg&+2SkUK;0hpPZs-l6UGlO>6+4Ib3GYir4^YhhXuQg5!i_+VRC*u%CXTlzl8nZ!h#rxxa z=;Gq`!)2h@AUSSWsrgxJi!54}aWtiv#d4>y9A;kN{iW+RTjJL0Ddz3Pfs|@`Dg8e` znJ=|#!@K3acBn;kFRk&s)t;}M?QlCXq3P4KxAjPaS{vv@qqJogdhQ^%ii~oTBf{Lp z9GRM0TKGDyfm;c0=qtiQ_+I#FX{8KbpyBnQJ^q|PElWeURD9U6A%&O=r5Rt6l7cs6 zgxXg592Rd5njbL9`138tD8jMB5mqT;KX2yTdA=qsVYlBXpVSAAds1}-{t~hfa0wIf z>1OXT;Pv_@VA$9|rZ5Bwk<4~@#|?0D&Fc1u`bc8H&mV1ouo;A1X;n;vf0>SC9zK1( z!_Fq36cs}XS5#2&JX|6o_m|#sA16{wzuT0TktyA{VAiRo5b{W5yShaMfm7#f7n*W- zu%%VQgeb8*wGEOmtIxw}eBK||MMe&?ckNSw=*FML(K+MbBt#Lhf1P{8N>A_E9}7vM zS1mTi{JTto$Z{`ZHv~cb3v}w7Z8@^HqKMhE4T3O{d-L#BdYrGr6rH=pH-n9 zcZG#(9ln9F5fMp#$*BNe9*&i7-(K2%$TzOHe-<}mzsOJjk? zCVBa0Yld$7;=`Y}hx)L^*0erC7)-t$fBC|JzWQ&W?`W+S#_U}7R6A(5lV9^w>* zpREU@1{SV9A+kAxnlfAxj7OXHgw?c~53sQsbS0)R`|m`pH6eT%O+fOrjm_e6c{jP zZf-6W_FP>@hx*TK6fd)49KM;U$P<>A7gZK44~|AGh7Z>vXrh|F6OS5RT9XbBD|sH= zbOplqmUU|G2kfCUVK@52s@fY+Uh@EiGwT9*$TB=FauAVbw$GZIoRsr`vA>vqYW!VWP+bM6pd{j*ON3)4QE7DU@?De(h z-!DDXv7wnBw+rm{^pF*hO}^QA($bIQb}3cFTIJj=p~%}l|EqxSzS(Z>s_P-=>U3K@i7WNdezQ+)+zq)Q3 zUk8(|Qa)S>L9EOsWi>Q{pE4M97XW5%_iDPXj{5^0Avf$m1xk0%JVBR@XC!4`JP+sU z`*)|95zB`6{`;3E^HvNq7m`+lr|`?YR%a2~EIrUzVbsujVE2VmnS(18Meus_@_kyo zQ_eSk`N}F*TcP_;DBo#mOAzsgu*r{>pFgwcRdcK71f}%b=w~$OSPusHmi;7L<3mD7 zUs^VFN$q*&UnC8) z*kEBWwU*REpN3DHZI7H52FmT(rUVt)k3L!u@9kwD%Zn=xq~TlYdT^R5KgSf7^tyVY zhgLlI^RO!~K3grckGR3&S4?t2dHLE3$H`(V2BjZI1RZ$@aRfN16!#45dh5Z7soms= z-R`_Tz5F1mQ=0Ru&OEBOzJxm@2XfTm`yj2FE6T&yra&HQooZn*{jk^?g;+~RhK9CZ z;}XlplEuV!a@tNm2P&apWq$O#f%bF1C{QyPiDf#2T9rx}GfKu>$Ynbh7cUxj-QS*^ zxR5MRLH>yPm6FJ{!TZdC8*Xphu3+mlmb-Zds~W1BFdtx|VU-`cJXioM^>hZn1w}=V z10RGEGH>2%X-$ofcLqLOwxAewlF1&nfFn1qj!h9t&o7=#&G~QTB3`JM~0an2VgB=rOP<^}+F0f!>%vT+oL%YpA)nqnFn&Ip*b1CM(- z2L$buYm7SP>$kU0x2apzSTNAht&)2r_mcI{zPo}zQc#sur#k7TQvRbvg@I0)n3r5n<_U;TWL``w3L(^n$BzQ zg0MWG5+x!gz8@iYRah%&jm2ph3mE=F%3Yo>5ntQPd4NmbC@vS zS%F>|X=!Vh9={a9f~eqOW~Ppt!>D|?9b(@Pbdi(E$jBNOyg?t)h$Y7Wk3)If%d=Vt zp5kDVD`;S68i1y9gf1seyIeMzAh`WD3$0|i+QT{aJMb? znz|?{(SZmbf10Ix-JOebmkZ(DGT$;Vy4UCi(P?qpzVM_fIR2R}kgMPH`0ltr17T0n zQCmaLzrJzGw;szCVKa^`p?WgHV)fM-wit>?%fQhqMRE6>&V}_#(LbJ`_Jrv=p_o(} zK&4z!9c&UYNjt0OVuMrV= z{MLwIZmp?oe{b({*F*f0f8f!|IKl{QQi=JU#2@YtL&J^pwFLA!VJKT08(Z5%@lToA z*#qzRJ6NBRIo9P(h@BJe6#|xdWvMplqBghIOH7dcZB0L}IV`Ja>*$caS%a_kEN`D; z(g1kMpxb$#Lw2=I6oh1Vls{sZb?e(RGc&s$o;u8pkLTV~H5LJq)6!IfgNKJ%GFiR| z20srxp-FN;q^}r!$mkFi(iSn zI0XeecebZMahjWNA|{ol>)QK2CV*rmWL0I4i2k*-YM_rgW^&WL zTrXk%XQe!s3{?~X7jwdTvZVy88C;eO3~u&ioivFG3JP)<(21i`>hp4go4A=7yj|95 zxYN$UbN)q$Wq23`4bl(W2$*T0d2x!@E1p;|a)Ka&Ww2W93Jd z)|rqrg16UDL1mg%w;T85&Hlk2g2ilxK)F6*H(l6Hk~;_yv zN+$$Z1MmK{f&f_x$WgoXrMeu>6#o~Zf~04h#^<;c9}D|`$9h0+MgI%x5tRO)F_Dv6 zsQpu5kO%gESP9bq4Oud3UTD_%PY2?@2+(6JzQGlnV)1Wmi@=d03Zi~vXupsDTO3QSuU$<( zyrfPZ%8n%M&O=R!MM&Mr;7l<@U47q1=$&_N#dLnBLNPJuvy`69)r_r_0(n~CWmyLL zC(m^l1hv@_5MN3nJZrboeg7vo%-kL?npDne8qHXTZg4B;>SnloL}Wk-32E45&x{&v zu6++Ps8l2x`a?HFOB=QJLFciL&87nUPKZD z3(XFgK=+E~B+fSQjjOtEfSB-&x{O+n#}@QCG0)QIvsyW>lG0K>dPx2b4ARD2Nd6lk z6?bh9fZtplbLctdaa#*R&#YX&8>0Fsr?TiyHrk#WV74fL=4r$NL`9>1Ezi@{yDH2^i*!|JU^=QFb4@@Hy0JOQoENpw`IH82b; z+nr}GCQEQp+OByYXTmmz5`X^GFP__xaC2*TL-A)M;CAoRu<0BJh{FB0*n@=l&jD-v zjwqEHB_hJ+H;mAWI`gH+`6CZ+pULjF~*1?I6j=mPtqHyHlL@74FdRFwF%Ied+MwX;;!mv)InxJ?0xZ`x#7`paB zr#j1vcoL}0SU`^ww*oq;56hG&3MR?>2BytPsGUPC_wG(B)HwQ3eg&bTu(1qvb{__% z^538WhH3kf^ zOq?jN=f$uPRB4I`6C{W(p`ggbM@IvSrN>b|HmD(53@Wuw@Mt8*t$yBsLw;T~n>`aM zA%iyV{JwKwN9B`>>r-3%=(BI8^826bA{BJ483$tcNyXedl|3g0L;`bV_3(Yg|8qe( zl6d`e2UgrMOWHt*UsX}tE^|*R;<_@H;&d50e0C*Kwr!xl5b^jP`x%g%`OVtT+AqHB z`a400Q6LTwRsNIkhQ*z#z0c?dop1*rg*AaRARx}74ZtAO8qL8$+jD<=Bty^|xVAx_ zrW>5eAFlvL%QX@q^rJh0CH+9RNC8w^+VOq2EtfJL5xnpY*gWc_PNUeGF!UOHO6LJ4 z9DP|fl*F2ns+WSaPMSA&Hz(l2WQ4F_jU<|?u6{`@89m0w8hK1SHs4?Fi zBL8*y`90#@RG*aj96)XNU56s(4~-QLx_TegwWWhS53iSgA$RODCi!eFqIgJH?q5-z z<>6Gvb}hBMmx*N0j?8&ug&)^0V(uAm54$}bqvb=3tUnA#_4mL3IVEj6nqb_7tLuKWN)VSR<^dX&qk~aVj%{#rw%Q6O9fga290vRF)SWGCJcdst%reHsc1M_H zB$c2^I@`hOqS=GQq)OwS<6hw`2JlE-3;zM^**4kCQkRHn;Ba>-Zp}FMAw9UmU2N$z zH z_Y!ID#S8kj0KK_mOw2!3lok87{r z=w%+JW@pr@@&tu=8WCL-nMXPAFz zMxuv8`!1vG^elyA@1nMG=bjLt&Zrdvc7z=K9==Io@5Ci>0UTOKNF|rTA}hirbD!ls zNI3^)1+}(O$TZJ-Uxa5=I}P~J;r52QD_t_n?J*Lq1Y{Wg49m+_q54p#d{lS$fEX2ZQGP^ zVZLjmZ@^y9AivExdLxXXYfkNFw`+J_n~DFeMOc*~<>*6yIYc|GT&sk5z!KX|KajrH&qe;%74mEmUv$cmmjucWh&uu5>%8oqXRw+^yjWpFaj17 znt(KlidRwhs&ze+eYSTfFXx_+Z@~c{+gX0G^KsEwiZGh z61(76HZGHFzvcZr3KJ-ijwSS_41Aj@cPKDy+G%!El+SnW$hKgN0@uIeTi--I~dJc`ee~_Jj!_baqd!d_zYB#puS`GcN*;Mkd8Z(AS;Yz zl^N**lu@^FL1fwHrJ@c(Rc?(#86yHf$N?HK{xq^d&9C{eliHYzST?4KG!sj)Nhm&5 zoy4E1Jlb%VZ)r|$w}8sDZ|^PT8106Um)HC(vA?|S(4Yby8|DuEtsUex>trD2IZ!iM zQB_`Wg=1&N_ySNS-z7nFhweGa;xqn?c$eP@zAHfT(mce!gTnx9wc^CgOj>cNd_CCS zEE>u5TkLio;%)ZQ9Ux0OuLR%4Y#BHX5Maj=z(BtRh!JA9NIrF|64^e(b6^qZ>b2$5 zC29Df7P0Wo>#m|#Hd^}$D+!I-QqK(ZIMP1kVB&`xJyl-Sfh!LO4V6we*x8`P2Fg#q zI-VG3|8Q(2*%ZV8O>Z4J&ao~lc@<#vgNvm8tm4`OXfS?TurNo>K-_WzOwdjy@JW~F zE50p$+2SZ<_3P|?gaAG#q%ZS?hVggW7^YPJFq} z%$V8m&EZ1&dL2(`#DRsFWv>|>>2&cyKDsT1l3i z+#gEZ1|;6OzNsQjBNZ0&dtZM-<<5F80DUw9wEsl1AYaXYd)()2*5-HX8Yl8^70Oq#Zd5W5GQ0E#B`TRzQ`yVF6b*`Map) zDir1>qYZ&;ySeRck(K$S<hW5qeZfu86y;uW-D|R2X!vFHMsSO*s;vKUbgTTsF}yCYK4Q zdD@(&)#j7lNPEs~pT!C4~*U`1*X&FIq&? zI%GMM+7MuWeg0vGy@F*8D|-|#^{}cc1CQ|j2l&uw=X(k7B1~X(8HSAs=^C41pK=Ru(iKy`=Sn98HqWjckPSgZM;z4_EQuxReDAgLg8})8IYW4o4NNk7_eN1 zs~sIR)>TQS#aHIRW~+6Va$yY?|2jw*GE7lJMq zZg$WF38_&VJ_04m)kmejY%w$X;|4Mcs^4I9HPByvu)AvYo0xa=v2nuC9dp@Zu=wzb z)Uw#zY{tkyS1TK~`+n@!WV^GX#z z%ZjMM=s}jYj)nopUfh?yd9QZgdJQ0r@nD2!SwY`>Rq6?9bJJxd!Y6B)7}e4+W*aBd z)3cG;9O!6xvl+X*BScsodChz8aMZ_oNcRLR)9F+{S#nz7ckSNfHK)ha7EqPVgQu@l z>N&>WxE{T~ENae?oQB5RwqyIH3cj=*--chAZYM_J3@Amr2l%kbr(=ieBp+`JSOQX5F|3Alx#3gtclLuzzh_$&b}avSyCmZZJs| zA6mS}AEwpg0&eZ!>k%+^_`TWEzyJV6S$}&H5bRq|)Vx>RHc*vgpm%KV2Rk8ut5w2c zHd&!LkKAHyq3ZH(0S_ygY*}@O2jiH1`Ng_oLaT*_jCDfg@R{C_hRtB4`q(h{;0F&X zl;{dy9j=txVR~rsEB~0=+TFU?h9=|0EUBmI5gM5G>zA6X%h3xARa6el&8;{R*1I`T zIN^at_&#o<(=i&Dhb1&gAsekQp>jn*QQ8eC9G_al(Yc1O1Q{jf7v4C@vYa0+6!uh# zaF7@tC-y=7-0{{hA|Kb2UMOsEMdb4HCBu9S$i-Qc5@Ng=JO>}XjuV@$G5b0YE!z4J z6xw1{tIjtO4p3p@s>Ucn$JI&@(lLAus2C*R@pFMnQ-=uog#&uI!7 zC7jiudrv9904mE~d$#AD9UX-)PJHV+G!QLMee>z0r%Rv2B`S14qK(4A~w*=9e(>kK5q%zljBQNF+afJW5B$W6(U zeT$}>>2z0F4#wwFj$j_(BDQqIO}z+WBTSwkcl!g2xRDJX6`tjFXTUz;>YK7{woYq|3bW$@p#eW2U4{mJlfUZ)@6RH9^h!hdpcgqab*Fh27!4Ks~gi5o_u zA;rzP!FTjdm>|i-;WWH8-9FcshR(Je6++`kk=oY|guQ%K11^j1$dr2E5P9cuB%3vk zp8&np%pQJTO{L`&pgJMSBet?rwG?7vsmU|1fZ4pZTU|v|H+%o-voDo?Am73+m5oRO z-u*#je1i;`?a##gYhIovbT&$%QJ#Hu$~_yM+b{hh{n5?nt$A`9!NsP4I$4z((}pOE zJ<*TT4P1Ny022q@yEx`fvaL1lLGg&By`V`2lD3SpNEGl8NUCSkGW>xu@obs21E z$@`bJ**QKNxgM zB$a2(M%)@iZm%h;(;R!^LJR`Dx}*RkuHt&`JimRJV9E!3aVw#2o&j1lQ$Tm7=&Rlm z37AZbh~)0Et|ybcD>A)n#w1cM_|e*wlcN{vDAt}EBqi?HqcHu-OW0&D8rfn?7me}J zM+U>L9b3CZZ~DgUqt=g`m#|Vi@2N&Tk8rF(his3U1@A!Nq@}^h&rzHh=LgRx7Y9z? z4TQT?FnvK^R!>;`Nb1b*F;hm1g%Nl^n8t9CCG+de1YvuM#cO-r`%{Am6Lwcu+RqhC z5{eD|OoBvIb|)5s<|p|;b@e4VBGhWJkJHe4Pd#rAm0&311I$Dj;+sL93E^LXtKqVt z(6G;8BX>1Kx&zlHmR!9>jx&X~X|b@P&EQ^W*h#)>>M-uT5=*F&! zTRnJUvizRQDlChUZ}MwSRMc)q(Sj6g10R3uCpo{9mW}0o%Nq*;lkY@dPWjm$tq7Wl3U3#_v^LRtNd*+&sb`91V;ueNiO2WmRicuW4VsPP%5*kC!!;d&X5> zvBa>AJaY+)WPHKV#VLD$E+21UM2mh1` zKz&#yJ(soZl<&-ulG}t;ln`X@8dt6d@r6`#aO|P9pfBHoabcr;GT?IYd z8c+F5sf&&9t7Wt7d=#+m#wsoT-UY26)}}dB$;w^Yum@3oEOI?-vDzWi0N+nxmswdc z##e@+V(yl^2-ZRbeWGn!^FO=^sFV?reKAI)PvXB@*PlPmDg-ObjnyoAu_=+~Fwb|q zTf4%Q;F*W7&5`A`>(l3f*Ip`kHkBOsEH`1u^TE<>H*NWc!?(7hWK5;~Qr7G@>N>A6 z#~Y4rOxkSyu8zUAGwStxcDG)_ zZ!l=oFU)R=s&{u%2#ea|7*C}#xDFz)oIT0=DwmRG`zxE=xa{gc=$p;4>LPco|1&l6 z?Rv%Ipyf{Gr~r$t*v8z>75`Gh;L<%ETg7Hnm_hCPe6y8yuhHUoRs@b{el_uq@&_FW zakxJOTTx6d7<-Kx(jpaER6~h|E_`;N_V5~+i^NK7h}c#~)x53b>%5O++0B6C$Pe+G z_{2|;;U}Z$Q#G*qj8BhpV;g4xFetLXNo=LfVSSl!_p+zMDfAhV?QX0ca@L9KMo??d^eXbnGf=+ zL~c-m$F;PuO;1g$8c>HsF6se_0lRAtGr4S(FI$|zKPPT#=)84+J5b_83+Lne@5+;D zt6Bjb1!1`!DC$Z5mYvV|RrUIUQ7`3O@#)B~b>uc&bD=b2*GV^J@v*e)J82a^W?94? z`>>Z)rs(ab2a>i2hnVGt)YNxHy-&RUkfLJFZqE1W>guGUQbQ5NtXJP5{ukAT3&|-d zZ5{+op_eCmv)vWRIBR>Z{6piHE9xH8v$OW~@S-_XvfV*`q@O$e>a^#FGQ7Sqtg72myqmHmV4MIi+rXW=Dw$djPMtt z_+14cQ`lGMJ_f-W%(}H9uyjitQ++7P5Kca_;c<7Hb zVfKsq5#qLBjz-t~KsjG7D^L&u9(ErtnGiPwx)p@K{-Y2ikTpW=gomRa!GPW|imjNf zOEyJJ3_JGVXvwUC(o!399vUjD2ySeVXPJ(F-*96>2)HBYe;P{6rOaZe-E43bOp9#A zf`?axV9;$n?|b9*jacN_ejp=kKRQd;dc5EXlomVC{xDE6t;oLp|HOd zlbHVXl#~>l7X>=OMtB)9k&%%IxSbFbM-2ZqV7EVN>sC@0W4py{GZ(auu-hf(M<4?_ zIvG4V{&Oh!%e_(q2jq!8-|zA14R(JjMO0eQzJL(eeZ;T~M%4HJ)l`E|jk)dFp%Is{ znqpJ)uZTMj+xNA=g*4l2A0p%BdSp{4ajvgrWw9?!dNGA=?!1jmOq`{qOE#{G5K4nC z8LDY$bm*|#iyBh~JN)jh;nhvsbc?gfr%z(z=JWtH1XH{iuZVBV`uqgJZ#cimWe0;0 z)um=cr3bAVw}AwT-eJg?su0+;ur;ugVh&c9Y zM^H9nC`4?!gYL`A%OP!wQ{UA!z_FCriV8r(-^_Qt%)-LL(B2OuB^l{w1djND@{Xc@ z*ZOA_q;c|Xu>w{NZ-&$THbC}PVvU)`wPCgcK}B!=6(}3j8ej;zo0gH0N`-0zu5{X* zy`vo9r*;F7fq?;}Kvd=P9-CzGKP-R|!J6CLS~PoV)fsz6YyZ9GW!U2+`9(%vb)mM$Sz;CCFIZeZOraZ*r1XEEzJfo(vy^C>97DlY>I2qA5k?X6Fz?ppk7 z>L3s2OEm&~d_iyE_f-eRqJyUmjO0+o`Pas^TXElyVJ6T2?HCAB!5XRf(-8uM{lD!g z_GS9@By17I_HZRq>4ax+(+ zSu*wSltcpgY)rT5Go8nSKNqp^upGVPq?*SQGZvkJWp&ineAx9We-k_e zR%Gob%|r7ahMloE>vVfdPC_~j_!UG-m6kFZ9&M2P)9qnoi}uoRaZxNAleeXVh`#AZ zg^x+MvCVYy$n;wNrExlO0*2YA*-F{KclkKJt2ZNel7))9{Oz2F%GNk<_%s!S@$pVt@AY?b!N1=xfv!xK79!{g!2G#_3{xxZdWI#reo@GeX3xq?ViM z6Tn-aFX}W+#LOH~H(2qro9v^}Y5wlIy>DsAlFxa%nbJ#v@`b7)H`3*R&CFHw$o91> z6dNSvyB5DRRt-7iwOQ?k`8*w(26cY| zRCD_51gdUX5tY2nQ;HDfGPzEB>ZiwjdJ?w#hJQ9E>X72*6V&jdsB6sa4qidVW^8IO z5YllP=~fS$p{Cv}Jq|JV5e}U*t}I49C>?kGe6y)3$@%dPWfaf!GNqmsGZrw#k2fJ{ zQ~J`y6*GkV-_Tf9INQHgP08SKVhJFJ*F|Jq7FzELGSwsopnaLjZmG2V(dj7JibW^2 zU0qAcm+$rSs*|ScU4FH$-#x%=P0~i-*W<$CB`$gx%fPRP>;1*+Wfo61nsS=c{V|(Tm{!7QgT% zc;P+Qt(DjC`2P?sY~|i$Fu&Jt_%!_=MS@k)L4~Tdw#j^ACAx^p)XD8}V+kn_kzDZY zw||X^gF&;Bb%Bv)zL**JjF|h?6S|MEi3euiNxG-g9cYpX2{FXEdLGLA&l{$$<&{QUK9NrcOG!VJJl=89;HT#paHNSpb#5Q&}ksHK>96ZJ)==f2#5LRSTP}1` zG)Q)?rI6`gjSvZ`K_k|nzN)v-iP?X(UAjZN)mnl-SGI* zmiL8u|2&qJY1*6qg#_@w8`IpaO-qcAVl#DQ8=esV=KvPIPl9c0dS^<4QOR7`k>~%c zdrV^pf+g5czvbH*0S(i&w^ zQqRXn8Kr&+c})U;>~C&&oXccQ(W)C}kkb$q`Beh-ujD&kv19@Y;26XP3u=fJme2VP zPq9v-k?Oz!;=?Vuv!Fs{AUo#;IuS+{G6%g=;H+u!g45XVe_sZv8UEd|Ca#$O`=w*1 zDqpa|ZHiFI<6Ws5+zxHWDxoL;w$}y4mLixE_I!Hi9f_Rl=?LZo`UoG%XCqpls$UBe zF39~MHJ$+vWq)`%2nFtZYat|iOi~JOT;aGGic7n=gZBuKN?s_@=ZrQU!0I6-_mBG$ znx>Koz?_K^Gs;#{$^It*PzTPYz}e5xG$8WRCQ`x zxjrah{3#l${32i==4Yp%e)ZO&D#yAtf48o;FHuSO+r=6Am~^llhJ0k3-be1a*1R+A zYUj6F4*L#)TOk$2M)_n~x`570F>&K3s{PIdQ6DTh#x7STI!%}fjT?+$i8qQ)lCeRS z+!j!s(*w7RHDVKe-g_UBaHH2Eiem(#8p=CSY|3b8ixfUNgp-XI2JjM$E(?^H$$9{V zo=-JTBlw#z=!8}Guj2BRtxjH&LAwG)E#VPvB<6Ae(n(LYK0kkW7##Wxu7N+bp}C^9 zpIUi389Udxrzbzqc%a|o>s6_5Qz3bVc}+vd?*h8X4=(7sZcPoXoX6>T9+yDW>1@jH zI5?l*bL;8*OeNIPSr$4j743*nsyR5^A60C=`4XRNH1yR)zcMQ4Q+7z>!%=66 z#W=k!@kua3S$iCdAusTJeWx%?)HaJtl9Q8hsZl!H!xJy6F1mO=K;v$)AArs>Gf5TG zVN<+)vJ;)|Vj>)dO2)lo%&cqDHIk~~s&%oHtVfHrV%%6jx}`2K5Yd@l$Y&2#($Jz%wN2k9qfgnDB2`H@ zsgZx!oO|9(cd4Pivvx4cT;h>8+zj44PJW&(mivm&>VqEJBA0uP*)U6%lGA}FT+@rn z+I@z4R6aXv#w=iW;7fR8n!(D!uas=QIidgxpnQdR=e=61zR&#tk9&Nw2SOV*`-MB?0o37# z1BS+!0a=fXVOrKm??Q=N`f06@5%YQ3*WhRg8Di*dmw~vrMf`X*(+`yw^KA8f;gv#C z24XpMbMA$0UajHU*e-3a;>^sF*@d#~tS&Vd^g}~~UpZgS=``3_z4ElfEZuy> zDDute0{OV~bA6eHu%6i~EJXZ~m@OTscf2Ro{DWxBHnl=cU0+sbO(ORS7qP?DMfO`x zlgko3CLl@`%?pUqH>}IqufoSg9c)&71EeH8v^0JVr+Kovil$Yvu`q|Tri^Z)=87u7 zg!5+tS+Nd7v~Sujdlk#TyX5E`>z7laZxGIbxPI#EV)7}GhC4*qo?G5>#=arE)^~FK z-6PDY;UFoy#d)!SJG)=?E1{-od9*q4cM>v=Bup0*eaBX+E2Z5j*4=peM55 z*O8aDFXG*^$A#cl?rna%Xuhrb51Xp>_sQ6wdA&vPOk!ZhNkK|a; zS~6uPU$*aM<9p5E?PuLj_dx#imiPV1b%^6S5eGOw73@bw=&`)Nj@h~H^QEc%%azGU z*^y*F@F@gI{9_74lO&n93g_ymNS;kd$DtOOK7XJIg_A!5W64B z<@4tEyxCO%B8p`KPM=`Zt__tVb|S^f?YQaJ<-F8a67<+1aVO*e4HxE(?of4;Mq^RM z?PI3B0Brfj3yxKSJ{Y!q8IBVND^apcW&PA-xq|@bqW8vZ* zx|0k*mM*q>?&-GUCsZ$t&xFp~gxO|WCIy+KIBuLhW;cTY+|aMy`KWBs|6u`NzI#w> z-SyI5lBM_&pmpuXkTi8CEL00wd=j9-?g;>z3QqNE>P#JpP_rg7e5DaA>d&CyZ@+9g zSC~O=AKbqM;C*S!`l&ibx~;OEKI+7o`YV?^=Ri5QN3W6=o22 zY^WGVy9C>s64_C7AUiUlS9*8AXR$diKc zff)xx{eD!}EURIypJD6M3(CtEA2)EmjjVj}72j3rLTZW&l<@nq-1#k;4B5m&=RMTE zrYCtsc&mP+?!YGQv+*P938+*l%vRf{j$Sv>&+az12+iPHnwf}yr(s(FpV>5tU_WdJ z=E(*<&y@MLVrlmafr{Q$MoNmxN;q+f znEu4JV=80{sy6hO5#v~U^(JNxUK6WPimip877Ft{GJI_voJr>N(%)m_Y+j9K{;=&f zsVi3~J!8Ld=VI*PZb41*ZhMs2e7?Kq`CSw#^ck}34_NQ1N7T%|&iz(GeFm`)^@j>gL>D;+96O{#qB? z{x(Y6OgJIhGu2SXH{P3T68o+82CWN$>xCQ+gel5))r#G}5bg5)z6U96ZmZI}6>(*rkB9ZKSbC5O75e-mx#H>#R1pXvnWzoMT{v zC_72~mmiM6xRP(hOrNNk5GmTV8#b2YY7O=F-lXMaq_TAUb=JQa1Sr3KycF3}ovHTN z5V^6hd6zJ0yYXF>u=mOv44q;Rwt<+{UnRur#g{p zCvHg6X4)8-9lIwst-^!wDbYqnN!`*R~^~Bcy_R{q-6Q9H-+l+@@{I2V=6*a zUzD>tTJRg5%IryLAGi~xzmWA8;_GP*EQJNq zUB?3-T!OJDneU$sL{`4L_R4HJTxMqX&q}*9=qYi;7CPZf)h^3UPH&cRX)I^qZ;y2g zjyAH}I2C1Iw-~*cB{7Grki~u5$Av);jJ#RK-nc+)~lJ%(hHCj+=xRk662O zukPB7hLB)&-ec_xD)Y7X*Fcffq}PcN{IMM)*VC|IjozVowyXeG6T;cB=OUHckCig0 zH4KIaUq9hA=*@ivi7HVeS3I2VAdMV{*63R^5Ssb4LSGLT|vIbQe@+o+IjP=zdo|rIGGC z4a6YwrMrDf*#Y~1SbNLhsDiFhmjEF^+=#ooySuv)C+_YOg}A%B8%ZGUfw;>|++8M~ zOq?WVc!Bq;bL!l>Rk!Z`In#UZ?%lR}$+J3p6MWSzz^o2ZB@FdT;9_lqwVWu=ea_O{ zQPi{{d<_E4?;g6*QoQ>?5qQcLAw&_34FQsp38IP2M$BusbzzWH91%H^!btU zo6N(3ld4~V)fjrGRcL~WD~bH@e(DFTqIZF-%a! z5#$06C$kpvv(9%78;rhfDy`z&bi0{{rNK%b<=)SZSTpa45+1t}8%v;vm@WbSw$RrP zybx2(B2cvdvCyaKGe%mYzp8`9FHm2SUfYOfiO$dYs3hf9I6?5-@@wcf5JJ|`FM6it zuj1Zur)@~MQ8Hj$<8!5N8(%+6h3OJrhN2|Ir;8v+-lXnx6etg*o0^rNGgOLfP6y&N zGvA++sSLPlXbi1Vy@VN)MF{1~48s4|L2uUFv2v?YErwuvU+O3lV%k5|2tw4H-kK2` zgT_zX@HG|4ZASZgf{P+|*dw>CHWe^&+0i2CC$RI4cqHPpCRtA(Depdt+#uIWRFd=j z^2$zJq&_H%i#j4zN#9EkzAvIuVz-jp5mRaU9Ca3ffMs@-Q-o;UkB!ge?&*n^;e_Bz z3vws(eNOea3yjwIdw9@rO5_QtPGjJ?k&>Lwz7xacn6?CA%Rd^G_9aK6#%sme3c3rs zje@f;tBTvoq|Nai$X2)$c{k;+7NK(VU4~1(qQridw+*g)lpJ5()4t8GpBO!RRtcGO z&u0qSG$7Kg4|8(GsdpI3emiC`T|#r;f!Eubhlja97Iud?6=G`_d%yKh=4x;puF7x4f7#}P4ayWu$+iIweoKLQ631Xyz%Lmq^_OL= zzPvvGM&Hdg)=Ko|OX@nbsZ@FHuO$oVGzFBm*VM+( zb&#@IaFuVDCV9oE-G#W;)cC*G$kCNOg0SCiQ#=^lOseFcb`fWxxE}@BhoD;-^w6K{ zw_Xlq9^Mrpg8v-yU%bG6lUVXGMQ^@M;ND5(=hnP{AKVE}a~m?2Kn5n7BQa;gH{z?! z{$nh;(Nd+vlU!9tLH^GlTU&8#tgIrQ_hUR+vBif(oGf7{H~E>y!GOIg}`$P zcuE++4!|KeVf5@3)k!J;D4I0>n0-a&$zNB6?UJndP5+pAujXk?$7SC2OFQZ5j^!_3 zy0d!uV#8wW89;QCmW7W+cwc)Fy5=L^pM%r)zE6bTVJG@~TlzE0-W=|{s=mJ>7!yRp z)6U4xv#oxny!()7VH%W5iEbuGmXM|D@r(h!d(utrmA1JN)d!3s9zvvSH2VyOQICs1 zakV^$AlD1t=AAyV3>Tg4#5Z!ifU`1(M=InII=RHL5YLf#zPM|*Yx=AItGB4w@@Z6u zwO?y6C*)K3y7$Im3WGN3@k{JbK1ZYkn`o;vGQ5r_4Y(6LuThJhN{!%5P}A~-z+=0ue}?0Cl2f?VQDKf zTlEdHlXzXGY9Y|3O-i3LOmE$uhjaay+Xx!oq|gp<9P%Pq(7*2RSSTW!l9OJ}7_b;| zR%zND>bs07-FKP#fGmhaVW)y6ARq>0SA0rE8fV3%BtPhys5itPV(=$;x;+)cW$mTb zaI$GSFS;tyCgg9Xs@oaM@Rd%w%@wczqU%@sp zK4~jwxbEXlWt)F?ElfUseo|aYkJ)-P(TP6Y+HO%SJuJ7S!?5Bxl7Z?-zAWc|)!7Uy z1ynhIB_Y3-7t*+1M*Y|1dxoT5GJyZKRmoLh1xxWn_>m{i54TmeFqAeSLTj$j**y`d z00%~Ddw9Vnsn5hQ?7mcatp(d(>hGFn2XfQJ+?LEkf4`c8CeNE;j>wwfw@$`jfdPu&LbrSe zkp&*o)J^p#N&O!spu8bJs9p5{v^N=3$g@9FI2UIi0}!BS@;CtY*|gK*I!#9#5CM|+ z8%Q1G>Po`@7$O5W%M79J#CV;8&fC;gSz7<2&xHq299&^I6mdXZ7}}7)mGx#h!!=mL z=tLdWDD5P~pC$1$Pu(6pzoK=>LUcMBqW%%KgyF;ww+(&1M+wvI&sOQ)oUDYVm3?JX zE~}^j^pO4lcdIHZ?~fPEMYJ<8oXO`Bv~1m(PVSpY<`QtXk0$WbshsFzK6lK0c`ScQ z&5=KOTGtM?K3(0uXhenYZVwcFvR8>WEGd^u@Voc9ZWQ_(KPmk1vtd0?!=sy$0E!#{ zKu7IMB$ktVM;w$HL0w0m4vX{+uT&!&;5(;P^hilITk6CpSPav4eEj8eS< zD)$fEaH_0Bm9Noo@SJYQj?g&_{I4$QCR{&xDf>#GJ?Pd%mH;Hm~OH z1V^Yc1R_PXo-+SEp+0E$4SuGg5Cs1thHnaE$!U&BmoE5ca^b_*q(#SBYk|M*ePL-d zhRCg{0B(wK)lp(&yFx_V;g3tdo1RoQd{Wf#3P)w}s2!;c`%;h+|45EUCUNpP0ZwJ= zJT{Vc4F#6Nx6+9W&Wa|kUq%oUl61;3UQo@dVV0hLClH08A&wW3IFZwytS{rbdgDkS z&x&KJ-2zddVuVJLnDYDU!kT zUU@h(yWDd#{?i43R5U=W^*D1%3|v>{g1*F$=GHAaSKN4H8XRu=bxu79m8{Ts+NQh< zjpTw5C>O1wmh|5^D%J7Im`9>ZN3j#VXvU=6A||ZKlsIH`1(v*0caXe0Ooc0~%|b8Q#avz0Qb%XkY^dKDk)ZFwFE)0LM^#3M+O)hgu% zexwj&rKG6&8bR$k$NU}7Vl7o_o_()+5v34|h6eT}0Ufg6o2Gl>tKz&1#ECOss?3T^ zRGEp9*Dr$&cG2}hrx%HeSlMO8kd?=OFZ;qGsAbCH`OW8QCDH*Z76WAPf3+a}<*TbdcM2dOT_`8&} ztG(sU=wI%hStdQ;PsKvv+)B1gdEx*aH=`jmh=Fd{TzD1Xdrxr{+4 z7QB2LiKX^BNU*Yxn<;WzO$2$mcW>8hJOm4gFlH3JquuXmQ^1(hJR+HJNHMAv+sojb z3EgfwT*t#;ClNBNlGt(YUR6PQ(9&KzP@ZhEVt#>XV1O)?;&@`K2Fyq@xDgt2^FX2(8y+9OeWs6WO*iyc}t8SnAZHE#WJ~zH=RfE91uGs_~!ip zMfuh1dAW>xX@{)P(vX)owDuXkpNho?L1}E~=^0{zX{OcM$v4D|8!B&Dz=Zx_*_hS+ z1JL~iEod`FA6iRni+s^P^LL#<6f4<0&+Bt?qi5BsYv3?b6*<4eP6l$4x+d)z?!1(^ zcDxjZD_rcfx$0|JL^?dOozikHIf_V(Wkn_+yGuQbx+*ch0N%h8SObyU@#pdMOAdP` zSPC&bDYmMD=_36508*uVSx}taSbkpKkFN;^l-EAHcQbGHD>^n05LvWL6eV+O#=N!T z$ez#cZh-LYX{%hr5R_KVE&1snDhX{YVC9}9u^Uf;#1vgNK&!>d>$QC9Y=QLF>Yx$ zJ|xYmgEt#G@7v4h3puRQ;nXoPD_VZA*dT^=_j>b{JD50_>_ zPvLaF{>CxtbFQi_XXuka+bWQJ+JPZZGwyhtK}F_3Hl)OhO3tz$j^w-Hb6;aU(Ya~2 z2p%R+Y#{|68$$Pll#Gz+%S!v0=a zd3Jw6E%KqToW8;a3#&*gl>s1wk?buk7~NPR>tz(v94mPT!rCeFyBC--yHTB;rc@}* zE27~&&e4$_^*XeqPQ}~_YXc_jZl`JpIrzDIjU`&mODf9vU156Z2-k$kA}^3O)r5Ydv$XXeWO)A_=>Ujhn)C!=~QJ6!`+aafhR_&In58@^Ul99jLk^A2u( z3}t<#kBi8mGTcd+okT^P3`?_z4#bRllR4v;#pvZhrUqXrt)UGVof(zYPyDGGjpeHF zP_|1oKn^TK74b8cm;HQ8q9Gw6V&pDjmYk>RzW%oAC#6oXs<&0z$Nhwq0t@3J14pV0 zO+SkK8Wxrdqx{~>PWkYN33>|y<=v{fJ%{9(#_wH?mSp9laO8X% zH4`)t>|)8Tts$QIuc?Ig>5B?k5wj{P<+i6+Q5gG6kbor$3R+gmXb2aV`d~Y%Q&WI_ zp@Xrir>P#}pA9g;10D)+VTG-8QY=PgVIe735f@PzF^w8|QC%7yQlcMHyww08-M27xK|9e-5I# z2B>3+$N>syDeLI}5CQXu*_Y@I_)^@spV^HVn`e4n3Hl6KMXweEK^|lP* zJIhEXw%evwf!!8Ibt8IN@|Vsn^2*3P`$s44_-xAA!3ruBWFD8HdkiDN1Vt zi82ZrA3 z@8V@C;+u^}V2&Ia|LAz{uI=}IQHChXw|JB68{D>Hpnw-#?xa}{Ma?_4go#ctF7i7j zEEfe++CAI!M3SSCBws#oybtZZX0@aCP_I`6 z*-eQ>f3SE_rM6eIjyl#@6t9z-&HK7w-+K8cn1#UYTx8i%GB=HM7t&8#f*9<>3tJb)eX?QkRB|e6F34W0Er_&@!}m>j87{KqzKg#Q5?7 zhPXi==Va#)!Aa9w`4TYubg^T-PE~YYC^x~mY36^fJCS9L@V&-q3hZ^<&~ci~6RvVj zvp|uo5#*|(d}zk*TBPC60K0K1+xZbTr(}xRLJFOO^f@}wMdMKIlt(U$2eoUfmP%6r z(jZ%Lx>R9H&g-?oReWC>bhZdY{>cA5_5MIb^OE?QoU*`_*jM$Sh6*|xgfoHG4BYDk zLxY2)MUsd-Cps99OH7lDuAcOXQqoC6M~8lCx~4B-@9C;d0AUlXXv}P&0VURNVdoxL zHNf{gx=l(JbItcYdY_o%zvjC9gzJI~-uWAmbjG4c+*T^K(m?8{1K<~6DdpwD2E zCa0M*PIv5Gtwud~6V1Hef-^1c6+{wzGy;v8sS(ir1dMYy8%PKv44 zg{o9aq-qEaVyP!jLJEm2oHf4|L=K2xjeDh!bHDlygt&0;Xe_Nv+N4eZC*6w(Jb$kS zi+OyTQ>`QJ`qt?i)w!z1&h&ns`V{M>yUj922x|TA(a-HqD#%49Untvu;pU=L=RDUo zD$RkU7IucWMU*EQhN@6S4mQosfAZ8#cwIkVj0R1XPl&|TvqdP}b4 z?s2t2A~kU)3X9VOWSw#4u32E@X0V`jcKAL8!U56HL@2wPw_YM*;87SAH>a6RC4FI78HN)NZ z-a>J$k!UcC^q9tJq_!V6=A?|_5n0o&3FyL}6HuP*dMGmar90Ru z`G|q%vc6;Zn=jJ`fBX!Leix*`^ER<))Ew6)2rxJMMJ$VBGNIgd?90h`k;DOs)Mg1o zvd{aagB;1&+({2bA5|nl7(#Ma?Ub|dAiNHKP++q~>FHo%I$@Eb`-l&I;j1rA_;txc zYT!6m!J;3_TOFiMV{8ZNt`)dy8%7npB75OwKpRU-n|*mv(u73(tHUlh!xTbP(X3z( z4+`s8+n}GTb15E-I9|hmT?dwxPq=T}ZAI~-KLEfPH(M^yV^T4vbiD#KHAzd8X~hXE zMT329>Y}peSchIq=yuckr<`iutFrSW-fkOGzqQMb<`-c+I*mD5k>=7pZ+B08-&qNy zJ9)Sq&{a{ql#^AY04_)|FmPuO3(%72fA2bErz5b}Uzi+TaC9sdR#DW>$$(Dyx}!J< z#HU~-u|ArLr1{EUT1MpX@D3VYt85g&O#Y(->)0r4r-fpVInY`}S(MZx|hG z)y~`|voSs3BRN{=%1qB+rU|)J6c{jY+;0sgLRkylT z@JQD*DFg@&srv=pK?HByiJ~{9LdE;^bgh}Zb{6JNuzpkr-?G6W%#YtlD`15%bt9N9 zyiObh>HX6M@Ui~Xtc@IoIyXz3HfO&Ik1)SX3TgOgR56BcHj^{cG?4z#6cVG>UOx^8 zn@x?fM#@=qV~*$g5g@lF%S1&9E+6ndSTI|(#vv(v>&=%M&0KF#5_yTSKnZCf7-;)U>V?P+)dZgQ;X6n^jDfts>-t zqLXiC%quMxP9f}G?wABGOQwdl()rYz_Mu}q`mKxxC##B_k{L4f%$GnfNd_mG4XOCI zUB0}OW3ijRr@jus%NUQ-r>zNq&`F*B@`(f@k@x5LWSL5kWIwq;q!6fQ+i@^I?ZExQ z=4q4pOL>1C&nw;B8vCCj^W$XlGMyc8Yq8OIz541={F=_84Fo6B#s$(J=6VC(z%}Y= zl3K%ToNO@Mh)W#HvgS^@Ft;9ckw>nO&QJ#yh2Gk-y^XVOio-k_fMt(mW3$@HGVT3F zARGnmlwYokN@(62adRe7k!P<<@|J*7J&lV)-j@G#T%-?0dEU4AZu`TiTaa(*Kyn%& z;mQucH|HQrOc*}{mGK(rA5jtrIEc|J_@qJF(NK_@#J zCQW!)WqNF2M$eu4wG*sC!Hx1G12=2Kw5vVEd$DRg$Npq8k> zmpiLs5b49gs7NE@pO8$M#*o^%FGJ&|oqT#XAHs>5?vl0%uRK(Y76Z9uAz?DS$&3#j zC?UqSGT~FathWR0wy2Qm(3(in#Q( z8M~1}+BJahTwCVlHeoJ~av;u!-kcmDdUqd81Cok}jcx+fR!h&;5E?G2seZ(e^9}QQ z2-bm`$6oX({cfrwSs++-`Id}bo0;^doX3USkuogDd^%CcrKK&zkpo|PIt_Mql-tHQIwZ(hH0_)0@VRh8v zm>)Ay#Rczu2R>KGM~6}3im%OpXsxYg2QgbkzN82By z5g+jDl339GFaVNOaJnN%(=^;r#9O{3E=`Sa#ljq#(ttNeN#2v3))d3IF_jVQQx_Rv zi40K{D;^X|2S9gCFdr_!a*7vRSjrA-atXU2i9^mM2o^Y5NGD-_OQVDkeyA-#9van; zj6=suv77BY+kvM->Q6k=Mga{AYiOsgA+G=fW~j)lt4UedYap4`Uo8atJCj=lDRPbb zU${@U$$?sRyb)wPbslBVInSo-Mb$Ej5Oyg_C9{af)#|M|Ka3KC#niN&Q7{r2LU=!FsIRZ|m>|InY=yUcSR$sbgE<6ImR~1SFMW=2N;v4- z7)!ycU+EhRy=2Wam*+FiXcRD*W^A6q5DE4ud)E&2HhNHV~2%7!{T|R(=HI zN~zg00=8eJgy`|P9qT8$1A@4+D6 zVWMM;J!p-HYpPz6D(kyqx{c68LrO@Tg2SBr5z!0hC%GoCCX%&>L^dpWSew-#PQ7Xr zo~cMXC4D(l*AjfkI#*(NKF^T+1f}e-xP}6Q0Ojz{o{>T$rYe}UnOX*RSO@ z(mTO%#7;IzqmWbp=PN_WNF9TuQrRF8G=237oPoQjM7T}#w%Bc}shGzx27ks3$kxC9x7p}g9RmdZ-`UnBy9mXG@C^HWL& zK(5q%o*RE0r>A11@?uyxJPETy=apsCFz;dN%unwze+!F+IyI593xV^`f?*WBM~NK% zb(*D>r7w|6QOf2{=cu0jd`D~Qv|=236+=!&<8n7?^v%4Dq&K~9g8}LjRNY*xgT#g8 z@N9vuz29_u0|N=osl?3qs??Pl@9~y`K5O<7_-H2Bm}*xYvx?W1h2^kIa*y{Rcn7Zc zKyegK#{?lu;kpO&w~dF7_uV4eai;)s-Pvs68oF?sf;r|b>zBv(}9QjHAOwEz=m}js#S#vS9YLU%(yh^2LY?(nZZsg4Yd+X z0haHq!-}T&7?2_^x8&rcg>-H3vVuk>&lp!T<2%hoRGj-!{Pgr)gK_q+G7}wmsa7Nc zKym>A9mGpuGmSRLyRumleHT{Gf@qEeN2EJmR(dSwrQ09|B8uE)Fso|H?ey?SAb~!_ zYFd9mwx;Y-;#DX&W@95tZj_~n9JV*=##b)FBQ^3Bc`XndAYG^1!;Si_j3Vj%*bqCp zL7pSfSgPFItRMzkgv3^1DTP2z;#Zuec}XY9oP-4Sj7+1D@%@9eUiuqX6_tbh63-gu zrilHSRXGWf?-oi7JWFlE3n|aFS<|f3_Sy3em5V4$ja|u}bcw<&HSFZlyxJpCy#9%P z+|xx;twyEo<&0{|q&)00c6DXU4ktfI$j@OscGAlV8b9E309l-Ax7E>Hybgz_p@Zqg z;+v?SQ=Iz0ZXsnBiAQ*Cc<8(+=Is;fJ#L8VH25z;bE|7ils$vS>kNTNNr}TXl&mSz*c&_8Xmh-14qI|Z+rzaPSOd{eQxIw z%sD7Id*fCsb}kWvl^6&Q)u$`II0!}fa|g*#T6(A+C-&R8)JJ%85Md7e>&t_1{&!=ko}qFf91 zh|#$xbwGtT;2KY%)^vjsw%)03{`N42jQ3vqiE~vs}8uYp0sJq^lssb^_d^`W< zS|DwXLXT~lN@mFHD6AA!gi1ckZolI(^=>qPzB_^Zj?zmiA!nDi5{aTnxY_;$tcQU{ zhG2|9Q2H_3IJ9X}_5<=N4P4dNh^`&P{Y25;35pfZ?dptp9qaH68JWhc7#{fn^z6^w z7sJ*%7sx})8(g(Svc_p4==U*%_wscwox(_Q9aLMsyUd0O7C0|ae(Q;0R^aLV8E09u z9oB1!>w~~BNCP@>Afctt2rgSUOQ-E};>n0FH|Xwz<8op6io4Px))l&#s|0cm&-a|D zfMk&t^v_X5lVw2$GGMdpM_BF7IdB~*eB zn^J~%R!g!BD}3KF=3**^M2Yq)rgpKvne+F!a;_Ktk8|%>ZF+i?prmPe3k~mA_>B)_Hexroo139sd zRMrN_!cuw){2b%EOj<`V+iCpEF9gfeeqmJ|u~iH_q^tDcdDTK_*c9D+z5{yQbgpk^ zi}rdkTMtvw@`0#28%-7f>o8!bjyT-y*Lm{LIOH4ITr-MDBUgmD z8d7?>MLM%6ZT5yWW;cxH-EuSG(T_5^cOcV#CrYd&#|cGNBnRY%)RtTA<-x*`ZI*HZ zzAgDzxD}2?rwz4kTE3m*RZ%{T;6e4WdN^5j`%<_3+U5PXI_2)86It`R(<%tKz)R`E+efIK zlvjij_*(S3Y-$?H810f;EC0}|yrtfwF>o^sF1j>3Lg3!iU_?>jEcXbK+nC0NsCs`S z&y{7Ea?ZLim=4d&b1ujJVuf8G5SQ%{LP=o#s(2CUZEm8$gcjKP6%|eb_j!LS_(uVZ z^5GC)S`JO`u#IfCn~_(xM;bCGx{o+BQ4wye`G=0Ac4I`7ZA+VruKl_JIy*@OmMJw2 zYPw1l*cJ;~JVidctgf7b3 z-UZ!e!0#;|$kebszDGx+m_nA&c1|m~hpRC=;A0hn3$pqYogPcx4bLfw8skCd=hSem zf~GKDKrhh31RY#ZLFp)<=ctD6$-LCSzr`MW-`{}6cEacR?a9CM-SM{XM_jJKGWKe; zll7h%;Bm^GSIGmbiFK{WD@4@!2;Zn@)}9yVgSeaDIp4BrNx$Hew~~CzruJ^l&+`oz zI_(k-nc^z?g_3leKC>M~-Swa2N}PnNq-ET@Od}Ins*JAp3F{(ixS!STfG0 ziUjaj>mJR&3)=`o^-(r$J50!hJ6EsTextkGZ={9*>RZ@gvmWj9Zj_>ocQixHdlB${&*rq)G z=!>aNxe294uB?yxN3@mikzaI}$R5HuL(uNtTvA5pWK4g-u?b{Pvs}a| z!Aw50iwAd*S~n*pWy!i`<9RXk-obKJ)`#odkCa4z@8)lduS=aOjI;Ct{rtTiwZ9re z;zoeX&u`9DI{&0=fo(lYYGs?as3+0~=N;Ug02s^>%%3Wl0g zSZsa@Ggs7ReF(2H%uS;|cm3ujPb@kzY8(p0x676BGszgQF|F9w?hXhfSS1~vNX2n5 z&UEc1o)HR`)>tR#?FoCYWoP2Ef@~op#0EFNUg_1?PZE56(S=^Uk0hz%o%A8NE78r#vX@vr_v4c-yf8zy`%rzZ&|n#N z`=q~8toUFr%8?#hLq$$^Aek)<8Hi8{Lc1OPQ^nBYLpa}=Qlas1^3~hRlDXzI+t3o- zBb1y)O*aqKxVs?c)0b>`@QB}ZS~Ycv?Nc@>o`{{d)R^TUUm*VJbTf?Q8QaU$&X-IQ z`g9gtbY2tIA3bcyV56U6&>!ZWxIya$eFJM|e27kgz7a}F{G(LS#G$ogVXkjt5^uCC z35$dMl8fNOGW5SWP&~w&wDrH;QvustuvYC(HbQeN%qNU`^lsa;U*4&t;AQ<*(zL&V zlI=6*pd^?Hd^WV|)1ql#8+4oz50-U=ZE>eYPOy=>4ND!J|g)9GDWJ3C3-+geiWFx6lra6Ej}6 zoHs)fp<`hqhk%#yfCupV?Rhv~zKBvPx`MmGiw!oZxRy944nwdk2(0(^9PW)6mc-`w z3B^SM@kfmy6`aN&W%$Qe3;A2t%7*_jwt2#5tb8d%v~2pLl7v1_ct5*geZR!wn18k; zH>K86Y^ttzKk@rb<%1nv`l6Eix9J%a2kP;=%i*DYxEYG1hb099t70lbpZc%sPgn33 z=yisFV#1*MiZ?dSKUiF6yOlzul@OQaJgE&2GXp?<%N36U@TG`xf}P*bg&ArAxsC;j zS2C;c{llXo*8G$8P3udK7gWs9%KYbwE2Xn4ScTH88Y^y4;6Ch1-a7*m?e8gHNsNRD zu?w?VyQ01AKGzPM&sDkM5bj^rP!`lzD3>)#H$+`EH~uwzR|fe06_t zWRR?45nN-Bf5!r;wu}rQB)Js*6xF|cXTtt|r1eUfv9;a9VVezj-^}SuL2oG1W zwe3D$q6vh{{5NDg4=tGizJA(LoNc#(@I$-q!%UZ1H`! z4QE7BS>EQEd@;Dyb}ufb)8KUNE`yGGOblL!$`60Lqp73_T}Is3`dI)IhkR4Ey={I7TGI4B=w8n;n% zcD4_A??%b7s`XmZue0h2hx7_}#UKutn3#NgmDAHyPEPM6B$%Lpg|x!I9avRuGgpm^ zYu({}Q_$e-R2aSZelF9My#W?ZMgae7`|@StMScHKk+Go34lWEyUla115Llm^NkGu? zHypvbR*L7n&`DEZfvGd%dBrlFC=n~?iP&>{Jh7j&`R|3|_l2uiyA|#!Qi3jvB%D!rhI)3TX8C`mmNXV)(YzDxqjARN7`!G@=#HX>!aqooiX5THB!HAC3yT z@RaeCgzP)mtFWHNt@#v^%$zX-03k)$&_t#NcF04n%&5-{EyQ)S9fr}rl_tM0Oa6nj zK*uW1UhNS1dXg65Z8zuga%~3gMbsfloXrn74fTd>uXICAc000 zr2QL|MB;Wx4-@)v1t-*X52HMXWohB(>Kd&GBZ(2ymku>u+>OWN!uA32Dw-g|=pVp;2 z#n4v=k8_(QAhiVlt4}(VWuk8l7(_;culpZE%5K3qSLk{1CCuB`j`~{I6Su z526fX#_W1t;v4*;6ivK_iDje!$=EFYMfhFcI)OgJfl-APxGX1?+8tHDy!yAI9<;sWb))SUe?9q_1R4x???K^o>mx!Ru(2<*{@qz0 zmVzB925PRc{Qk@7Hb2nfbQasbFtfGg@<^#4r;a7G;-Ee_cl+Vd87t8F-=~+e9MV>= zCGC2)*P7S&3JmY0RTQi{%&bC<4UVY|ZT17EAumqu1j99R!}M==iT_+< z(-1{cmgk3Hgc-H!?~i>QWq@mWZVDRN-6TMC+rJhHgAxqAfgsxI zxSJZ+!5wS;v^2@dsgX_Pu{pM&MBPz^&g-Oq<=E8@-{8{^xduY;ADY7ZmlHbyD8BTO z|NUD_&Q0ZD)+1=ia%9zQmtw`0>Xts2Jc5fblpsdp8RKs`OBe>w7n8gJE*HD$cTVa1 z*xuyi>@2#RE&C<*C;ShIPW=UU#_;HV3*Px@!fmP))MIj8&(yIHz(lWG!b^d z0fjDPJBORUSiwCObs~HZtCM)}xM~)q$OO1`kv~QDabGZ$XC3s&( z29O>NWF`GK78C1ZYH$7hJGPur^*7T!eVSJL@>IMng8Vx;$rXgdzJ!1h#xB3=aBWLR z@+WFibjakdMU_`&K85iM?cMlZS=PTv>^di?6#M(}i|W_uX=|LTiPpRyJ-OUW;1Bc7 zALRk=7F=4}r2_4~bQ|V6PJG~`1izyj^81PJg*4UvHrdv{K=4xYu7PMpPfm;reIxCt z-UCDyAjFCa>I+i{Lgn|2BFvp#tnd%Xc27@N_@MT*w&5*Zy8HO^iu$}VX2bdtRZ8N& zHK^6`%b3^di$y0pAOiZmgHoV#M(C3a_yN{{Iy|RkZpht}P)py2OOq#}Nve91Mx~sk zwN<>Nii%1>1TQoL2+9i?aS?UOBKc;Znp%>*G`qWHRSMFF>q3B4f2U)u`s0@H|{$J9u6o)UU_I`+`jqrb8-1rDC|+Q2##VMLi|-FVe7QGJ3K40$~v1?iz5gaIa)` zHB9V`|7knk1S_%bV!?pqJ--4Od@2o_o*m%4d5Y_`*=FtegO-n99Jb=qg&Y6 zk&+=%r|yuwGQszCZ>8{`3ZU-JRrk&ST}`5l6 z=jajSprxo%-#VYKA-{UApZ7!kqm;|`n&s{M0bAA>JB7K&5aQbX@la`j%jyxt^(H2+NDpS?e1OrA%_c5u&mQ~a zUW&XJvsP(b@Ajb_h!a@^2FH64Ao{04_}r;vxyJVSK{w&lB&`?C_H z;6JIFs@bTPZst7UK^K3%rmzXgdR&q(_@=UWx!_A*yF^B)UzEA#f+YTyP%>M#>_L^- zntfXw1<$fXavn3s#$XKnMNgC3!W0+z2z*4O#Le$BYt+qjMwD++%fOBj1n*#e^ zPJ(tvkj?^955_R$$|H93pkG1x6<>+F%G5V8lXl^I_eKYs&mNIOPcURVhJmHXWPweR zIn0?mZM_XO%qV%K^n!bQQk_Dn*W%5ORsc;NE1e%IBUehiglVpN9!D277Kn*lZSo?^ zO1Y71mb(gGXhiKCPupP>LZeNn*^;wUr(M4u!+ULLM_N6M)|#-sKnPO4Uf|AFB+mYs zTEbiTk+K{^yLhyU=vk8Tj$80r>5}+&9PWc}m)bR2-B^F~M7t2GrMOT%?Em-3#Xbf7#df}Kv?$BgbMKrSL?sh3MT;v#~_&PU_<)zMq zL$a0QNa|T7Tuxz$tu_AR!Bv%httu*)pO0M74kR18EBQD>T@x z!#fE{KZ&U-`RJ(%3;%N0Tmv)|#|*oayo233QXCx92 zB%)^0la2y=PPgjN$a2k{#C_kknAMF&Edd_aTkx$JnYH`j&3>7O!6gj#Wf~ z+H-vKQ!Cl7FXxJ?)OX^$CW7bAj1fDgPFz=?ZcXGu+=q+%*3nF%hOQ4Z%`Tod)gu$Z znIO@azBc+=67nu-{_(E|19T~|Cihowb0kj}F}gE3TA2Q9U;&(^EDYT2R0wmUp8X!* zEYwf~%i;TzgZ;Y9Y<{FTTobl=(K-9CR|oWF)xwp&eCcuA)jR6|8mB;k=c*Q+_h{#k zc`s-3A=mIeIpywBd*P9-?d414r`j8z1;^O$U~%u-hi~#G3n@h?&9gOM1!)KrQ1-+;4C9Oz#N}m zudqfLjxZy=mt+&f;MhcIY@~+b?QtPVLcX(Qi~auVI0%JOjm#fBAj&MblDUi3xs;c* zB`x4E1BvMcI!s`w2F?a84|8bL2>`-f($RakSTbrP6@_0ikZ7wT3Muhx@Ck{IFDVHb zM`>c}x@5*YjmO4PE5r#N4x8}1-L3Pw6nYjs%T=)LJZI;<_YK;$+3)KI8PT*{1aM!P?r=8aMja!C`X0 zGnZ-ofRBEG@Y~=UF~>i1zFs2wE%$uTrVy1H0EwtZQ48)`#Vamu)C~1*;&S^`>Ak zV|_~O05~~iem6IcIl^#7dz~t0dPL=)DM0?bAJ2D6x|)ai#2ju9@8S2b2gJ+;360zs zpx*?2;dqv3Hc@^qiuStA+mVq(rw*-F^H^>Ae~5! z-J$@d(%a?jQYT8;=T`c5pqN2Q)z%6V+}R*txS5}$$vJb3?+kAPIl*D?*75x5sW1l5 zT36dUB34xMj8bW|>CSi;+*0dpJwGqoc%a<)y{^n)#CIIZd}rH@d_z%A+e$&+NVV7lB zC$*%9jlBu|@DCaf578c+q+_Ld)E(7>iEkBXD@`LWb=;4z77A%9G=(1MNFR=9-GXV0 z%_#IpGVh)jS=VF=s-lUx4sK&Ka^WcJ@1_2VK)5yem}B;Z_;1|jT=W`uBZFtb;2ue2 ziaEj$*G-&z{b&0Na&5B$4hGV*t{?ZOAI|$S-2_C8w6(RJp4!5>A`~A9SMqdhG=S$@ z2i;~GGhnEGgs5a_x}Y-RJ-iI)%vLaC*3fgAuSvWv%V!_>HJ<@<)Lb5mV{;G@{ylp1 zCt7e62t$CwwRc2`Xf?I{3#NwyKSoWNb$Mb+X_dCGh-tOI&IRK6P?=@LV2n;ewvU{( zb!I(WY=zb>pxd1F<^Lk?t%Krf`fgDIK|;_F2=4Cg?(XjH?hb+A?(Xiv-QC^Y-JJpE z@Vrm*-BY*Dt*`1EIdy(**?se&6|r8IcIm1hY9PQn$>G2{f%D>VJq4N26k)3 z{5qgnCJW=3#ao^OLqqCkO(BPQ{7X--2_MJk^avt9E%cU&xI=B$FtDpAo+IyRt~Zir zqgin=YH|&TJGr6JdI`@Ov&CeyEg0pWDVDbvdb8#pkMp;zu4sfLmc>3;!68Z)$tT;t z0=?Vuq%mJK;B6wzL?kUU`Yt7`pAN8kPGxA`D}4f#q9W;g++`!QE`cmtvh+!IP|yZG zEA|J?Pk0In%o?R5+%?YEH$FN>k;__>#xEwDz;$&^ViuNvDYri)l4rZr6mO)hS7qCs z9e@xGOu}P6%zdIs9G$lq+cNt$Df5lOA2asrFQ?&li2VX; z9W(hVXtX4ZDa{ZO?6*uQ6E>9fOTYs8cjjL2Eq*Dc9;P|6RKsf zf;7qnXB8BY&&7h}P+LV>QRP4kSWP{iiuj9V#=w0^YFd%lYd{byz;%;w#8>+C*q^K?7#D{-ku)h37p=RQYE0a%j zKxVY+oz5~g&kJXKjbeC5p0i(goa@j3&qiQ0GGGdBm~qoK6*tXVR)DxkEIgacx-W;` z{e4m4MYPTrA^yPOSoqc~9JnO3#H*J)2;(q=|03;-K|HNvkbIkbAPoNzc}0nuQY=2# z+t<78d@#?6s}k!serI6-%&mY5jBmQ<^zO2>D{m*jgg1VBMk8py|fX+lx z1J}0zMg;1(LAuD9@7uS!+gn+MnHn9L`F!fJ*>%4Qsz3+;Po*}IhQSL@vz?oJ#3n78 z!>3gxYriRoIrTDQ1I4Y7_LVt1eGaD`DwU*N&iMph%o^s>{&=KR(0O0#5Wv-|tdCo4 zHitJoZq+ZckGHpTOQgP24n$ckJNo|~<`2uTG}DU-CH4qZ3TS?YUCJR_?EKW~cxhxl zKl&#^z^f7Dn@6>K-4ci5aJs`by@&r{i3&Gt#b{^>FCA1x86RsbbqKp?!asuys z>>4B2sI2QZCAa`?@#}7%7Cn}{guM~(A@eibta`V50!XRB71eFOa497=ppF{-gVGVKqOpB^G@_Sy2mB65ccuKtQXTX{;=Gs8&vPiE%r1W>&AX7tiLaxH z6j@Z@##wW^Mwgb9{QTo1foy5z)Z71uSQ}qX&*m&SIfG~`8qH3iEjl5=zbNwu&5ygCDU5wv2`-2@^_N0mcx=pZ*oN z6nFRW5Jk~*hZ4tE6ilalRH*+TR6fqHL>?$^bI5(vOQ$u{QvrdRGh_W2L4vDo0FhMwB4WU)L}_-wLhqP zYO%X^;XQuKKL7Kh=G9pEb;8+F{O4`F8b3d{Nz$*KW41{^RB4} zrZ(zLvDV^Xe%!xNoPScTHtJvj6C4nK!#9qo>rjm1(tA@~`K>dn5bP68$K@o=L;48%ti#e&g{j}>~ha8lTcT=g!2P{lqKr` zW?Vo>b@3{Ml;-@+c26*JDT8@Y1J#z(E4_h7Ww$KkZw%}wf-Pfg?1pODNg%k33=y~T z8Q?Mo-CjHqNr*~{>LwEPA4WXk6_Q0YU@_sJm5A{5%|jbO>TFhKx1GDHwilrvrf?Mw zRs?+M&gcqA!+)8CSLX^e8;|j}><>lQ*>3Fb^^ISHU&ls`ji%T-R&Dj5xu@Mv^@u0L zS$*G~{$=?|ZidbwZI@&AX8*F|Kg6z5y9`k#0o1p!%r{@&NJmY?L?LR4y0}siAh%JF zHvJ{6Qb?r#L)BRyZr?Lof2X>0Zau-s7P8K~nl-lB7qyA)&Lz?{>y%vUJ&dXaen84b z$78kTCa3Cs4f=?e`i&-!kr{t%SNx%N5jwFq-MP3gO8UaXCM1q-*6l-@NT&i@MDWr_ zTj;xoC(|j-snpOm81Ne3S;)aMzNwvI0{-dvy1etvsy*h)wg~Qxl`25(3IA%4CU^jT zLmQ01J3Y~&8I<<~gTL>!}9?bI+OL~9ea;DJQqd?LY8#dDFoW<=tVw3kvPr-R7 zq@-x3Qe}qT%b&AI@>1;IWzJUU#?6y@e6pXB%WX7Q^cM-;g1yn+Elj(b9r(>JpMcy# zKsY~Sa2y2T$mTl!Vvt~pnU#zw;EMBZM>XpogZPjB4%nC&jLEw-(tiFzR z_j+50PV<~cpwMC{2rO8)mjaIeqy7q%J)Oy{E%_!g+VR>sE!XTXEZx-TIP$W1jqQ^t z$~}LeK<3QwuH1aEo82Ll2K?cXR6JI9S{9#bUo5J+!>>7Fz*Q?GJP!!ZI7oOO_Wdci zUnbKw17!1(qY2q{DzKB7Ub(WId=3juT#=%2XSEvKmQt5yD?`!r>ippNJL=t+Eb;3j z0F&NRmrBokpX|hDaJ!zKG^y$&{&xwdO0vO46xur)sVawDpPEv{>k~eJt5GG|4p(2a znA7iWHMwpZCMUgD6+X)y7v8!^?aq>Wu1!xlN?hs`snG_Z*FNFh8Sc?-Y2`@uDq^*7ICgLEAo>#nW<-5_aN_8zuU+h9yw}m> z4{;Qv30C-QiUFUL8uQ00?)f*d(gAkql(NN)=nICR6ORDnba!cp)YNe$&Q_l5e$686 zyId@(l2q<#VR|Ha`ROTzqE^RQ`NgTY#l=CV@>54D_Y_Oxls@cC*5kFECKi5o1#m`IdYIloCkP8bYnQ>BctX3?#NVH<#@4 zggGLsF|x_zh*{{e!m*ZB>Q;J78$sRV-+mX$yOfalNQo|f3Mx}VXZRc>nX5bnklCd^SVmXUW@lw5^dj77uVv5H6pw8#B+Psb={VwkxJ&CCp zU6{y1(kBKx6}KpyC2RD0ax$`*+ImLk$qiEd%eNAviE63U-4qlgPXdDvMMpfDLc-O# zosHeO)WIPN*KR7sgtllmI5q=JFo9c|iS_I8JK-q+{V37r1)A=(tgX6*K8izrt9P)W zlp?iUD?HiY`TfjmX|Bij@K&tDQt@(6x4t>iFT`}1ycrorwj5Bx($fII7A?j1yzMR} z+J^MI*fZSZ>0r9jyjR7@Z>)q1;doJ4d;8vS7#Q50PnJmZS6rVMtEij&;Hcag>>ozyFPkCt&#=dAvtBQ_ z?Ivn8HIVQLJcc2G16`E`t35P2GUH7e(&%C~7ou3xWXS7M&99F*QJB;f7Lb2!3M}}R zVn+4u`q8v7#g3OD{*p|;MX*DvMAdqo=JBhci_?}_<}n<86{Ry2YTH*4-mT1Sl+nP+ zgzr#sn`@0T!5|pW% z!sGl#iiogdjJ;OjKLG?wPgi&R!%E;y8D*d&P4p#dl*3iL@U?Wi}Z&Et;a3 z*H_!{z$Hyt5~n14qHsl)#09cd}a z-u`2?)iIC#uQ@jU*R>T~|Gl%dE?Sh7lJeI8&gK&6;)8*`|1%4aI+OnoPLKcJx z4HwR|HYYznkEpME+_4T+Q!d+*kINSq4(*;kq2qW{cuoXUyx{QuNT6U2*y}z@!{yGW zyV-zk_R}vY>K_{bFG{_b3Ga7)YIP@JC(bP5 zc_`1=>w_*@lQ?+CJ&`FWC4Yao{kd6HgfjiZ;zQ@Nps`(A;1RjgmIo*yu<*g65)I*o zj{Gg7l(}zozHLBYxX90Xf1$mxCZ;y1BIoGLp-Mz}jnKb+KrI-%id;0JH8%aFE&l{o zPIelLaiv>a#X3NEq9Z*Ceh0tu;Lb61$5fQPUbwRs#+|1xi_&V28kS&4Iy|g7>9!^} z)N$Jk9p1s2Q7%q{mVufOzg=?2Ar{REKXA#F^#sYal^(7ZCoqNTUC;EJ`>px#{xrwy z+Ubk-EQVByp|2f<$UYU2l4y9a;gU6#7x;Dhh{L=3(i1~!8?63SX93FY=LKDF0kF4J z>;c&bQ=@Zd5dcc?LD0J9C>ErUnUI=ipg(tHu{>84w)}MLbg0vQ{{4e9rqh^2O=jqW z+diOtjX8owP5VOl1EFcjp@#SNoTLzoatlk0{i&wa;pod}LBtPPAQ*V6FT>GpQ{6${ z()x|#4^b%ATa$N4Z#rGr3qv9okRk6?+XUtQbp4rQoK16yjL?Am2Z{idz)V9?oNJc$ z7p8?K(7PO>*n8@bQHtm2BMRJ?%?PL{fjw=LX})A-W!sM$-hb-?24^_A*l zQ5~U1-kHLJH;1*sPb4N3{9SULJsR)5RXUXMz^z)KW|{`>Qm2I|7(HBf{dw3UN)wf8 z=U{A=s_kRr`RPKSG`@f#&-Ad0|EiN7Bm8k&i1yq7GxqVf!w{ zE;ixqOr%tq^AYCzNaizE5jln9d7*>wS7u1q!#KZIJor|iKFHsdpew-noT{bcys zc!z0V8JN!uuh7e?2Esunx#YaZEjGt`tVqu4Vg(QJbE^nhqfDWTdt&}3?%vg(jwo86RFBMKAecP3*$ByrBg z=D{ue&zvN%G4EHK=o~RL!phEpH7F#vq0l{G{^Et!8w}&Yi(43Q=VE8nn*yGlAbE{S zN=i%11m{+E{J`-wKq7&8J9aq( z*n7jqERuo;M}(Dame#sS80&=PdHuh1qFPtK?Axkz@e!*bKu|Ck2R;QEE)RdcYuNa7 z+`)|(NU^K{qlJPmDYio&@^;ta-Geqi7LxqruThhCA7Rw7x{IE1;OKsbj(xt%ad1&3 zg0r8HcoeDD?%aYqXJeviEf!O{p6eu$@$1@p;28wywMakmMP_owAz)Gw=|UvyC~(Ij z^J0kYE1`{N@TJ0yWBGb}l6&&V>(jTxAxUk{3@Y5XnCYlBJ%Q~s=}VD|hfVC1{xt+9 z7meRN{>=_#b`L^2*f|N@gX)3kb+25r-@{ z{K%`L#apP&!DsEE7?Eb8efC{1l}QB5_1}l)(sCuG=YHd(XZ86y^fHSx1|f~D&Cs>= zu9&PO*`{f-S{15cii zEVrGVq6TX9Ka4?Gr}I&2_j>wtyoUZZ(Lmp;Cp{}{Zfd`2k*DW>FQ1n=4QzxI z{k}azhwi|MY=sD6D6pI`R*ZyLQmU-I8|~F5)w05#A7N_2Ql&0^GMtBIkOa|;I%_nq zml?*>)b_B4^%&r9{?-{@R}(w)P5*TRBmpkPy3I?Br7}&;>or^qAskCAypux>jh#~& zzZqeEBZbhfOzVm((Vcn~JN3Ac@or0AkIapV70OQMKqT=Qdzcj!fjz>OO=yht1Ad*n zw7t?wCy~iu^-A&uX(e+V;m47~l54?lx!$w$j$HEgVyghx$)!zx`Wd1gs6;^q zgl8F-J=*Ivyeh0;6)vX5E?QKq=35@F$xR;s%twc$CDN9|Li?B>=yeckh*0~eZH}e5JJgiLo|+#@S1@ZPE3G)(%)QR)tHVE6!7{K{%+kxDwBi!XGx z%gI}Enw&ao@rJ*^s{$lGRqw#1IeDHJQZQTis9B96al*Zu&uSB-us%)XjFTwwREdPv2Jbd<&JIa-BHtObsy@{rk~WX>W@bgTk2AphzNWY#=&(wmvqu_-`exMin~ z{|RXDZrb9`SXYRIDkyJ(Cdi*U>AnKfLdq_k4--m>q*S5$&`=wu+NZRC(+&851q`lCqNkwGmwqJQ4n4pN3I30aLC{i zl4QMQ0_TA29XXoCGc02W8=6lBk96reSQN=i_0!c0veoGQ zS>!7j_w6waLdgu|a7SD`i>vUxm%Tw4UIC=FQ4Agg>`I1cRs!#pyrZ%_%)0V~!O3OK zs?c#@pOUQMyPmZdC(3(+;%dh)RiBnnVzTOdz2pusHunk5MR*O5I3z?oJFYT78e?ou zL>Zogl6n?f)W^Q|9z2xtae>9s<*Sg^T}ll-%UxM zhucXXl!U~13>mH3nORMuynzT}{I)@4Ph7mk$dZIF@-m;F-bU_-=A5z{-+P$3@3+t^ z0h~^&`8b_#j^<)t+TWN=-eT!`BJG&0$J>i{ot2UHiPtIXo@}FC*A1t(VzXD#3}vM& zfJwvctlt&|?QHMI*~P#Yebgu0(gcU+ydo4PQfb{gCzyp#kl(Bhc7eev&44{37eAIu zu1rZ9ztE7d$5a`r`tM64=QU#`WlB+i0F$E`jCBYRbZ3=@!WC}h`!&jnOE_|mAcy(z z^sGnX4>>&wbz2t8053*T9rfD%la2ax-`6NKmx=i-Rjt{Q+eG&ot-BYmHEe@h;`&x_G+WMb8>QIS zqtDZqjT_7JW$0(<1$RNC)<~t>52kFvL5X^tCdo@I@jp5%e zFC7)Pp*5wQSNVxl;Vxj%Ol45UQC$U9r4g-3bBXd*9 zs~xfil$R7Y8qsBA7hD3V0OR!N))mOfDN;OU0ZBcTDPH^vFb6=ijWoess+G#q9fsYLHQtNj#-6D7ri!d#=bc?N4|mlT5gi?K3dHnjz%~(BdPPbVxr|3N zAePT5!=SsLASRIEp(%xS9{R;$axl#!G+mCu2X*2VWbatj^UOdFaLYYBG>6U}^tK){ z=yH`giCITW&^~903Ak0@o9*dsWxJQptRa7UYOWnmQ>q9`K{iU2#F=9jTAfo8F z%~EOLvYka{HxFFoR_QS+EalMKclBU5lk67ov7d_i#lDIEkeYcxu$|jA ze%ESVO>r~`Z#J&J^0_{GHJpy{4|j*gI2&fLEyL;!41VW>Sut+?E(_knqO zZeihrS41+~XwKO~kdnY~J(MAk!pAbiQ9yX!A0PwH6(s(czZ1Bj`{N&8y$||vWU|@m zA{;8aR)Vi8L4MIs#gexZ+$|#--#wnv9|O5^)`ASJvQgfmmsV9TBcrH*J`eAZr6m;S zfS|{C4mhI7KKkrfRIv(tMF^uY1Oie5BlYUg%f6>6Q$C!qvH>^n4gLejCWvIEJ+dhw zUDzWkca>s%8G{$F41JU0$k0Mr%ARc5I^8{c-$>?KYEY4NarHex=HLhJ(_y46eC{%(-;0#ipu?PWAe?wAhp z4`ss&eOBf#EwmNsh#ZgKHRyC=1U5OJD~+=8!cOu zi`<3ZDI0(Hs^`3w<)f9@R8yn05h`zvgmJW}@Y#W0u5ENOJ9t0SJ zvbTHAax;8=kpD`4(jVr&UOmFzrB;?rzL`@!C-s%Q!S*4GbLB;PB1cO*IREf~Zr{V; znQVl>Z->e-79y#LePXE zBJ&FZ2GO+gR7l7q6fDaqt-+o#n~ECsG5`gPhz7NSh;Wug2s*W}@-YUf{!r1Bb5sO; z;pB$8aGI&upCsR#xRP+o76S{!1NH>XfBzOL$->bRTm#ufd%U-2#n4QgJ!`k|IFIH@ zE8_~h|9(AttjUb18e)MWlsq#*iYiGXs8J0i2*_?)Sl{n7EqdPdM{Jtvd=;kAZkgWg zB%LD0lEdP2T2%7tWR_AiVWUrqSX5QVwdj9=656g@yI9oERk;Rx)AU|;)VVZ-lNOiq+01uW0Xdiif0!XF9VQu{)-)W0tEu;DwmZSLadH)A7@tcU9f@!|&GWEz>S@ z0aQ*tXjdLgYP4i{T6|l!vgruvzY9C*_St+~1X2~bTgy*-Kh$-X1%-vu3m4n4 z-aO2I_5QJCt^=GpPPQZ&bRgh}7#8n^irwqn9(c$@n)0~rddYRNsYA52_eLwYIt$lq;}^e zU{vb@e5Y3hwjsqkQ~9EMpTJ}?=Sl3R9>a^<_n`@bqOIRN`nsfFY=>sS{7{U#pE(nz(^`G@?a;TE;Yj+6qycyrnRPAa&M8| zei>w<`92BUQ^V&z^&RQIMN4AOttJ-c&v{Og@jHH<$H^Wgf&5-i^o(;Ul&PAon&ZyYET zW@QS~X%Unj()sPE{vkM3`eVl-2^x@zV6@y?F-@fE)$xGx@iDYQ{u!E(T2xKg2kNE9 zJF;U2<7)hXG3=ePVdhsm0SlK};oF?Ts{174Tndro^ZNby^C9~;P<}_1&bHe!mV;Kx zuE~#Wl`Ru&ZCDzq;eIM-917N1F~M+;{-KlOLT-UeuOI4aSPsB^H6m!n^kAk`!msT}4At=F5pa875E%07^!IxQ?)Y=9pPRM3SADT*+r zhJ32U1u<=`i-2F)Wi#)i0be8QopY~r1strf6g1h{qbo#s^@TO<&5g=v-8Riv%Cc1B z_;4~XVQ5-;cA>);y1^UaDPdDoh`f3KI41z~voZb>(TJ8_X%sMrBg&!}~!qsIR3 z9a(sxiqnjyk{D`pLEVY=Gu_oTS#B9ljxP7&RHzRg91WbH^gLzFS(0R_9M2v`#G^yz zNtm^!g__@>3o&8Iye&%URY(_et8zu4X^I90W~Ra0idXnFCkK$4*vJY((>^rotU7ZY zurQMgMsj3i+k3{3zw{nrERg#MaiAHc@X6d8eagUHF8}X*+e_{J8ZAl-PFz zgX=5!Cs)3_cjt{T=PWFOjQP;hF%^0eD`9N}R!s)0?zHC-2{ka5mE(OAO2_!dk>i}5)0i!8x^r>)%f z_Q~+(*X>v622*GnDp$G9LK3;amDZ$6^j@IvaH`wkiwi-p$;$~k=A7L@v`D_jazsHP zft{3ogdGqNdm#MR( z>>kf#`U&sZHJhC-0kB||0cB8V;^(wy+~i%#N8xZgiw!J6<&RWZ;kof5cAP8kH}RoK z%!-Sn7Ou3@)x1N(F*%j>9m4WjGbX|=DhD~xVvM+cFG}O5iMm*INGE|{bi#pe&}>Xp zSRBh-^;Q%t5?H0xFB)L}*hk$|=UY(vEgcbDuR@nz2;K$TuO^{>d5buLh3A9(RQtJR zukP*>r`198j>3I}l3>H>YzD;`k8R`fPubSd=c9b#-bI)6L4n-u-M*Q&-pzSuQ_Qe8`j0--aof$a5r+!gHjDTz=er~08a ze9yj&Mb=`>5^{BrkSd(Ux`tegEPiT}Xmd%WJngmH6{-~NTNBIv^<#_7w|0XY*{5&P zgM`??a`3P>a+&#u%0BWvmiwEPQ`3QOHFOsJ?m4+_PnNpo--GmIeYD+Pn)~{$k{6Td zck!lVMJjSlmNiZ@FdOp@bY+rV$N6mrg13b?LE>QW(b&D9l6XJ#@WSbHdyWTgJWG-lqC7Hc>xo8vYg}6~xs0E~7@(*|kx> zhLa@^L>5}kDykTR=k3bVgCkvNG7Fs|iY$WM%g3lL$_;egpR6_5OoJ5{GjFFeE z@9x?RUc+TEkxosO3Q701d50fzW2@sV;b~b*-?vZ-Wm7mWVD9tE);Do~Uc0RUlz!|4 zD9A`JRDC`hJ3#M!K92Q*JH%slA2ym)+B?94EeHfW-?|>vR#7eFXI_*g@_ogIkv1*= z3_PAZAS~`!s~6m&t8SnaT!Xcg^vNG5NUB)nirdQD#kl!;xqF@=YWk{rY-S@67H11@ zo;d50(mR57a)HTzE5$%rT2Hx(X3N?J;#jz7&%UX7$!kiD4krJ_xtSAGnY$b-t^2NF zzBIi7`Z1z_nmVqsOd$v~T%_+!31@-yP&R3NhHkF6c2!@%IWt(+!^EQa_KUulqO@KM z4020yh`+NDec*hXDC2jhX3@I-@{s7CB#8REs$RR<;nSuGOzp9Cu*Jc}AeeT1;tU%h z%ZNRD{5=K!{fT#dKS&ea6;Y+X(Fr2R@%KnVsUTd!=t(fqlm9TB_%6PHXJ;;jP2?xF zW6)}ZKO!&)i|oslR8|kYnlq1kJz(p&R<~k2p}vY{K2FCvMrKI+)d^a$AOE`yiNP}d zb74QwFI8Mv^btu^aApr(&%GK9F%EjHTg0p3ChmR;&z&JG7F3c@QtxI1Korp0IDE`{ zbV)Qz*OOdU;Bgs0y15~5s{0fm_RZ&1M^vUQFyLlQl90y7;}(Re+Cp*1dNpV-JPGV_ zl%X*Zp^8-ococufv^R}_J1lxOJQ<;ain^9u?y4uk)n1>3OC&;*R78ZycpmW+9?y*h zXmS3OIp&!mj+bnRa+LVUXsv_Sa z4a#HNobYI@9I(_A3fCeAAX%tcFouEg-=f00uVBMt@_$nnJv zddO@)ND&sg?xau7gc&dHFNPRO(I>6rj}%}E9xdl=<6UJ%-Cs$TjN z!y>Q_=x364o=&C#`S@)RB6bZ&{QybS%M)cgZ?}#4w`(hCSj4zS@vEQ)N@uC?``}L9 z%~g=ut0rIJbi&pWBz<;RzYEf~!Nv}4D(z($7Iil0uB=a-c-_w$eC3xt>>ic)%rO`* z3AV%hyYZ3-^}#wR+ zr*saFxMoK!*42la2QRyW6ZrHirLQ_4PrBVXPW{iFKOF9to7Es0ZZ@DZpdt+Rly`M1 z*U~VqR}o0q(+{Y3sKN|Sr6aTrEX}g5C8-JE5oV_pl{)QZC@Y#IB9H&xH@MQf^!PKqwHk(TY zc#N7qJ?oRB9{MmJMIR@+*a`E|Rk@8&Hb2bEc)YFCGU~BfA@fB>6kKS?UUMfmPAW5A zDd>AnXC#L9l5ebls(((|-{o3bEMs_L(E8p*cGp|G=ZO17#$c+L9353m#XGfqkZ>CLhpu2P~Q!$ z+f;O@(6zpHgycj)U5GKEY-pOGhG`WVeN3oX>MDPY57mbQ9Q92c@<5jW*?zb;vd^uM zZX7|-0NsGe9ofXme)wd1xgE6M3_vN}OP8oTu8BKBj)F%*>q+3UFBAzU9pn_@MR%Yh zew!QQbH@Qb?To?TPjrbQafXD2nN-h8T{cD?Nz+TSQ;{3oIMsA@rE?op!&InqfZ8~q z+aheKzo}lO4-r8f7^gs>0okea`m@>7qMX=ctIrraR0z)gbARCvR`pMu(3#qg5CAqB zD#PkFCl|=V>s(i5V%Xk*U6PkKqEnJdFR-6o+YnW#F2}L!FUPAu zOajMA%c8eB;eyUEXe7!@oZZj5*xfemNs5uk%j94;cd)DJ2GEn!_H73mU@y#WaYW|v za%m;1`{uHj$~~*W{B!0t?dA-<3#*&%LkC)Wi*jnHZm!D;ar;_v4Rg zjvL#BXR{d6Q$A;;)MBG+N;LQ0%)~!|f*B07snFMiU+1KEjAHhLuA)DmD%c3I&J!erl6(W zsq1W~rPT!<+72@~?1p2>WtuLIg!i0Z@3;Nh$z>%0w~f5sCREIQ z#`rIBYIr9pR^f7!t>oPebLsxoXlK$6nSAELr} zBjT^BtD_X@$;@5DGzpPPtaM_=>j{h1Sj{WZkoV&)m~b1PKV+9as&SimE2eMohrXT; zEH1LqsB!5FyO&w4Owk_`$|&8&E!P&kI$WGqRV^31p6UQ=w4WA9yq(A{#hBLPn#=gK&v=*sy-ft=FrQxzRy}mB`ZWe++}-uCP4STGZ{ufktv!Q6&A_3 zir|c(?*+fUJQjt3XL7Yj#~fie%qgir3^3%;(x%APMmJRaTHeaUrE~}eWmF|56(j>r zs9dqkuLAqV>W{bMp5Q>y$Qh;l&0z~HbYt+rk*AYps8LF|mU81F_l8T6k9)%6TlCg) z*r1A+3-!?r`64EQd18C2L$@q~>?p&pn__DGnwcU;b-8T)+4Xt%z?Gu3ekqPVp{oSO z$;n9^2WK{6kM+}HkLnYJib{(R1^loi(3fq%Z1qFN9~M`VbIKaePn+`=F2Eh-meLO` z8L<3#7-K}Snp1tyM8N2qsXV}rH_1%_iEK1*Qyfi-glohCO@3%%4y9Ex4!Y0-hF)${Gr zo9xuuqFuYNY#EKzWUbCI%oHaj3*z|l$&2KhI#PH)<3U*4&4zj z(7(93f4UT~|8wELr;~4dyZ*pK|LN+Ahy47Pd-b1oAt&x1hKqk%Ahi3Re*VF+{?qg& zga1D`^fUb3Sl;xS@INE}IV6pEw|FfdEdStU{^{*fga|DDd;a6~|LQIOZ(A)%Oah2@ z>m^!05Z&1SX^^e!T;(CbeySs~0ou8B21Csbt*mCQ!#*pn!sX`}=P!mB2}`n_Hd(;iordk~0=O%Kuv0E6Tje@lnOF zgc8r2-k_{x_Q^>|DdyCdGnjD<@sciTul(DsONti*1#uwi*&*GULjxzkMJTYePE_VI zr;#sYkOqv?+t9}~yZ!D<4n!;r_?Z#&htO+?)D%B+2< z`X|ik)GO(!E;Wm~;>>HxSZi_Uogtk>A3DT9Jh~cFn%j*32s(VluR1^B_w?7kiah9;+l=t|@LXx`R`DK13P@pyb%? zGyT9&(H%a<2D1;-h=3NFFQFDGYmrtWE7b&&r7|U+i$JVQ%qeCZqt@qn=&&p*Wm(QO zkp||qZ9Xz)78k(XRqxF0cR(Jc3`8i?pD z$tePNilA&hsGh$PG?=<8z05O#ICL%@4DTqTwjpsd>9-kWcQqTT=^1Xd#AHlr)!VM) zv2)U*c9Scd=gEL*2CQUu1eJ^iaix>fbhL%ACN>TUHQ4A$Y1x}+tXO*lg@~3(CXg{1 zSckBz;@d}OK>PsdydF)n6|T_*h}6dw>Pv*qxB9MB#044}36Z1?r%k)&zz5HA5!a79MxJh-SuBkgkv% z;HfK6Hea8Pd0j%#0y?9Cb~Y(GYT~S5os}~iY@@5xRO3*|A&iF-kH(2F3x-f=gkj1l z?T-xB^4`c<{*F5HDnkt9CfMRI`Ed6}78;_a^lB$O8p(3c1slFSRwKD(G-Kr^;)U<3_lEs$AY%w#l#mvmi%q&^V%xp0;Gcz+YGqX~ftgb%Y)%R4- zJv|d~BWCiye&o)K+}dkB-@9_f9S>&;57|FLcwWxnia%b?*ybghnCUV#@q{^ zYsEdo17tt4ww8-NE)P>Dy?htmyc1t?jAN?R`|}uPHoZ=2&G&KuYuj#Rk(%f~pt;2n z`|ys61wF;XSWQBwue4#sl&$q?4<`^6=EO28G^y(X@3@3vNCk%8qNbl-bEyJQhoVH55e!+M zuUH3=)xC?NRpG;dqd=@klN@y= zlya{2A-KwhmaUO9{jlWs5BZGTZo-D$0)Ew8sAetA4#Kh z^o3VJLqls?Qs|LXh&$&L-wZag(zfICIb$&>_CjE^;g)TSr!Y>`cH|~PU>7QHgTo8 zm^ADS!WT60S+f{IXkNV4qNY2viSu}zXz5pd@$0gAGH_Am2^nnO0gUHVK3S4Zol~%6 zWVSvPnN&p#q$PQnp2( zi}@1I$r#=egPnor3uzHL3b?CLSDGwfe4`FjAr8wgLD5FNX+fQ?beA8uK@y6S$o{$+ z-s5okxGRAo&cev*%X-&qDZmpxj(5Rx1hRO<$RhKTwIiA!71Q%fWY>6Us(5YAFI7i& zX5kx;=48Oi$r-2La|svo&n>jDn1>Jh{W9@#(U0qdl5<|*QID=cv`^}zT1M4H?#R!9 z7NL-(=0{Cb2jfD4_Vx%3adrUq_O%^XQh? zB4~m0vC#ALFH1S=d^qhawg>O9;IqmGhY6$5JqA2}v|pl(Nq>Y6;Mqf6kVj@U|Vz#}ujBzDNiUodjJ5Z(N{XX<$8` zc6Vl0+pA7{xG&P2c+*ubcyM*JrB=QM0uuX!>_m5UY1G@V9C1*;T z&38%_heCFZj>!yHEYcWx&ycMkoZV>#;xN4EazVM+W-rPYTS;(ZpIiEfvv><5`Tr8h zBS*@1AnF_zYo@*52>H(IU1--w7OT)KCm)@|8LPJj_2{%WklBo!Gxs^3oTGwUE+?G7 zPAXfCu0%cZTMQK`GDw7I7^h-ub#i4l7X@Czlt!io;!k$wyvbTYY6i#S>q-20EiB`S z<+~WZbz>qS8Jitwu|Dd$yu@855xEiPDq@Wi1+j7AZPwyXY5F1koG}_?l;2c|b}D`l zT?~=(%R^2JJB@xr@l+tc2TLd#sM8d%V<*ox{4Ep{iijuRN#1Io{VkQ<eKM;Et_FsSF${a*{1)VA_T>na82oQe-;+YP(DpKHIs8yuZSh&s|CE7(8qU z7_I>D+&AHaOYvmfJV6G@#O6nyV58jkz}Pc*M-#Gk_4AOk_AHvwcUp>Hx<};`OX}VA zaef?8``$esm@M$ty%`gT!W{Di(COYd7;2+6BbOFKm7)7F-KfZgE3mqy;8%Fu>ZI%1 zy~YtR4y2_#mti~O&K?@;+9S~JPlCezZHF)?lN8+T^pq;+^R{(W6BMQ&!X67z{Mhxv zm3P@)KTwhPX~?<1OJ!mf;E@mQ&@qk=`G95X zBWFSZnv&9~)FVDDE*R^t=o5Zg2u~(8`7Mc3u&eLt{@&`sx7mevw)6lTO)<}@znXgU z9xNsHc~4oS$VT#Q%5RXz4Dw4P-O)$QN$30Eb;&oWn42WOk4X|&+>gnu+s<(1cQaxP z=(rYLBMd*gwUefq0my`8o=@oA-EB1!l|p)7aI`2};rXSB0avd#a+t>T{>Jrz-LzaN zou;pA#-h{-F}2jsRBxZA^;_dsGq9btHcYDHAp9wDD%x@c!vO0ekrv{Hv}+6rBj8RJ zFHSR$xb4Ii=EO?;XM^S6W`!%S&4+EZ#>crAG{UGdy4{DhD_bgrx}~(|F(}RMCL^_k zkAt`QHil5RF`5-6F1~FxaW~;h`&ne)-|otQazn?&&A4nqU45dOUS+*j+)ivNHDFdx7$}< zoP*BDoVEpK#u0%DuLjc*e^#$JxwS&?bT5OEfA=k)iBAR@Pzh0bz#7SX2!h?j=6>5> z*9FuiMI0O5lF_BiXwr~?{m9%%y>C7%-~rqZTvctvWyMoOJmiL+O?@?z5`dW?H(glu z;4uzukmrxf{Vac13U`o@K~$cKnGnm1K0XHC+dE$l@R*UFt;ZfCx{u;S4Spy)*_4kO zSK20ra3T+S3?6n+(p+Z$5zW;CaQeM_$&c4rPdeJRm2|JDe4X30dE9DoC#5kT0>&cs z<~{iMp7cy&NwVmybf}zu)bk)pqZRHjxj;k-Z_sw6I)(@aYsO=7^uTkGsp!PmBA&3^ z51SY3w_~RaYp{?;SyT~`udgaoJR09z{b3_ms^#si_SLeA2w9K~FG%4K5$P0SGS~`aERw!~6r=aov`)QJSdkmCqFhzW{97`2?q8v3PioPCqeF^ef zBiYZPfiNGPhppe#u(mbda74+t`3jdyFsY36X=>7$_`uXLuFomedD-Kf+8@83Xh$sE z#q97T=|3m_c-0+DAO-B_Pz}Q|K})VzL!(3t44_?L)$>iG;VEJ85R`FNU#Hmhf3L_% zmBX^&WE}zmXLUJPMM}Dg14I(I1SP^cEZ+xFS@}SduoYj-E3h~=3{=Jb!pwXZaryRb z*cS~~n{PcVB4&HzsZGZHgO+;9%o!nHa#%}x5AH|vq3<^*R?(!^RW-cON;T{;8|$)f z@2PyO^^pBI?bzssL$ob8?w5Z$V6l52xFwUV(-6DvqOOh{w`-ZQRz!_QkW{kueT@!I z3Z|~h_g9BBUc#x+M#C1eQVf)?GHDdo&%8Lhwm*x2&~wdG_sMb}mV5aIpqSa*jf42n z%VJ<}7ksyp4^Y$Q@cAc+H8(!h?`R$cjM|&aYM^|JvcgS5JFwg2Xh}&%>@b zQ`fwGcV2W~JNv71sI>E=Gfd(QYKQoyb$YR`-8W}^}I!u_%`qU>ZxZ;VdpOh}QG11aU!wNHbpUziT zm@QN0<}uYOG4HN33?0Q^$FG%3nV!10m7L5k9y6b|&gy`Iq)X_$@rPSI&1AwSxUi#^ z%Xi)4#BT2+8Qcm;l8akx;}Ysq*XdKOHrpDpePRE=A;;;ZA}z-O0|kns8Y@C( zGxgRj{4mvSuCQN>;N053sGikY0rKZ4j~Ycfp%MDi^N93drPF!9F7znRw*A21xZ zLc}|a8zsgDh>wKw^~PiRYM`a#DH4a<~JaOgSaq_^d0WMU_$gKN;Fkg4R8XDIxIGEY9? za-woK`W>>~vz@x}&adq7DlWT`KKH0}KP3ptSM_CLM9-B%Z`{$K(9S7JXI9nQvv&&@ z%B%*>JH+DG3*7ni$wlF`K^oY6+V z*x*KZ?&XE}S6Z#RzdGx!w3BdObKkO>92sjsg4y${Ww2mY<^oVu0^xPD1W8mwN1VM$ z5-R?2v#Z4OhKg6{P4I6QX!IPuM)pFm-z9gu8*9GwWPUXzE!VgcYURtMLrI@c4KMV^wmE1&m?Yv8EP{N>KeYKOgKhR5yG*InO!?{3C) zfzj=+n9vP(G8qrD9hh%Os$rxFIJDvu>;W$(2PuSXG4yb30_C#y&sceE8$kypRU$rw z*F`ICCNSTHN(^&$4EBjv^-yDIZqm$3A56W?a;KR~>te1CR(=qh$0WEG6ssVZ7UF%U z>#55(^zcc9;mqzjZ~mg%&P=IDPDmo>7eJL`{yT~q-|E+O_^TURIxO|5>BB~2yVFqC z_&iRpTc}G-AcrJZSs&9V2!t3%t`2Q`^dRHx!2d*ATi)`Hs#SCI$u?0mzSbunDZc&W zNz!IsUu<3OmQ(L#WfLf3?bBDt$=wZXYj84Bv$`2yI$C_5?*0_NKI6X6zFqw&Pv7cQ zODsg1d^rkiMpdNu(4CrPN@!T}Fr7!3;C?x;uh@R?;L3?AuQiE*xQ32S1$A|y*68DM z0mb}@%eOVvI3!PT7welk{|*Ds{}B*+7EcLybv@<1bQdrhyx>Bbud`OxH?a-1S&7g; zPGFd^U#v+nIjZf@?SuY#@7{=eF&Cjj$0d}Qf%fo3as=Yj%fwQNIfytm`RyXzmWX4Q z`q@&6MK0tOyk5&Yu5E37(^h-E71s>kFlElq;^!lLpF!j_$t+6}>ialLb+VT%*VEXuPp+ENe?% z5>?rjNvBkwl`8ZKJXNsSq`&*}3{hiKesIhVbMcX(24iMarQT%zc8HMIgf#c98i?s) zmsiY}p+T;MOhF_=5mr0QZ7G{gVh`!2llntk3&pv_u(S%^KiYHEDqpuvuTRV>zdz%~ z%`#<$vNA-WxywI+cN>k}@rZ)O9pp{Gp_2HkNAVxC=DT>cWYmIN>7P!`6?_zc2b_yF zR6Nff2IlA|1!~zO12bHIt_4tWJ{fX^5@y}3ATn7}G>ThZ4rbpPuVATFR3#L6D~ido z8sa@dCl2{)60%nve!XVdr&V&~FEWpqMN~c~{it&uKLFX&`cza&u|Q$|Tt_;FaKnZx zzk7y-(d_^`NJA-6lEdqAN1^D?>5lg%YPYRD` z6P08;_MBgfNz_q!A_FI6Jb%!$$`=taXJT|E8Z>=_;OSPjlQpnnAOy{tlh!4OZIO44 zwQ<9cc&#Z|(<-xxN)tBgM6%h#7twhjbF#=5^zPjsh}reNB)i9x@36-B`=<+FY)UorjG9g8yI*@wAwS@NOLry_FLFeYY9qbAxt zfSMWF**7br^v%TbENLZLSJ~q|MGl7%+f{zE`F{7&e9k#J=Wg!{;=O^d2=a^VL-9K2 zX1do~Kh*8|O>QqsQx^hIJui5wE;ai|9Vk z+zg+>04FxTtnSf!()kcNeTJK%)zuBpYCKqp4b1fZs+#{5VRrfhRD58zWIl@lBY zJI~OtST{Zrgd5bG`ixagcr3H5w0ol;d906{(ho<&Yqp$iPF0AhxL>@#SxqDeR$cLh zHSA2U-`)y02~%02|I(!CsW>O^WyLRnzS#lY51pFppOH4XU0u}nlRgMX?%y))Ya0$u z3>+BZQ=j)p7MiJ~etMX9`{Y6GpKPzdZK_UH`53@`Z24sZ7zVY{p7P;-&45F^y900= zX}nC8NAPQ!NtQMW2aU;g+anjx@KYtas*z*v3a8tCA%k&qr?N%Di1H6x-Vyp2{;8yU z`@4jVU)Icps&~fK3B+gE&Bw#^=Y^Ro3+@Hk6O_6mmlf8NJc}{kzU8#O>}P1V(`_1l z@|w^)zK;a0X^qPuwm8k^PeZ^sD?erts1Geo0)*QPKsh%fx$tWtbUfG2bXo z58zO==a&$Qe}I}9a1wZfmVvHpD% zM%TlPDP^siXsK8zF27r${{+=e*sftHqX6x6V<4ey{86fP@dk!Bq|388&(*UnwM8)Q zToCo1=~rx~(Kd>ODX6I}&?vnI4$&-x#HEr)fc)($C*p*&Kyd*J*5{|Et2`_dcUK#< z*4F4z&2bZ4M81`}3|;y&G!@g0{bmXv_3{eO!j6OL*E+f`QJ4=5_)Zl+#sCm_6IfNS znY#01pSSEAe0+-E?+h?|Xu!LU`3viI84C?#6Cts`tR3Ev#_uxxHalNG8 z&hAuM&pFCpShrFx!6p>Yr#gf_P#>Z)_w@T_OrLD=!TL zX2s(V?ny&k73cu`x5oRI?hNGdR28_{u#mv}r)%+c69)jO5FWD)ua36+qo)CvVMs53 z6MIFW_YgbX`z*_uq=`iwH9;dxuQ6{P+6R#n?uuf?Ohse!GHyjh`gSMnP-#aiY5>F% z;ja8_-D9%!`Fnlk%RxZ&BY{2p?1|)Eluvgx+|`zkU&UlQ#N^Xk0HWY!L}q|5NZW5& zZ;ner^H00f92FuMq8(*=wQ_Zk-fbdb$5F`tJK~L*{=XyM9NICE^5hWxuBzJy*TZ{| zhp0#v(@0usS2-P$(m62o&NP}#fghjZm~JQTFNMBM-pwJS3KM5GF9j|_2kwBF_Qe20{5pM6rSP(>3)o^VfEi0+2yC&PT%`6 z5Uy~WMOTkTNQ6q~g^5tdd+{>!EBu5arxz5p^_gk&aZL`qFM|;H^>cvRm2N$yvizVT z`i{&BDxU~z`TBqrwOT)Xn;gF=rf2(Y=(AugF}22#wqzT_k_u@|UW(c3+3wH5OP#@X zgzEidJ-=V8GeerP^zR(i#{^(B+~~-pM?RdA{Uv;ZI9LsO{;t7d_O5oD;Pg7e z>Z79c`XaI|-7GtjLQ*d96eXMr6R3pPY8_?rC>Dac^brIkL>7X7&2}5?3V$>2*6SRR zuWzTQhI*E4Z+l=*t@gJVQ>)f0BBkNROvdQfMVre~&h(ddoY`^1;Gp@E>GUcdGq9< z3mV!k<5G++eNE_yObX##nyvP#!aOahn8t3co@Y~zM;7^>GoJ@a#A}IqFCp1pea#PA zlcF5~@ii-M`9(R`qa2(RD|=jP9*64z7VuA~=#&Uh2*POn@=BvLRnAn8gN1Y6g0c^X zrWCiJ->yuGBpDVNtyc6TR_gO(-OQ@1qo)r~jT z<#?6K+V11f`1*e~gpgEDxA4$i-;GM6rKjK7-u5W~Sb#s@do~IUrnh^1*U&A%|0no8 z!x;HD*4t@BI@`{;2v_s`9UL+ozImgv(wRMNv-Pj?{ZI{h z0qRJ8iip<`M*j5-ev=MUJMQ|#eVt5HW1yfSAV}U75O_6kTQzpJFtJnGO371nRu6ZF z+rIidm7*2aeV%rT{dL^2Dtpx30RI~HIpFd7L5h&kZSAhEF}q*134&?#xOFT$+d4e# z=pkhF=ULpJ#`~-{9ca8g@n8QG=9V>uujH1zj+-hcJ-#KUCv({#y9l=4^Fd4_Y;&fc z(rc$=8Pt!O&g-2U0@<^EBns>!6^zPcho!KZOcLv>jE4#E%O-^hsE?(7MR)m*#~eA& z0ylydp`cly93M>jB4;mE<8_} z#zjnnTeOAI-IQ}=GRR>voEhPUVS8yPAJAsx=y>b)1PG#W=Kjb1a05&-K5S1#lS*DS zIP3z}MzV6hLj1`jHrzY&Y#y1}uy>!^4cLXy?CTvaGwhyM)uCWvI%!3BtO3x+A&Z=E zg3T!+TJH}BpU4Xw|4(V}u1k)IlD#tJ!G}eif028$yE(^%XYvL7C-(+-{lDSfF8?Fq z4gS2LhSUV2iFVZKr$}NZzhlBcZ^vexM^?4*T! znbk?;cquon`&sVY0Jk=&n%rqT=*G8YYi$v9>bw>#s8aAktboTB3kn}?16*|PlKe)h zW>#CB_T0+&zT@S%8Vs-Kc59!=H$z{n;FB%p(&{5Fj5~`gt$x$4NI-4i(s#=FpgLh zq#tU@_Y)wtrl3sSrO3d~r&D2<2v z18`PlIEwP*a@1kWb3LGhd-yZckQLx6bP^glwp{}^nN=FFiM?rRR ziPwIn%7%R)j$ptHLxll)`-FS`l=bU&=_&Mvox#GjX0zL;28|RNRmaw8JLDU+u{*}x z1n~7^PT5(^28spI9DaAWji98K?JLs`MmOdeCS@frZkh_#U))C$xa$#>K`^!L8bDtS zyz%pWKORp$GM&;iXI=XqUBk9y>ogchTnI*txAu^f4o8S51>;$X;25f)jA8P^sz~gdw)EkD8HckkG?mG=e zJ-?F|ISmsvUQY_!->uM6Y5!TRqv!HLurVjLSo8M3>TGbUPj^X&Tnjp@k;9d`m_wT& z7$inL>S$L^Y)v}If)q}{_RftlmV|-}%_w#BHUw40=)1<9EbjG3|*wgOZ3uRay z+Id8x%Jr7JNfz9&nv72A+Nh$Jb+pw~)^Dq7=w$1G z?uB5DEZ7z>5D@f{$`fBs2cREpVgjFK(nEY*a6@J=aiB|2$5>{6D&K)0+gI0TS_UOy zzLlZ0izXmtZtt3g+LFDxYhhWMbT!2b+b?hBpp8K7XGmdGsSI5teNcMOPEVoqvc0m{ zf3JP1YRtjy9OVJt>3ckg4gl$Kt@alPgVWjWz%h^VtPa2=9p5AS@`|*%!b@urZTHPP zofOCc!rOwo=)Ou!IsFgm&8l&>f-5YlLGuo#-_~&~syRaF^{&J``&D}Il`LMgJexfhnafBS4uuW(<$S^_>Y5U`DCxYL z)ZPorpvGwt%^v!jcEZUP)1Qoq5`CfJN!7B^5u}#Zwi}50SLPe`mQ!Ji>c&nQh-5E%%9*R`sN~_SNu4 z6S62aGSEz(wqp$ojOFnWzc8(URwyWH@=mHVfeZMCfA_}CtDWFuDLiyVfRy(%2u)E3 zHOopaQ?9=$SD$+v_Dll0ams1>KixPYXz()|K_R8GXy-YTT1C@NyDF)*w-_fEfrZD6 zxfCMyiv3W>uG7F>TO`ehl2l&!%RewgkH z&N^K688|(048PH&vtYXn&-m9&B9*P_e9bZ*4q9$1WqRLa>Ev$;V?j5p)T z+1a^*{yG67xYhT6*XAb<^b+@%cbW&^j8PFHUi&QVriDghS&;7-t4*IDrj2nU`a=ZC zAa38QBt?ysBZgO~$BG-dE845)JfX>rj4Wo%Jp-(*W-u~)i6+M)7@P!Lb2KR!pc)60 zZoh|y?W7}hu?++jTBx%zNuE(yi;31cO+BzjY3c-7+Bpo9cET8(m_o}z6Bg6Q3^B4* z7wc!e{o#@>E>#}^Lpo4qJX8Zu2zix}g!z$N2v@T|;y6F*O*E$Pp=(Zj<)}%l^Vr9A zact##x=BQ$3efc#A%vSgpBLo%hpQ1$%Y;g{o)Zu_SV3h(?9(}3jlt3AaevR*Tc;;_ zUx7S?wizBa`xyEJfcUCya~Xp>`wn7}2Y5(FC?Y z_p0%G!Ne6|FTip4^fW!G42SNC>%H(S<>n@otN5uk81Y?c`l3kmYtrNYb6hTwy(V8T z{_deP+&l4pAH1Ap5)7WLZBS{IOstN;0Z%3di3rakNqJ>4b zh7U%>BafBaYJi{mV9p_c;?oqlo#E%H4J(=1c=ngDJrZRGaM7wXUUQc)kw!B>y^;0;*lQ@5Jaj$gMeHK$SLN#+|MiW zWV>86A9~S4wZQ@^?|sp~v92Mqns_}`zcZu#Sem9{sS9a0OnD=SFC(z|{;%=j9k^5*s!DLS(U# z?Z|9DPSdH>p*eB}5RggYC{mlQZwc2|Z)MS2s(7SOT-mg5d;wlZ*{*$OARwF^PnDD0 zKlFOy2SBdwx{|T6*dS}OxnNZa5>oi0zYzkb^0tm4I9UgFyZ=hScefF^STp(mVyHpn zvHrh`#{Yt&{{^ppi+hwJoZB4nm-n7L@~g{d>1-KzvHtP;RSW|o`DTaIW&?f=hNu)L##~Y{hM{>P@CRV%1FZKGz}A}BjUc-k?*`ONxYe}WYw%=W4bh;DWacb z{qO-{dG5IEAt9Lr&PCq_eROxe?>?v0^5F}ZgMH!wej_Ca3BUo5fu=mSdM-cy{5W(p z#-Nh&#vaoIsaVeAuy>K-Z2*H41;vvSQ*GJtP(|8d3u5w9e2mL=@#jioR8(74mT|CD z0mVW0)#|q&o#L#s4%(iClfz0#=ZLpgB{36zoiu;PjXzD2Z*^~@@Mr)?IUad<-uc8! zF_S-@b!Be*hiBG4?DtLpwr3)Xt~-D-|0i3KsKC_{KX;RQyVZ%d7OQqe6o4ZU3cYQj z%)8*iW-4pN3%V+MhxW85_!!?CC7{sIfdqTc}8=})hL*{jN)SUSvoV}#}2ECQtss< zTUnSw*W!dmj3^4Eh{h?T!Fxsim&BWlyo^yAw$1+Ym$7p;602RJa(cxA2gQ7+t@FmA zv}pnQf1>Q%U`aFKEkcPJxq|Xv3KO#m5i!kI4RS6^MsqLrpDa}&Xkb;9I9t%mo7Z5W z3jraer*^|(^yMA6ToK{DARKr>^85WsED>AzD9u9;t`)`NIDiAk)u0+;Epo(<6C@c8O8fp!t)?((5EkTC0eJ7 z1?nJ4aqI-MURaB@rX+BsA_in6WVd-wa3Ip3VJ>2aXg`F{c4|?e2vFT}Nxp#d6qnH& zGi0&&bzj}VF1PVcZ7%S3Alo+Pzt33=XZq{#6rjcdS*pG6?r`l#BFk>A;l2LF5n6{x+p{e-U$mi&gP@{kp&(zyn;0fVvgX*E5N^ESc&j-p8>~ zcbl8bZ?{iu)Kp7FphYyDNV*uOye}XA77MWu{C^g#yJ``5hW4adBRnb(!7@f9xkX1^ zwo??c`!4t|mBXmTeKWX66vsoop!y!Q5>7pzA)b|a`bP48bX%>N{a30EDRqmXY_5>x z7C3!tLe6lY$X~Q;A~-89`Wl)zmVV&D!~NDb=jz3Mv^gQ-{aQR(5fk=cA9PyH?qv9j z@`+ONThQ-9lzS?wo!?}>h@+FUq2=|KH%+tANdQO&vR1L9!jG1QA2iac8b9=;bI`{x z`W#{R6<_Y3A$FQzh~1#jgFZR&nOK{{LMAp}@()IeqmBR{*b<6GsL4(1wCdf(>s{IK zRhvUPV=2U?1c^+GY#Mt`7?fiu<&qNtMEPK6Q4L61KX~vBh2yvPdUw&3Edbek>>mnV zye9}A8Ul`6X%dQgN<*bFJcoQC8ZLxHYp%mgREIIF>;2%7T|v|W!(#hIEZ8W-PzrZB z`wmAKU5A-w?OewoYvDXKbXu}SQ&4>k%FG&SGeP;VPV9;Th9#f#Wgk(MrUNiFxWX+< zgFlbr3d!H72OVA6%b#Y1Oh$#7`S13qf;>maTFjAi zO%YFKOJ5UH$&*rJo`ixQ>opjWUSSl1owV#gI3I%5K#xOyJb$Vi)C8Z>dg!<=^H6au zoTx|=SUob5Hy^n_YFel8*sX)3(2JAc#{0{K*S`&lIt_2A9awUvt66l=Tmi(n_RS(# z5Snd=a(^1!GaFa8QS!jNK$u`~*;7dWV=cgs-D)s_S*pn2P_6eXkS#iTF?}Zh5#AaW zC~Wrm+@qQ&ZJ!&3ZQ5+}e!4jx%Fy_B*rsw+4f=Ud9`LPe8*(2~x&LDr2k{+k3fTMQ0Oe->ve6K7z5A&XB?NtAV{`|}4x`(IX`=`zo%fV>G^h2U>lhQCuKCS&y&D8k_lT<~nVAOW@?@Sa@ zS;t>h0aw`5t6ZR&VY^;jPm2sr)D)@KmoI_BcNdO*Wg01H~ z>D|kA${Gk|b?Zu0p|?t(f#+cB-UEwsCcG!pOV**(rhQYU(qPq?uG0c7ltJfjFW{(B z=7lb`qzVAZ1lNnZ<12{7orhfMyQ7$*1c;VVpqNv;7u{=|)O4f{Fx+#OJPm&;+Z6`g zo+;+2e{*bN4Xx4g%rOJ_8Z1!4hajeWlU5cFEq}Q_1K0|dCoHzhFZdzoO4#3oe9=1^ z0sNc=ior+~oisf21ki(yq$17wi>%oA1R8!TfG`qM-6)(7=yiZ&!UQPr0rz4gK`t^O ztFCPxQJTl*@&|dsWZZ1i*^Fm}p&YXk(0I375QE{J+rUM|u#ca%5C~fdI zXzzM>h(np2|KuD}vUjvCuXkqjWWHJA)080TJ1o69^^jvu9Rlx*I zX?a^oPE`&@4(JkaeIJO&X+OjCCyDcV@^meZs8#E!RqNGB#tGZ3^Sr1fOd1(dO?pG| z;=5nE*mE)-%t&HUYa{v0hXSvxHJ#J{Ze=LkkWY_xks@XY$^kr*@%S}L3$cL-k;nU7 znC{;#xT}_csu4G=STPiryP1R!zn@^l`||WDDK?$P5QnSU^qVj18(x;nnW6cTK~}C3 zWw=(<$9aoc+KR21?K2KbDtG#9n}JQ}iG9Q)&F;b4lZzQN7Ih_tAt+rM!qKE2|KxD2 zZ?2`v>|smE&INI8bJr}3oqG;$>J*|{ zN2*4hP$PrMixuzyldq@f3Mfu{E%}c~Nz#r1WsrRGXjB)>63`uPwDo%mS@}1x#-Ter z+D6RO+mn?i8SakOxY2=XhmKAmRLY2_s{aYY7c*)K0lK};LGa$L&MG|ThWahb9%j{V ztYje9cMD~chAe>NN|wN&`^>jI4O7N-HzDxU2h@>CQ&<9+&fiOUjJ9Z_ zw}ABJ0HM0V{hLsuntbh|KZb=YT%@2RrYqT#m7NmN08O%F=+=;L(fv9uO)d3V(l4eh z4Svme?=gp;r!y4+?kCrS+D#)HE5tT>e0_lY-SoX9^ZA5w(9g@ctJVoVKEoWE&lsH;iz0; zt~tMX&x2ss-v`%gMT2xe zlF01!Kej`a+TY*nqG27}MomD=;yy1a9Rq&dyU!5irloB9-ml6N#)HkvuJ+zFXz2m$ z%30*_;A{iF%bkFG5zCK&b&Q&g1=U`NzlMcEf2+CH`;pAWS|rY&PU$Z!7aBEX+Hewh zAJ^Hx11VRPkFYsWgPf;sxac1B`+eR7m<@ZkXG^q(tig5C2$|8QUWq-Eshyg`Zq+fw zZ%9w2n1d43_g67}3$MEA8!#S07H{P;{~D+mGvL(kef$yO$Fl+)B3-B&gITFRWckkKPVER$SekpsJxAh z=dMkA+ZP!S`G*;T1R-}!v+9U0w0v>ka@6D|v?+C!Op%Dp;E&#Yk|lzht}lB%WTVYm zi(;k3QA}q@HrwaE02hjF0N`Aiv-V0;Z>qT&C%AXoml$22gAWE^?@nbHaU5U|)tbe> z4-#-Wz1^2tnSM8fT`-#qZcJZxBNgAcD&Od3p=Fjuk@oD}ZnQREtuvHUwl-nP~TTgv$C*fx0I8PXZtdf1D3f4Lw#he9MEF^s!9X*Edo6fJ*w^+6< zIH}1*ZNKQpBq>$!5-~I@8bf8gJ8Hq!+CIwF5{p$ zgQWHk7w9yXsBuUHxKDG_CVwXE(BG)GAOW^GAXunsA;gDLzh>;nLkL7)qpnp=ii#PzF7+D_<(F*YI16ul@`}izFs-Fg z5A%>+6b-j&Xi2~xcmw|^R*R@P33TzXD?VSmvBMo_$*eA(+KKZFxxw)ex=}EMcBo~# z7X3)hzbvCnY{XyC5ME$5Chk-HF9q+rp(BV(H%!09=`me<#;1IPsi@xYgE}e7CeIyU zbvx3e^zqD6GqstABiR*|0^6M-vZIv-ughgRE$*hY2$klB};o|pNK z-!Zt&4Sw^h0$jC`tUG4=rk$khQlxM!JxLCysA&Xd>~E8A+N*P6s-&QQDjpBEH-j0< zft$i`i1VmQ!TRN=rdaLb@~H6O9=lT~E^0GTBH|BPMmglG{T&JS!b@g<{#QfXqIUR( zSa!i`xd%6FBKB?Y+h$~2*VXd1^S0aBpdpv@wN9@=9SK8-{*vKEtO0O zcE{^|3^NGuDQ+d?tMO-~_zCs=O~oUcv(1LP5TVvG#iQrVd*$-^?C_aXmhfA^Uyks1 zz|kg~DwBGbw`$U<3P`fg>-pa;Djv`lZb1RhxYp+a+ucCq3Nf0e z7x^Hm7^Yhi?K|bCDXl7Shf0(IHB~vAy_cUp}dt-ylCnAdjC+G$SD&jjFH}m zbAqNTjiq#Ttb(lP1J!pU=*P|G%LUXK@1y+m{m2$9HHfpg1V3z=jJ6(}?|Ryj2}5!t z<=y)~E(vyot~7ZzY*6gdI$E50<^)FQi-Q8xXL385+x}nHwDo;qEn5dx0&&uBCVZml z0_SB%z;=X4$_m;@NHupAlzUQtl-UwiO(-am&58G$^Bo9;_Qxzd7g3+yiDOj_Rl}0i4m){R7VR1bt9uEpOZ0+3pw21 zu-tcjRLofEnBPgn5oB|tv{jN71g+1gmg*js+)?NCs{JCPFLog3`Q-iXqNEZSEv;BR zIm`eS#$cJxs^#Q1rx2e@cK$PHon(P~Q?kVB`#RD*OHkc>*95Nw{BLE>HKo_}H9h5< zC;BAAeVG1{nE>Kd89G{9Z~EzvtGT8z6Dy5AY8L6W#EL-a`vMK_?hp?BN#nUjVv*jW zFr4Sq>zr0&V0Zg9a@H6(xjZI}D5SF^SqOS($!)n4AHZey0kauBK8#2G9ebH=*bpjQ z6e@q@*X*W7Ow~svSG8Vd8gOcak#b?lB6+(f`q8{tw~D_h#nwx`!HZk9drvSwPWgO_ zY|s*ZyJD_=Uk=BtxOI!iIgTTP=wFrIorV99-p2{sAJp-|NA-6@NM(V+=gjf3>C>5fid2bpD6%NEeWn|{tBxAegBNbnGZGRX1fH;vfM@3nq8~|X zpuL(z-~re_)m7KoVgAQjK;@TQ;e#ZO5jaZ*YU#0Jc2s;#8%18&Vk;kNuN58tZQ?tgqk`8fQwu3kTo8FgQe)>};@5Vs5Wrz7!&kcJl>y4sr z+OrW;$>L=#`C44qaGz;f#2}u0(|WpkJLyRH#s8?n%k@y%ddyk%S5~cxTl?;>vkQYl z$W^zaDINF{u*X{IqAJ|z7ZRG6_l$fTz0vu6ish7S+ws`8M@e50%w^ z0h`l-^VhHIof?jEsDPRFPm{}?RhF_5B#I`>{7oO6qG(e?zEv`#32wF(kC5#+-lCMK z)T~12NigH}juN)TfQaL>@A3~=)$4;PvjPx{8C#R?!#7>&&-O~47~X4Nn*M>c51J6} zKx7waovP-jyQrkFOiwr31g%8Bf9FW+Cz&;u^0}a%Td9{+Fk5!q zqiSQR0fgO#ll4)e7|f4mbpH6lc6P|YfcHHK3eNd6t|{=5`|c4-LUDKJk2?3s3x12| z4m0ZzQ_fL0K6df1U#OM}hjisNxm4+qWid&Tz5+1DnHC!tK%VK(6dv>JLx?Rl&$jHqmACr5j589W6p)#hk4Lh&9Blr_1 znYa=LI1oCBFGT+03GvxWoh6(5&yQuZPocli@VyQk`j4yP1B3vGu!nRZEg*Aj-J5!VpuRP z6g`yCL2_80mE?cd;+|BIg#j5vd!5`h(A9}Cg~)??r?Ff&V_VHcWjBy9rhbTwf51HQhy4J5Om_KN4YX zvEzjQf&v+);PH!B3kMs)AF=H$&-Jh#(4$SRb!7zUVD(}+^NHRA)Bzc99t@83=imsT z4|#ZjSHi&m(3ge!e@1q{APA8p{Fn6hf%tK+^w?Ke4V0fuqfP1YKK?vfdHr{TP{1Vq z_1+Tz#uLERAe{cf^Klq|d+v2`c=_;#+AEpwE=?n`Vf_39P27zTu|NSX^tPsFd^avd zOJWZQv0Z7~>$U_vF)!@V)K>r3*mlb^1cYNc+aA-Al9PV%u?W^iOe>*en%U%Lr0T~~ z{Y>I6R5{K$GN3=!KLR;-?L_2Ac&)mu#ExB=5Zw+RB}(k##T`Bs8yo3)lA)0OoBMZs zekZ5H7s(8dm(2rrr2I%mt$cok4<_<15sU9rHc`B(M_B3eW z&ujFkL=vWspx(5)biK|6^TJcVt%5TzgNTsq%&Kfd*5y|l>}nk}Hbr6Joe{C0$Mquk ztz9JIjNDjLw+6e{z8DFshF0hLa!^!x#y=H<*dK&vTdmzPi*Nh2@B)Wg>0UB`H9ibM z+*QGJ)&b*fkBM^u;Y9T^kTv%!5H1|Aza`gE6xL2+oj=m>$bWz#r{v@{{WRU^;*{vE z>!O4DHnc=SQ^0XsKfi_?%iS-TUFT20v4M5i z5%66!wYXuN8_wYk&S?!3K|PX;`D+tZ#2PZuZYN?Ix7^iEoUD&8&d{tv8M(t*w=RWH za!?Ut63L_G4^XE$wMaVJ!1{DThCrlzOc+PAVNW$j0eUI~xy61YL%*9(rc&#%7Ku3~ z@NhvvwEPQ9yr#1AF2Ahws74WI&S_x z7E*RC%RaU8;4(-)7aTG7a#}Bz7B`1>SO1QR(M6~)QhLfL9$Vy79j;hy&K-|B2X@$j z^UErWiq(V4PWfgJyxyaLZnAUsAA#(b;{9XXhA}gF%C+2DfDr$L{uf}v;pvJ@FZS*- zDz7bF^gJO6PH=Y!?(PsExVyW%y9EgD?oM!bC%C)2yTglHzuEijs$F&Jo>Nub_l!Hb z`x67cFvc3MtTpF<{vH>{&XW!J%%wR>5gly0^<`TO{}aL|XG+fMSs7}hoc{0|QicRh ziuz2z`cr=$wlH3Lk0H?%9|w1qPW1cG$1Q=|qT6@*he*AJy03xN-0&;`7afhT3rGcu@wbK-YMrVg6v9LPFc zgl83xl|rzdz^P69R1PyEs2o=Ar|D(cW28aEvh4nc3!opim=016zFqxBw|Z?rZXsu->s1+cC`JN z_;~>x`}uXQBPzpXv|BqaHF#&&+8Q@YPfeH@s6?~#3l+^gGg}CPyu=b{psLLEA*Wz{ zyGsc>(QS>rw?nLA(=92i$n&0&a`~I8OJgi}4!&g*u@|g?V z=UE}eU8m=8vXj{NqUWNAWI6*x_hol6L)Z4(B{09lC;Ny&VcaAbwqv_bqh#xA%_kFM zKMsZ_8+dj1-+0VO{2teuc_+Nr=f|IMU;2OIUui$wf1IZ;VDa2bMnk%*E;yFV@OB+d zaUH+`jP54ioW!lLMV!vRkH)p0N1eIZ;+)IM&g+Mj%}*{5#;I zb+@1b7QVmw={=6(ue`bP_q;igT+NZD9zSz{>Utf9cBiw4{0v;miO14-zNi?Qdm1e@ z0C6N3xx?WcFen7;hWyyhW`DF&=iR)Zhk5Ofrn1MYr>pPMegSHa>4tg%tdIGQH$#M0 zAfn%;auzRZTH;(SEhXP9d}jFiA^T}5|9yPHnNAUnnWTw&Z#yc^+`Lc#$ESG~$$a6Q zU(mIEp)Ue>&h(=o2Wr`yM7H#o4=!Vmx}li~j_i`^Bv`Y93E@L1Ep121|x#w}!( zcSDX{XK>xs=Jjs5qUP_{Ls24b>3X6cgO znrB>2pQ^xapwxX#QQVPDgHbOu2d5e_TuNJVlvm*uxU~_CTM%r^h#3~#n9Qt<%XIqP z^~pl88^jU1HV#kea!zQHFlZ1YRC?a^T^c_#j6LIY;SgK{I`9Vglf{lod)J_NouCxI zm)OV6DTi{xrp8_);sky8GAj)YRkxl#UjMIe)Jf_!f>Iu5h4|?TcVT2WpZwhPsEKag zPWM7ATg3;YBBFScqZ%0}hVyOm66hJ?^a$ahM3W#H{6mn76rwMMr~?Y&#Ed`5-$pa1 zeWN~l<@Qv&mX<9RJm@r%pxT}A_D2iy(tRbbE}@}F2+WJ)`6yRKrZrL$J!sm{^UKAy zKFhz3alzg*wSo>#R&bQa#!;lBpzB{Cnk%f$)QkC|+g<90aX}heA1~J~BAF%{hv&IQouHk8>gs12@KxsVfRnNoiaH``v z_r64o2VqdGwL~Ik?fJDfB)F>Mgcc`9@{ld!VyBxmMJHzm6X*3^op^MshU!m44;8-P z6_HCt?5T2>Jl{|0*+J~eYQRl&k)lagxcj}NC8BPvVKf6<>4tBCEv5>066-2e_Wk8) zxyGDs0d6TM>{m69SxE=|Ze@oo~W14!deXJfISe zm(OpL%!Q&_b?APxd!@NtnKP1x7axx$jytEUwlaj9ki@G&{U)#EZIt{Q0h02;9`6 zRnCsdBPpAMxujWj8Is$zpx*6|a=K!HXDb+u{m-3_Ysgj>1%Ips0AK1_%=Sca@$jMrn4dQLc8!Q0GUc{xogrB7(IJ^1nv@;H>OZAIv&75PLk9<){&c#Whzj-sKj@`Y zR8*e0RtkR?ji1}I4!&q&=V0%affh|SE1aLy#GG{-Jm{uKx!x@3naM?Cw}z5RtQJ7} z-oMw<0kN+CkU0O8{Yif75JPu6R?9x+;G#L!v;Q>g(A7GyFtQrL&@g!mX;ICqZ?+FY z%Qp_YO(P@0X2RfGSEOEmjx+8O?f8ltd`a_y+2=)sU5=;a)Zs%@y-)+A!+zWUh@wBb zJH@RtXE*{(q9a=IV+Nu5`RY}P#KWHT+ic^@>ZnJ8A#JxhB?+BXv{DeYzobhA6utHv z3)wp%Og2idkR*2OtV+abU*-E|kg!m%^E{s9Rn^(xy_V5c(Cd^rpK`@AQzo?d(KW0%UZC^i$a88YLuQOa2Dh z&IC)&8_pBl_6?#^z+&)!$kLQr6LC!G=Gw~t?k63EE6Lbr^2tJ0xaE+HAXh0EI!S+KXJ(b^B-&G(n$K&(Y!4^ZY=QWtWmeE1}aA(oso_R5%vfb)Cgvlb7oI^!T z^_anzv!?$Iwv9_ak`za%ps6IEe0|CHeSIK$%9HbZES=i{X^pY;!~V*=wswv9!+gi9 zVcSK8?DPG0B%n+C)sBXMkL#A+>-qH@4~N6fbi>=LR?Op!*NA%g^D5wKJOiCKDWh2P zYQIJd*Xg!Gc;xk~0273TY=it?_3hxmR1#DdmIDsK9BbehCQS^N1q}ZJvYD9-OUm_e zb>77agkeCe{C9HY4N;Jz9$YFU9ay(Pefs0X+Y3`$BqUtPcybEQbM zZ^(hTDO%_ZuEnIN@Rh-Ah{L9!*ec!G1onp+3we6j>MSAS9z4-am5+eBZZ_0DmlYA! z&K1ml!%EynJ{)@dE8pUN8vbHKkMNQvY9T@DA4G0jZggnfE>xlMWQ6QE@yJ@0;X!<= zA5Wl^f<99!3eI}&skH9Bgo*Jbc&79q%ZCGpiHWk}+Rmr}gIm&=Vv639itvg~Rj>r7FK4#b}IJf8)oykzzXJl?s^v7j&F!ru5cmNqL zJtq*544hgq)r765MB?h5o7O?RLnzRGd61c4?l&i&Zkv{xLmE!IO#uml%Thj3_7!@E zC{oz}L~(m@*z+AQJO^gTpnGL^U4HzKGVrHFnjfAP#Klc#-FpXuU(|FCMY2H{VaLmmS?2lTJM|DWuN z|JzsV=XBSL?yBZ{Hzt@zg7jBeXHbyXKZEFzXm$J~6jpqZcsGM-r;9gckNuvO(wV6o z{(R15%EphEyFQxBaJAW@{aJ^K>&~_O|4|Q96HX@F&-h8cK!9L_{=(a((f`oCf4idJ zE*U5_Vy;NMQR`M}rAe%DZ75Uoc{p=lDW@w0&3}-aqvZ_d|FCd&y-t@M3_yLLaXmhP zZ35>hWLHb8t1X~YpY#Ly`3`u@fQBZo|MgE5c7>`5^M63wkj9Jkj1}eT*71Vgn#qZn zku?@e_4d*~Zh)V;AzPzRmjhqqO^?VrT^iM8Yh&XK)PYo%qH&GY$jM_y&2BZ$&P1-b zp?F8J$A11*{v@T%W{vY_%36qUURr;(XkxK4c_Qb=*+LnG^dr04;$wyQoFU*{m#Y4v zmqFI4gyd{;ge+(Couj?x&7e?ts2cvV39iumM$-`2xiowF-t+(8jbGjO5$x#tcbLTNOb6lptc9!n}01CS$o1@CGQ9s=WDJwqTIoV zXM`gLlM8&TuA~0UluUJ#Nj*~dENA^?lf`gy7R_jm@y7%B2d_sgF;^)oO;KCy{#vK7 zla%I>uuz}nY4IB2_@R_&pXu{`g<3s%u63*McJb(R^$MW?)zE1Dw0-8O0H9Fj0rOhY0sag8YR#C=D_86P`vVGvLE3`I60GC9l+!g)< z-tJk-cNHK<$r{|1641IO9mzYP$j*E{Uh-|_GPLyxI(^n;*<46(EYEHg>)?6&f}Pm; zRhnP{#63)2rt3yHR={1|T%>ZO`}B0t_K;uIuBw9pWl)efe6GaFx`>5V_%kKzrLvvj zU{T>`Sd=p*m77_VK|+7iMQu5?pRXq3n;)-;P@ zfVU4S2%7n~Vm{c@#0~fh%XOtEYE0YV22X2RY(RJ%@W+)ZM7T}s>gIeAq*ap&EPv;5 zRy4O9`|0QCJrUM6aK3NZ7Yld8?jOXSDoZ*A@`4Ka6f&5O-nuB7jh(aI3-uvnmCw4! z%pZzA#wb_}I;#?VdvAj?Hx@7G=~#Q)m#*8Ut)O%Z=2x9n>iWeyk$fRJwt9%{UEz2f zGOk%C6sP_zqNv)H8}7?NH(0M-Q+3&!aKQRiPaeAxXJ0;#Yg3Nn&z~2tNTTvR(4~0V z&9P0(Z|%h-lp$;4(zE5Y=2)NFu)1?1e?%F+>YLAw=@=Yv%gV?}o_@9y&RHMKd38BL z+@34kQeTZ>kcHjqL5mAY=Me(FT`(A-1RF7+r{m>5nI4g|L904avIH*T7mRUyCeTEk zQIdIvEP~gvc*Uh3pPt1yTt;zyI&OJ_4a2zBS|oNiPj0xhF{^rL|9MAy6Ia5#_I0O^ zAQCisb~&y0s+#(WDS#9-1KA-3iwr+a@DVskcOlv-Q`gh+DtCRW;bRK&myM*aL4f<} z!@az`{^o#)WxX{E12$!Ev-%wwemYl+%Nzr1tq@*UCvz8=P@LEn-Uvb75t%Q5{KBKK z`cI!>y3GdtkIXzRCank}*HYQ+-@yD1DXXuCc0cMa570W=KaHec*!s;8|^zf_~*Go4c$uZ{| z`^ki&?Xa=SbmslaM56H>lULxbiMh7qe^+g@ z5ajd)Zih_h3-Oi;zoVrAxKYf84;JLMQQI8uor~NN;UgA736g0JT35@_NVGYN-}wuG7(t9Sf^pyCQ6&4U29bzN!x{8)Gh!ZJ zw1^0Y_kV$8XW;&4Bpc-{A2ayZESy@H88SIr!taIBhR!s|{IMWMv>|9AW=AXm{gN1i zkHJ5k^T!*Yc5P&BG5Ylz4`1TCoXZ1F2iR*@p|O@@rXyGcMLyz+R8R~)PeiF)@Bu7x z91LFDzd!J)F-;rDc)a;ilr<}=VZ_2 z5j4_LS4rSvoq?vrIp5n=*h7mm6c6}gEr4{)Sq{Pu>2jA)uMocJ1p4@Q>6PcU0eXW) zTl;*ECMgt+sm;s^q+gA&U+F>4AGp&kl@Lh`fgKydcv!V9hDEBN*Dm_EUbXsstSIku zd+SV}D)pvnnJ%3~WUuuS&z)+FxZzHzxEC~U_DNsi>e)%-^_5WQ-PbPzTbo0aYPAdN zWhVpm3Siyb@^ePNfZMb6yyEf9H>wotHu+?)*M>&hh_BDZYfZ{`x9>~~9kq-T z7wnj;GKd!_B!eM!!s1OFSIOO%@K`*Y?=KRa18=6aSn^Xx3s8q6V?p7itw$d^k#J27Lh|rS+nlTj&+rbFS3PcPeYBx$3vyXn>C_BZ)UY= z;gC0th+TExlRzBh96(}d{b$Y@DkjH%8kOWA>ViF}e^t589z8^@`^dTh-M74Akk&sg z*ZQMq?E=iRoQn-&6YDecm67C1&DJ&xy+rERS5R5(S>5Z$-6{V^>wQa@f-@=_-Y~`T zrf~J8iHFC8pR83Oe7H?%Njp8X_34im_#B_odF{DJ;?B@wTQ5T`cL7=zOxW}NdwsF< z*m@sCdc?n?Ey;D2eP_%>@qL)puFnYQ0S!Jt%AThC+oT4990iYA$&-R8r)?T9Ab zKqK071a>HSFI3RSY{?UZ`yR$3QSYtqsPygLK^F=Eh8CSEQ6g& z3|{&vkJ|PQ5kLl*ZF|ZlkxPJ-TSa;o9b+2FHR~ixoSr~6m6sY{9XTAN_$sNn^kiZO z;-e4KUP0UB{@|{xeqX9X{E~9mPFes-c{oXT&wZtCVThj&9EfdPM4B&|5Ydq_OD&mG z+NlW9w<7A1at3Kw&BeK7@EBlKMU9*Ez7&YgZg67j>SBFUz!)^|3$Pne`@JUs1MjQyC7{9pxuDlY`Q zgGtx-+_MX*2moWTDITGS5zL5*8RLB~gamK=(0)1q8N;hfQkyiz1vW=~rh31FZc7rr zP!?be z#{!;B^wff+QJ;j?{UopR%;1%VsSQouE6qZwwV2n!v zVRXnz36xNRnCGMGMw20J6C$1e1Xy?79RaK5r_pM$r0zYF3-Q4$=W|V=&3`gmHc8d4 z;8aot_mEGQwULZcR6;%~>yV@N?tra2m?oMV9!C|so4-&6&aNFg8h^@hxlSjEsJD+9 zcDOP*=420aawUk#NbQe1563b52Hc7+7UMk|r6!AI5Yb;yeH^qiL#LV@alm@J?|gg^ zS+}oheJ$2ahG(~O&!e0@>Xg6DJH3z9p0SF=+pUl?hWAsT~3z8xhngUOsY&X=<7X;KaqiY$T{ zSzH#_hp(HbMnWN_WK~V=gz!MvQB-f1d0W7OX;~wNg<)L|OLdHmpqgx)5`q%#gh_}% zB%y9L0;?zvmLaootKnO!g_S^o5`$FK*@ZgEJRyvR!1~jr&$A7C3@mZif}R`FvI6JI z*uJj6GK28-u0@omNF~^uWOJb~T{fz`J(E%SDe-D z8SUdz-n19OQF+Oumt{)fn4JL)Rz;PW&zi38Yri_DtV^Yu<7Fp9QBtm_{H&e|^-PJv z(e4)f^S2`s7W*O~X}I4dsIe0;9g7fK0Z(8jak^~h994r0s4Rxx*$S(jZw?UHdOu>? z`ZG~>w80Dj0SfNLyh9n)h;O*4kNyV1_2IXQ+3Y`u%6+N16;kEsTA8$)FS*!~sK8Kp zZ)^302(E8oZzO7Ce&lkkfMsg?+ZkTaAoe!R?Ef?D^t{UQgrEExJ3K=`&ewlknjXb5 z$8xh7s(!nfx+ktK8k=}vw2TK(;_$R0<8U%v=<*ZV zMm$@Ztu0%jsdHqrcLVMcoM^|(Axo(ay!aAV>!1aHDsO@J)`ZnpWc}{ux&`P_u04_(;Z3tpa@y(n6X8zyD5H9mO=dz|}V zitac`q|K=10K6~xw%qXznw7d11C69g;cnDy}7I4NaPYoWtc zF%HLW<0-*Pd~<`wkN~wK+Vj4ZT|te(Q8QXHVyPxI6)v`cc!Wyv4xy}MsM?8l+Wjh- z5L^+N!i6b0c;bh^*5PvUg|1J8ECi`kZayTR;= z;Kq6Bl>_HO0jXkl8CprLa9^8A!QsGSZ@zftTSsv5#!i(s4XZ`^js0C&Gw5 zf~PS3Vx_|}bs8M^uq2?YZ7riRe6QA4`J^wx0pg-sp_Y`w-ISuKd+_S%1c`w zb5F|{C(!LW&o}I69*aOgOlrPdja95AomYeK8dm|_`rj?C4oV@_-%MnWLclsH#2f4| z+;%+O1N$cM0xG9A6v&sLgb<|CuTVMWN#5T}r635di^&{ry)aU+UV<82nwwRT5P2|A zou@bAei}=!*_fPtks|FSK>hX`q)#o19f9f!xV1t1z*BnKC3)uQx_O0fe%Ndnk#7%I&QQoUgxh?*{;d0j2)c`(TKVWVFWT+dvlZw?qZ?{4 z{D&6JnqMO>v1s4pgl7yadNrJVdC!T5-`oE#MSllfp#+fxS@saDVz>H$K#ir|z0fJw z0@A={n^)$3joL&kDsp0hnkf-Gxa32Bx)E+&W!tUl1K!*sV?NI!TVyyN-Egrsa7#PJ zm=9m05~WD%{OSw8Q<-@_@?AuOf^7xTBky4hFu86|rx+gUoUET)c>J4oxq&|)lmi~> zkOvB?RV$m`Upo|0Z^Kb7q{V{6s$fyz%OUAt(9~rHlWHSa5X5^Txw}eM!3a_ebF1l@WDDerA<@BriuN(-5xIh+hgI4 z@+E;0tZF(sk>$s_cNk@X0cYlFYg-_#07B_yU0`gbCO)n+2n8qJvV_=ZDG>51Ho&i)P0;}1jsQLJz?M*w<+9a%cVeuqCk(jG0_WOh$1t+hGKqQ8Pm%#Co)cVO{xO)JlD zWJNFrwt}q=Sy3_L1b1`VCFYsRpFS+p9~p@(oGor%=zODi%E>pUKG2HXJkr7{Ly-MG zZ#!R?KMFDCSn-j-lWP=e*QTiuq8O+*{G^7o0ThHl#v@-@?u-Z z3N%+bzY2NWHQe!W49WtJ*o)$48oPcW)?MqU+|J0XxpT&lAD zraSMVQi9y!hV3#wRzA;kj_wwou6C@rS&G(r&fx1OVkINvDX*RUBjMT9M;{qKs!Cc* z!g1vgXGki)DWtGdEBl!LTPwYW;0Kg`!ZbY9ER(q&f9RKzU}rEaXyONZ{`q0M zjUmCiG$+T_RxS^2O0%%gLOUjjzi0PgfjB;pGKK$#0o6kM(Dr?cA$vR#8HtsUlIm;> zxAljb48}rQMQ=CbZuKgsr4aANsCd`LgiA4!ADDDXG}>|xx;K8iqN)HKZg)XI*HMUP zanw2_@W`ZXX3p$;!3c^KD!lW~cCGZzOi|F=CN8)?;mYXS*dSXwVfeF+GT(M*Q+hC#Ucqp6AQ7H94=o0q}ADN zZJcBd(U)hvz9LdM>So8GyKQ6xcRJP;?>?gA@p`tgCXL)ccrLD?3XNYJ`7U-6@YIzl zNBv~eX>ZtOfLav1Jy&uX35w6G>6HL9R=s}hvlH&UjeT{0YfRWa$c=5Z_{t$t0FF#$ zrz6`jTi9q9iN?q8Q|*^eDaF!Wc~;dg2?67sZu#)DBiroYQVq4O$C|?p6{3>a9Nr$> zj-v^x3S`DvoeD(g!~)GgkAewkcy^pW9=nbLh%1CRyb_(#n@clsxc9Xp*R0xgSDt(F zK^o+>N}3sGBFmk;{XX=qS)40t2BArDN2qilRx+lV!|WG`-?Cqn*f|B`Xh{NN-hgJ# zzzL7(9S<|=;Z82vZ8LpjA8630rIu0ZAwj|%PlmSB8uKN~aMNr4y(Y2?2|d7ZJ^CGX z*XGA8#x~TN1=e{^_>^NEfdZ1A;6BzJw6*?a&gh8)+v(}G094XV+!?Ch-)!_WIm@J0 z@2d!xcCR2*9xCCkWl^QPap4x#iHfqRK9wb&kxm^nb2tKdYv2;sjqYgmde6UsF84*T z{2zfXQ%^(%yxN<$iD zq_AzF;M7k=gskBKPDTKxD2!VncShN*IXHxFDJrTFwooV;Z05%euJD~@3YYzk`Zv|j)VN$?Ea$A~^Q zBQ#oHR={o#U%*q(Hbw++6j4Z%u(XI?kbt8L)ZnbvHN75}Ky0a6cqe2Pmk;{k+yV23 z(gLo@Ig0yw&{x4D3~!?s{J0WnT@Ee6#~w>#0+R72{p02(NkIj#JOaQ8l7P}kYxo(v3Mg+q5EY1oIElV6bb#;u# zRiXw#5d3#_lHe55tDSP1Gbt1GA)eG6r4`{od%4^)<%_KMj?%Vv`ATZbGb@4ANqtI7 zP{T+zln{21)G-=yY3fmxAS4kS{Pcu^;<{gnSI>mJd^R9#xiL&@zfJDISse^U>$*PU+3qZV zbY$6>5)-UYJ?qDFWk>@{2r8chn2Ja981x2mv2IdovXG)zWA8@ZsiO{2{}qaqRx!05 z;*~rFL}I=@%3yE(Yne&}Uv0DPFEttK4H@yJLC0zomHo0Q*VjRAl`+SG4dy7gE^Owl zA(gWJl7@hjo&VK{Swj1>N8;|N1hv9UtJ)SP$7 z8e}_;SxAlELyX?EnugS{kMBCg3kaG8jH4e<=)#CVqX?d8_W?vBVAQaUb;xl*4lMOO zI}edjq02ds+_x0Ct6xr*BUP~x&tsN>yNyHfu8>gxNkSCnaLo-YX+QJYQ$DW@YX$^Y z+ZpVwy_Q;#yYa!W9uE~sIwF!ES;3Tf>M>|5j<;UTX_v-DV?PfWMWpVI_37GT;Rs&Z1|Uw~ zroE6~0>UaUMJw1P9b8ri|DquatA4MpmbeVIpymaB@qeJ@6N}KIkrrn&VfeBsOfOK$ z33r-kY{eaS_bH%Ov6sc0pGX|tqAyA|Gm8&scc|6%^? zttb3OBSj^~o^%&zDaO!ZCNbxvE7f*mOSu+NVEi3LTtA(Jqh@6+Owz5a;$l=%t=qnF zC%MVC&)Ql2mzBfTZ=#-HNm-B|?71sRZaVjANo&6f`lM1af(BzZ(dPmUdbR}N*I0F1 z<24|PJjl!bKt#ojoOG2$62VL(FW+sZ7IsM_qKyM|x!egi3iwD48B8Y|@d=@410-~L zOcG;R<((`akF&7eK z-&KPhu=E;;W&;LvG&1J3tq@mT&6hWhW8!bG!Xwf~;~7`uO%)yOMu}Gy-Y>&$o7%be zm;HE${vFS|8vMTK+|&St(-_{&n+dx;A|vk{0?ZHfh08@)`GZP5V*(*^T|M2BNYGqZ z4(WuGtb2tehL3~fU2&8bpFte;;1VFAWQRJgQJy7l zZh7hLE#2-vxBGnwfRdcfQWH4DRLK+J69oLI4HYzlt3Svia;-KKY`!4;VTJB&@(I+e zz9Bcf6!dXP7aLli%POx_$0~fAK?QClD*_$fm2Xymf87d0d)v$^R905} zFesxDcchmNcUX@&IguYinzg|FL zDqI-54i)GG2j>-wT^^N`c=2DZ*pI&$AiH2aY9D`O#JAy+1P#pYXfuo=f&uWs^%5C@ zgKRAFmBbm6w|lD+ir3rqr1#|d{iNUZ;i%eQr?Ek|a%NdI6sGYw$;~a`iHqyT5de3c z%3_W#QZxdlzLL1I8{Y^hq>*4cWH#?XK_v}-3xJ>Jjq%{=NwtAf0ybt{t^l+TWj@}D9g@@ zwKy772a4e<>(FWr%0oHrJ*ker~dkk!NS!ujob>?s1TbfK&(fGj< z3E+^5Pt{u@1=k0$3=b*3he!fuUcgr{r2YqW>Ht`x-%;s}WP{BVg~OD@iESOF#?QNw zuT+5VQ@_eyCwXWS@@366kN$i8Nj1}rS4<7_6(d zS#F4=55R|V4Tp5nwQ;eab>H~b-zs9Il1KF+c~gH{ptD?|+Q9U`ukfAVziPaeD@0Mv znc-lz3seVwr_UDA2$wWVDUug!ypgAr)t*HA)H5V2_nvSkBZP*>u#~VKghM`E$ zt8FJV&I0_WUwdX9n|1_~mDVFOg!=Ty(}KE-uC|6#gNDLJoBsW(w{PyilD%J+`O8>W zGf!FZyj%PsD&69;I8IA#*dED5p) z4T|0@bcJ>k-QGhrkcXDH)74~19s*XbL~&lnnMz^r6wrEnK3 z%!R?EdGQwHprmd+IGF=9LrzxQm>EXY!mziwDx!G=bw?Y5o+x*~Qu@TX2m0^U;^lGp z%=u50z{*4+svm=YL_y!71`AsXB_56akREq@Me+tLw%Gu*Gr0?zi-g~GolETRCjam^E-@%e z9@$<3s?EYd@)!Bc^z475=gn~ae_PLs{?GNi3%N>}$8C&V$eJ2za9lYy`y zyLN`^Z;>z^yTPLNrA}dzo>z8)$KQY>X-H!7gU}Xu+HHuUrxS4-PPfxW!e0U@)oy@= zXy`FR4GXQ#TG9B*VpBc^_0)7y_P&YP?P^|edZ);|6J5g&vXUS-TF`Cj(Yk!3b|~TT zJfT$yMSGQ`o+3xbvqPp2J&{YB#6b>Wq26aN$JLA0$WAGxd6!mu#IIJ|ro&lJA7b?qFIJH7Jd-6qvkLDOV^ zMBY*MlZ~6ydvScRxC<4()th+cCjZjvv?SoMEuWwC!F2cP!&*jFt%Z2)1gUymN0=N| zp{_O2n;I`gi!lO_osEk4T5%_%;+Lf3R!{Z%RsuYb~xXJh_3?Ks8ze^fhu z%-vgV@sfQDb*-Vl<88rsZI&w3eyuowDnP5+bH@f9;3d@yhW zIj($%Rh1kqf30QLJmYT@;)Jtg=A0SOI10{k9=V(_0f$V!Iz5F3Yyv`c843{0SX9?y zCw+QtKiB|=^U@}+CK7y{W9`O@I`>cwqob+qOhK|Xwz0IDLn8m?aj~#0^jv9wwf`m` zjzIcH`S1;4sd(qd*^Cgvsk6ZH@067J}>yKBQmJfn|v zFm1CK?v#yEyBohjjdiTAQO+i4?+?|XoD=3DLy22|6?^-N0RyuR>EwVicC~kU(Ek*(5L0v;e@U!rS z+8yJ@in7BFw)bLEAM8VfXm6fXQgUAwa!&*$aOha@15y+M_6X(iv)N~%jm_TbCpv(^ zRQS%YxMkWbV#X{cST{iBIseo?lekGiXsmgs;R4p0b?f+FAd^c7ZgbIt;Fryx)$B6R zWD}C5{p5=I$1^bHHzsssbG@Aa9Ad&SXjf7hN=zO2pS(r3Y1|hvSr+#TQJ{0@x4m1+ zm-3y`f)yI@2204oh^3ALouzYiQ6ta>A2q3xf4=cxp&K)>` zNv@ybd7$cY`wewPXfyyawyuiGqnPJnbFL6Gb zZS(wsX_h{}NL;TWS!xVfFD9=Cimp$rrs+JCaT^G`j>Gf3yQ=$An;3qW8^$iRoRl6s z7@HYK8J@2mxtPKDm-09b(-oU8hnqT4nJJd~g};|UmFh;zSxyHE9F?x7^TNi_oHr9N zjh(z*SrmfHp+MGUOf6Ahg~58FA8FNrb8!D8GhppE+Tq$sdt6dpENjy-?Ywx9-dKzT zZIyQa7IFSUdo8^rReoMNR>3yuf10D!ihh_;Ca!`@(xL|(g2?B$1c%l95((r5al+5! zfFs%77wu#I=%pIXaAt@e>>@Up{vT9bm( zQU7uGe(qc}G0e)y3wq94I$8!yRM--3df6@bX1H!m#GkDPMNFg!>poe69POT_gdT6K znf8>Hg67LWU#O4H?M4<2tZg+st|&PVf5Bog)|~V!YAC5lXM&Ii=de~x9_8J zF0*Ie{rIj*JMnDwZJI9yz_}~eD5r9MMefVd;~%7$0cLe5E51Tq8lM9;hu4uCI{9X8iK{-^ z`uJ)0wkaD8yi_b{E&Ct@d<0qqO%riQ=aox+uJM^SLLq)J0`PTZp z>djIsW@18Mt(AgNmncjf*0VRo&q&EePjJ*a;<_?AY%EQ$7rL^XgsfjxgpMnaIa>_c z;Dw)+aZj}wz~=w#p`G@9*nm(7kgxJcJ&0(v=3+M=3>_1t*ez8&Fz?i0!mpzvfceC# zlvq^$hBAyoWzp}%=A8%RF}u3*D0p1?@U1)Z>-yJP3QG?dTt%wMKJuQ% z*7vN6Pvp|&DDEkjDF4{yiEqIDn^rk$ABFRqaYI$V0ZcgPe-4$|U$NxoZOY?YK1Xw* z!T7Bcb@VEMO#ufyJ0!U2Eg2l%AFHlTeICLroh?MLX0N%CNod_vZws{6vB;sycns*a zUZ1Ns9nLFXn{Zpriae((VR#z7R4yrMSxrBgTRG>x>|8XhFp&BdzGTe@Fw5_Psz&9 z$m)t(-ua(T^>+qJHz6cFozBp7AHb_!U<4uww<7}=pYlM*v*jO}97h^LB7|(Yz@*Sl z%Ub=qCJgv?YIvF-U=+w{h%$eOPr|j^+e|aKSAH)Io*<`THuEJcxTh>D+G9Ly0gtPl zB?bn|Wi-EnWm@Ld$eeV2*wNpqu;g25 zsePb?3fNv-@nsv}zg7bpH zDwYnsbHKK zToSQyI=?5=wM0ys2u2`w&Rk&=@JSc@T)kv<|3h z4rJe9f362m?9)QDHHL zAf^gpwe|a_P`QoD=K>WgW4mN9$#MID#o)##w>uH_yFF?-2pqLW@!ELWHqGXEXOUWF2s zUCV0D9g3&-Y@m~_XqW9p)WLGI87{uLnffvvllS~>wH%9j|98={D4`Oo2;MR)2XndU zH6N2{Wp^*+=G?XnhZK26rqzC_&+-BXQ{7=l5ua{LOj#LC!8oj7KMkz9%f&Btzn!j@ z)NDz~DshP;4Y*T%Z+2TDMh;a#wd2)^s9G5cgjzL&c$EUGim~|HxNP0Fig9)`Z_5|4 zzX6lUs~!>(V7YAC0=otAkQP~F>$H$zAJKOCg^HO24eKrTM^NG9r*N)MJOaR@F@>lp zn0ej~#d)Uo-G|Gv$HttL7ZRkXbk&{%C3?Ba1uc7x*@M-QurO=7V>b>_XJaiR-?7lD z%((EnZ5iPM`q0fjdu0v-Pj> zF~3z9JiX&;s08F(IVvjLr)pwhDn+~K!hAvMTVAPWE9Bfj1!Ri*+BiRP-zWDY&_#`s zC~T+yi@CRsilciMbYp}h1QLP<4G>&|1cwmZ-95N9H0}_=p&M-+g1c*D9U!;`You|v zMjLBv_`Yv`>)bPQ?mc(b$eQ|Vcdb>`wg1@l?t1sLpEp_w=l0-pSg4UaSfSlEbQ&Pe zIHO=TnJkf#Dw9SLP^B{YIdv#iqqs`rF_U&?UWNR3u9bk2ZPoYBc-|!9=~K@g_Rw)+ zr_O#*&0MotHdOOq1V7lWcPmyA=}!&d*M{^fcv5Si6UqS zNE2#3Go8_i1DVBWbhBR*Ba2YZ-=--_efcS2mb>>mZ(CP4wiO126X4-V05Ic2mxIe( zopb{j8gigOc_WOeKH2D*$p10CsV#K1TD+C=*XMnkOcmF+RJo)M6H#u`SiMu1es5c7JO|VdQ^6i!AM&QpMPDQcR&3cl% zmHc8BwhnPg7ku0$PR)`+fKP6!hO$*3Vha_WBxp3&uq2vg?G$JfFNQSmmF-vSu&}Ma zWqxCoBKbWtKNjCl^b?Ygb;~T@vxuCUAm614UP;JXNo^i*lzK-`L1w9Ozp@xvc;$_I zBrYb^-b>aIJyEv(B$Y=3v}`?c{(SM7wAPfQ^-I3&H~LZMKpKVzOAqEWeV!$o{Qs34 z|DnO9zSdk`t`X)c=M8${q3TG9!~P(ByKe9DFLNh9R*5MLNNMyDFlgf4d|g?f1VuR8 zY8mYAON~l_l{ot++3{h)NyEjxe%(xCe9sMDPfsoQQ3CBz-v7M=*^!x?urFlDu`%n` ze@*N9w5@6Hi=u&8#u6hKchV=vD(l??cI%17VV}`_%j>DX;H`_LX693Zfc~K*Efv&- zaPNJrQw+T;z!S-XJE?CkjAO-}>z1?KYs{_BS=GaprohwRX7W$XJL3DrfJR!4UcQ{; z5nV12r)r-4}`7VT~*dZN78ma?a79|oSB(C>3n8; z+t^Q*Vz%^I6Ff4G3vuoME`j)}xH?3hkQ+8wx%l~@(thyo6ziw`aQjFEdeUgYCYLm} z^Hj_6AO1M?%fIo*tmJ|-!gUVJyz)J#Gxs0TyrVIsOmIF_a1Xalen`%3bTY=CY%sq|w+ipRS8Cp&*!(+0;&mHU*;wnVLa}Z(UQR}l^0ZFIn{W2Pg@O1Q=Ham`k0Mkj z{xjb(`TYML-|;x{lmD~$@#>V;XX7wVepjb;|_`m?Y=j^EVl8DjEZy~s2kUhFT9g{KjApB{EMLo3do#z84W z)n^eMTW^gFIRyEB-Va~=N-Nd4+wamTR4RMFO5SMYtn>>TJ$a7NkCRf)H*?X^)I-5b#c}OczyA0xxHzlF zP8anCw!NkM?iajNtk!qU)tP|0aLPmfi5tzyBhQp!iW;;MT|UXd6;gFez)e?F(0jO* zqIKT4v+*)a@gbm~Ma#{qkkSx&`}BEa>&!w$(`)uLZ?Y(czbF9ynQ-`F)oYdXVp4M)xj52C`WfGEy(=Oa;fQy%cx(?=1nylD2>J$oVc< zNf-@7KrG66kqwGAD%hdO!a~>&DR64W*~ePG=jT5y`TY|4xx+y~+#ZXN+O-aM)n)^V zhs=~`rXu|&TO+GfKC2Ww@m*QM@EZvdL+t__3}SHTRf$Nc?pZ1yYoH4miC(&nF+xyZ zJYD&1XifIukRZ_a0kn8YC zQUYTs6iY4TNNEuCnvUoV8#zmTE`8glB2+<#Q*0>Jx6n6lEI&7X^R#-VUmT+fedm&& zv=Phg^FJ#?KF5=h7+WJT^{)C3#MUsu5!tCp$Se)P8BNuV$2XxieGzxQz|J_=s;JcC z>Ceuef)=nShwQhivjzCbXMJ5JqLaNY3!oA{N(q56@Z$9iEG`Ir>Z%3F&D}UXR(PaU z{+a%^ntF`v@xb2#;(>bsF~R#U=Onsc)+l$=H_o2P4Aw2^yzwep7<$arnI}nuiFLNe z0Fw`T3RVvPC?WuP?{F#{Q^i`a7+6C6L7QY_yEt5`6A!7EtlB8tmX@eufWPVerXet@ zS<8ImAe=otQ3t|1%wTWyZQjcoCgid!*81>6qi-LGA$E}9VCb`#q@VCoZy33?W*_ZyFio4{3TH~S$JDTG{)s$BmJQ$_4Z_RG z{I2laZx3=TISUV1=cD~644`oj{&IA*L4|5E(m8GM3C%S3QeLfNxV1woFn=PfuyBkc z<`NVFR`~EGI9jk{dlxm=(#;EC^(M3P!#jSb<7QZ&RW{oPKoJM}x09Sp&3x?)zJHsLi+9Y;P&77Ve#U7~^kaJ8$qu44hYwMg z-zEjH-{vAOJFrH2B|_Smwb_4JV%I>7=K-8{eAIt&%@za+S)8(ky!Z99i;7KE;u|g9 z@5$!-?H{aE&9bN-P-mSY1;ZOf!oOfWIa<4@H)bcjDDKrs2@e6~2~;pL+%0x%t0|7^z0po^ z=Uu?rJ|n3qaw(-!)qfZ^PqJo$`~& z-(01hq2v^}8!Og;Fz=)yCpWLdikD;0y-eJIZZf{%$Oh0A`F`%xQbqbn;Nw=`uB@6& z-HyjUB*(v_t4MPL+`|D2O&!s+E*)#lTV=B|jyomC54YF!Hb4cuRR!#Gb-|9F6I_1d z2)Ldhe3MAtab>!b3NL361}vUqZhrq1k*S>uC;=z5f$EcOyIc5XIwh2O8fH(f;7Aj#lxV60wpiLOm+*d|G#szfKZPg00#TOC#WjJ1(&x&7=r=tta8(j2US7VX zpd0JAdcS!I<^CMALR|ERooMM*lreNhkF#MYR{AboEk%IFxYy5@?7M5ftaP9dMDeOE z%$YLIG4mOR^zrl$vGA$o54KXny(mH3de~W8jK(?6s>T0uP3;z;NCWr=I?E^?K-9DCmwffr0jgH zE0A^Lo@N{r5+rEbKzdvpOyq*i-lWU@j>*L>K9#jmP=cJ7xt7Mr;IgS1*_1_|prdj> zY3oE{Y0L`Ll`RRCG$>zOTP&Xl0>&GC>qduerP&S0kr#F@xd=ZeqlF~H9ZN2cw6>da z1N$*y&OrpCWZl_?^5#ivS&L{m{ zBd;+b|8s{aN(A<=wOTh2*-t`QszT*n6z$nEe{ns;7l4~duWU!k(+?T46Ib`Af8pX{ z>DXdBdhtX!u}WxInQXCD)MP@Vz*ef@wzL1W!P(LuK>-ISlq2Alg;5nQB1FZ-tk+ge zS+N7(p$cOzC)|WVpykWOzRbUuN0XT&0qEBP^UO-n=SpLp9z(!48_bg=E*TYdns$u@ujA@;)?kn~9!3J&zTdJ})YrbK z!+PVpSk*9kYad+#BAy>r-C`)NF6zleu;(`izO>AtdCuW%(6SKYlBma@c}<8m9GxtLbRV`?QcJ zkv(C6MGr5;hm&kue_q~tr6QBQ!CJ8LnqJIUj*9}EUC1JgUo^n9!`mkz1*KUEH11pV zI!(+c(sRU1O%-XUxM^H89pN!i5-0-g3Q_^xFTWIhmL=v~lzXx5elr~vs}xpRa>=Z| zQk{@k)9ZgNY&0-;jG_ytfH@`BU9Tish7w?~CzUpY88&9$Y}N2untuWGqb*<=noNs^ zJWMY2rn1Q=C*?kj!`{+5W@@!PVHvgnOoYRy=(ibclk>IfN0(`J*+LJR^lXGlhcG4#r>AYLa=a+JCtTJDR82{{=A2w50a5T`2yA2M z`HZ`&LW{W~39w3Yez+!Cun+d8mc{vOrEz)g44A>7VL9y)A2f(1j=!PQwwvA(lCUA6 zLJ0ORX?#DQP^#~)eP=na)zS2~_qK1f`=SO_Y?BsGDrDK_=(h<}e^_!X;Is1J6a5Y; z$?57E7JNo|WQzjm+hyIc$)2uWZL{0G-etGej*U{LwHl(J0<`)(#a6pHpDW1B0PwCO z9AR$$hYpyFz9&(q?Uc8NMxQ&<OF_YCNAr9yHla3g&!*n0#ix_Wv34?4lHt8|Z3)P3Y6s=wQCYmpzIC(l zmm%@4o%Lcp?|y;=2z=wu^YVLYSRn3bd*I*TOVc*L7|oTs`&_wY$mMPV=MBvaH4oUL79bng0&)$C^K z^6TS=J?Z#PIw>G6!-==wo`&x_e=m95=)(=kw@SG^uew03^`Q{~`W}x!f)9FfTMvYm zD$_(&fit3CriWU_*U06@N^&YS!aBT5hq>-LCm*EVP%H6Z^r z-|2X~Qdc#Lpmcc9sLB0ZN@DJ~IcxsyEPy$O`uO$xM-TRWYnK{xnhO60gMX^=PJhcu z{09Qx#jP>J+PJfMRk3H`TXx+KP_EV|M}nloe%Jz_vDis%LYW= zGU5VID>vdlImQ%tK=4nm8|!uyx2wD~=M9_cfIZALU(Bpn<`(w6vS@ZKM~t-{5T4aV zs&lpw`2t(E8H!ByfuvUR9xot5S5IlGzA+ux=6l0j1RS^g-94PrV1LC}^UE+a@bRzn zmjw61<)wZ2afn;$;OIaEy!-+R-pmVDlv7MWg*H0uG_Vd#yU(8W{QC2I;-d2Fin|?y zeoNsV9`ASqyTS)UFD9Gy-HJqf){NQR^vHzuMa^A8-;if~fC>nnpwW;*Xxx{sx4@!Z z=9Dx`9!-M${tpg&s0j-}JMzr#;aHiI+zFiJV7;6F%?f-YJfVpE z(P~M70`z1}I5{D@t!S191L^GMGSt>_U%6P_BLVy|foM2YOJ@`qTze9+>7K#uW1y|- z*dM7lZ^YiT8u6G;eY8Ao-!gqp)0}DNT2$Ra9C2JWBz*?KM+(DD#kEDs=8RfSK8e#e zF9QuNHi$6mQxq`UUNcQyHq#Ai2A!;(2;Eg~D%NT~yB|#fnC}Yyl?%vEba$6Q#6U7* zj2Qv>a4gE!=Aq6$vndrDXJKU$oV}LE3vwaoSkzjqzA>X~oDPZYZbevgaF1T8{*bTp z73X>l885TT&9b}$*L~?I@1NC`q&#UzW6zs2mdnr3%2L_6uyP*w#C*5$_Edjj7lBqU zql>10>F&8#=h+%a+o%C=-v4W}uG;OwnJ-VG`zLgsst#2dgQ(MuGQTp@@oYZdO`*!i z-DL^qVoBI=N$_zlh=vB4JI?Ij6GaXRyk<%R7mP2vWmw!jn`T}^B7gyDNK&9r=oiG9 z`oiXZ1NpD>Uj#L}Po6xrxw1jKSI2Ar;S>LZ1QVB{(Ls@FNrW}CB>`q$#pqF|%06T(Ty<;wV)&NZ>~!pt!#L(8Ot-DyLsKqEN{QNd zp&&E8)>(Dw!DwZ``f+4}2yMhm60d~rv95tTd=4u~)k39OU$uI+fYJPiq;I~*7oaQA zGKYocm#X7!X_BcT-1-tp18ueO>*nz`aayI==RBFLL&mXnt?$^StTGW@JJ<*=Lh=_W z>GjUQkXC2-Y|G{(?QU^i@x>o^mqB{Ph?@SLp!KgY9l|5KvlGeAaw0?zMRDi7|19 z(c?CkidQj+OEm#^1DlTmheuD$DjUrv14bEKKhqX#v2tMRCYPNMd0;>ZOO_M!WS3XY znks!}Ry=B52#MbM4rKxcjOt6d*#+T?Cv|)IcIO@X?nH#i^c6a!ct1zO1y#CsP^?XR z-yVnpeaM8>$c3m|JsJ|v!LnSr^qZFn`Qg{o-yRRw5Dqf93sEE*2(Y^Pe)4uMX3$}9 zCQM4}-^pLoiMy#XzV5fbYp`4+i@yt%Su`M_yE~kIW8!+7MNM>@aN4QPD?h><|HwD! z=JjOiaYRt&zKK|ysf%3Frm$n-EPJF)I?ECWHNj5}t*z}$PE#7|;KT+vnc!0g6@8f7LJtSi5=_XB1_z{6N8}aJRjFM1$}%>Y%2^qAmxstuby3!< z&dHc;>|T{bdW*+P+pjGKkLw}IruTyrOuK!Q^J%wlvuZX0?8Fxw=gXC zcN7~AW@0p*dPzbKdnAC+5tnFGCnWyOdS_W=YYMck=|i&Qe~*j-+J12OzsaDCj=HO+ZUTKx7= zj1m_=ja^b&(R@s6^MbaB{?oL%44AXNTb$&o;B4bNMt4t`(yO2WBSxz_R7}N-L|AyU zPy8Stv#JiL?0?(TFBS3U0>qhLAkB=aJe%(;*3imrvq{uzd?gT9HbzUYg>HO1W>6k@ z)6#0_0j)SAH2AutB;TovOT59FXfq7Ilx8@XE#l>bw3J|j6(gs7jDV^9YG{3n@c4jCyzr&l$zs0M2v!$z2$-{R85O^(t`rHxy>Qh+J5V! z4^NI=>>#ww=C^f-1|Et0(x`ateWElDtK;_d0}8Mg(EMD>u|a!0$DO4XnGkWJIr(_A zwC~mzXnVzUp`KvXU7@qv>;NZR{<`UAQ5MzZ)%-nxLT}Ngu1Qhc!Yk^Jv{K~jgnVHi zFotr=?YFJVl#MnTGk@ZhdC?5NVGvEZ#`xr2% zp5rHEx3Wj8VQ-Rd_3&6VoV-yNsHK~niyxXL~8VkZl$0trvvVd8u*m>Fb74dbe_I?aT#V5VK$2Q6A*II+-G1vIa;~a z20uHEz=rL-7==zNZur07^M4stZeN?Zgnn)tNvCO&K$vqrSF>{?}R-Mer zd2cli$T+fMw~wDghm#C#D}%_>L#}#m8!Oh2_&uC% z#?J=|tduZbl2Z#?7nZ$xHo=JNrJ~XAy!z+et`EP|-D%(DE;y4=HEV^CW~s4kZ#!6= z(ypY&tOvX$)g|cv$W|)yPldpdteu9ZBUpAVBm}%g*L|O=wdOvn=o$gFh&s7KsoT6br0{YZKa%<|R-s?gFd)qeVFsM2-fh*+IM2XV)1s5# zs*#Mf5q&o}RkgdSTk|r^niy;m6w0%nXfrf?N`|dgILgg%%ug%*l55Lj|AXf3A7c0P zgyvf_y2}B?9*3FEn)&u(9A&eTaQy&kG$BxCcihWBdp}L>*8lqy-iPlaZDsp`IpZFR zvMXgU@VJ?Lsb~Z%k04g{q7e1w#cHl?RJDb%4tuiZ*^7rn`|1JG7&6A0p)+A^EBS3d z>FN6&XTJg}{-}7|Ry?LmD9`I>y2Tw4_U}U7&+6Lag0Tqf;={51qP)l^5$z3o zLs32f3bGqduB>47o(sp2L^xfPv(ePJ{@fWr&P(fJFgL#NlcF|W`hrJZ{??Rw+g#&O z=YaN*A4QF#hel?vRAmuk((_v<#iswpZ>$$?`U@Q2@esFMth0 zRJ7x$!T-0}MmBi2E0pfO&LxO+doQVWyBq5+q;dAn>3%mGJ#Qw1Q5B#^w#cY9Q-ofbQ0Ghkx97*p2fo?rLuJPwEfgGP8_Q?y+u-z` z;ciVQyai=@NK;IMSKD>J`YLj}JcNdPLzFVo--ve0H;SIWubT{M&GdxJ$77|>;rIW{ zB^~pqjx~_UtbWro&Yzf<7pq+Vnyrl397IUguTR5U&0(+9hpR|Cc0jH1rUz zV!f6@=@^%3c}ff6?Ueb_Q~Fq?UP2>1*EzFBNega0yT9(_I(=_so9CCK$N>J%B46)( zvzYeN)$J%kA*v#&&1dBDc^qaKscAXO;H6{c?-qR{Nbp!=_bhdVulpX|ZtdFi)61*= z0PE-roYzjS%K-x~*aA?nbk+|}rRQmxw#|#NFXv*IZr$S0Q*Qh{PZLW-dS{zrm9v)cG`fqpn#P_IyiZ@m0P3a_ZfZPt-#qZ0a3)uU&8*Go>L($w5P|1=W@=Ev@@@Ixs&IzbG z##fxxS-vfEBg1N~Of`oc@dT2i=ml-NvoeI+#GB*zX!`nL-5S~neS>11@)=V0=+C98mv}5LVrSK8oatkhW%*m+d*0bYwG3e?8r{qc-7Q(pE(SJ}q?i z+sh25En|Fs3UCn7(!2Jbe{$1FLGNA)O<2rNchrKln0H?Lf6mCLQ%HpgHQn$QY?7%SgxiyyWh=a`i%9QSi2qk!4FV1 zUM%FjU|h5s6X7Fx^XS?jfNC1+5_F4OkLiFU+MAapaTDnLy7!hxE~`}>5%nh?RXnX> z7ovNqS->Ega(X7iR?jWfsJW;@`MMYnTYvX=v@>Jw>my+HG}JDVLt>(!XM;9T$z>jC za7lCt^)5K6xsl&3tg3GLKs^lPUVDMmDcAviBL@5{7myq-q%P6?QWb}0PyQpH(u5Rr zHSDuMCf1K}iyUM$$r_OwHHN-(In{!|`$vx)DjLhR3R1_m{RL*vn%g`&Mnr!CBjO8) zVMIgkVToxSb@ltNmOtQvl z$biv~j-yOXB_ZktIQncn2(ST#a8(|m`bye?UqP@_F>u)KGd}aLuP|yIYKry~rW+6& z+pbaY>cDhF&a!NxbYCae8N}{3j*L|rjpM^@a-&;Ry(jeu=R{CK|t%)50 z#mMbc%?7`1Qf%DqxBc2;E(4iC^(7)-%I_so#)cJc>_9a9;7yn)$N-w)Z&yhxgMA4k=gqFdlPyQFQHxO|V@)oZn?JA25 zVbOGO>mJ3E>$1n61yI~1k?6fP-wZDjJ}?ZA^cOOpM!y1wKf5gOT?NI`tXk1SKk}Vi z5Xv7|j;k|5P35qm2cZ`z+;jz3ZP@!8y(Xr-ruP0W^^}Z@iMb9BJ9@=e`16Q|cC7I6 zky+a+*I<=-gq&zI#7}?mB(v$G9($&$+IoOR0zfe3Pj6(*?R$lY}L zc6OzRq<I&cey$Las>nVns+Fv*^RYkw>#CdI+cBHvTyz%1!;#( z7Q@HxeV1Lm^CS25RPg`+&g;HbMWI;?b|6VT6STM@$z0m*YyYd0F3d1RF;y2S#;bRV z0jBmHDWY%*($o35hwIV75(p(yha{?tNe4OJY56gmd>{YGwUG6H?sqaSu6v&%3 z){;J#se)?h)x0W11pPwCqsfrHHs4UN@BN_<-q?-cGh%%aH^H1u zdmWzfvkOA-_PD<}_O#VIlKCGAD39C7b1t}42-xTH-Bt9?FvJH|Y zu2JvSSu~?OpbS$UB;0Q9TxCMW^@^OIIh3}2IoR2Akhz>po?%`PguEu6J3a~_@;@F3 z5uE=@>E)9;w2x_iFubEh#l>r%#P++(OcEoan%fStfHs1Ih8bxDjpZoNszLw-rx%QC z2AxOJhrfTAT(&XgL(Y(#B*Pz{-}GMXGLwGm1W0e#9i+W+J?|m~lnDOlNnP=jyRox- z6#NvLdpm#0?~msPJiF$hD)-ZK7^M+LaeH4uWQ ze_mIRTh^eiE@V6ZuujrTOh1!fuSe>w_McHIC_7fE;aQL^H&yn8-Lu2*{n661Z5)`_ zz0E~!y2VL53phF$XhD%RHA(f7=$busE2T@Yj4ki4GVZF=-lA=;V+7sXHShZRkI83D zyXxs0;?Vi!4Rw0S(>~oQX2eJGqo7(IugegMTE!Sk;(NT z?-BEm)vr${1iTH!e*pq*YPBc4RS5REpwv1&MIJR7dddgVlX>@hkfK1Nug&`pobSWr z@d=2t9&1rp>8~*|DlAlr4888P`lQ~OIHulMI`1V}u0GS;fcmHtf8{Vh-`xvEde5bu zIqe$?xYw@BdR={$8wyBpo)vWa9i7l4P#uiHb>^{mljTdcvo3D6`(TCmwFV(XqZr>Y zO={Q4>uX*Sf+^COG^F2oyM+K9_-kbjiQ!crBa!ZH#m7Kn{0u?-<1B+NE1{nuLrt}K zJ}|;Pi%~5~_4^;z!eSY0Y$8np%$x3tJ+CU5=@mo(I^T1V(CvctVk8QWLeGgWzS&*1 zs;Hubz*!LA6e}_fGuXA|SN~If&?wJ-1=lsF0$(fpQ$!%m`u)1Lh*Az$HfC=2tXpIt zAB(l8*=YfxX^C)cn!tP^=q zC#m!E^dLo@vKeeba4rwr*X;2)%FCx~U=_a(#y-$?FLp@XH&`4!{N2g*6dT)?PtQeh zdcWHliK2IV^>je{6Y@r{z-}lrmEC<;w_K~#pn6`^hG!@qP%>M?)7kMj4-@+|Q}jaR z>O|3BJ$#oUawKYM5kmdyq4egrn}ycxhKbmP)peg>T0y@=elA(WUMc_j*tYQnl4RLhkgl~>GY@WyXW2t zyX~!AiaiwJu{7*hLT9tPJ|BU$0FNIu%u3^FqyuC`d2%^Atpe5ky{gt@PyIy~o_;US z-I*4;OL36yR#x6o{av&@KmXSN%Z==`hf4Ae?IHJ{iURf(P3+=q5D`W*En{USSHeELtkzE$nRUN8+71VV)emu%%I;WpXC@hYuw!#Fq+TUD&NqO zdrubDc!>sFEaDzVw+U{-pvKw7$j&U z2A8y18io%Ozr|hzo#h~{S53%aouV6wtCsd36raB;6nM>1|8q0*_k9iw-Dn=;Q0;y% ztz#YmE`ICeiF9&REn-n9Po?&lE^?fhdD`s+iW_qf57$#BUeBYQ;(>$Z>!p75Uwxsp z5Vv`(mMlOsgDa`4@6>pM?oiy|5fN}5XmZ1p8V)07(8DQ5xVpN22`6KdmI5!-0u8$g z-$U7_j}-Ou7Fm^<>|TPyw=5Wm5uw5LQRLG^eA(=6a^s@m`TUYq26=QFV7w4@p=y+37eyf1 z%-&6>w6jCu{^}))V7-oK>a$xbYYK%{w~uFcRa~b+P|3je0E_UZIW&LWcb9k9+Mj2LOnAw$n&Y9f*v**|fR|v*-6lO&qF% zXZ=Bqiqx$XFG(4w*Ymvo(51b1D%b@AtpGL#C8olHdwC>7N2|0lOT=K6^B{ zLdFaJ4O)q{0(CBc61t|zv;b;(U{BMG;0@$%LpQzofCJhm^&@o~j)MViDpI{$3EaLQ zxZ(3+P`O(^Pj#obSaxafo%`{#()gm`=9j2`TXX(mQtxQnc|^0=PrJHcgLx{UdRkO8 zT9mlZk#7`&9^lP?({SW(Lhs>cPJz#VAr}RmzX{G8AF-xf(mK_h43bw|Syj&rbJDk| zKZ}d|OquUX?sfNmPBf?bclF)v#Ux->)5|+zzAbe=)7ou&B20eezB0|_4r%NB+-9Ei zX420&|eexQ^ar>YLZ+`G&P!Tt2y*w%Z-W>oBncs=J^Ze*5=XBm@e}zr?|A3a0p=|GSWUP=7l%i|49EHA!YJNkj?m&eEsBKk zXb9WA3>hz^&LYl1XGq*RSk0K2RIoE9te0H5`>liUr9(QWfGrDaQIs*CZm(6JX&G;p^ma>g3`ejG}*y!v9zl;?BK1Y^5O4l)~s|0_V|Q_grLc@%cXeP+hKZp0mGRkllROK#@Gm*1PN8=v@- zOowWvG%jzN`qDuE3Ts`9^Qj%b7)1;>^mp_IU{1oq1f-(6Ng~ScL0-)UhvY6RN=d{TgaiMi90 zoAbI~q(<-zk?DWHrMtZCAovl~WxT9GWmJNt zm+w?=c+cjTVKt0hV%Nx_-l5>&$M2c-h&&>Om&uN_{CT{Z`tl+Tp(Akxb*GczjnBpH za=4l{A@*Cwe9hj2!Cv5qRmV0I=q@}Und6h$Rjb8))`;QKfHE=Nnbhay{nC!sv5&z< z=5b2hxFhM1`e@uj@5q7(^)AuZmFu>>r~;Y|dVQF=5N!;a@dy{D*I-`|Fv}%=Wgw#3 z(zJKGwPynSawDD7x#_0+8!Iw-Mbu{q9i11pd{aSzs0M_%%at35@B>>&OZ1DUV71G; z7v^S-3(|;L-}^#pn7-mJj@Qn*HO-Z!w7yNwBahAv0;taq=)LdD5zmiU3oq8I?@x~H zadEa2`o08lh*XzYZ+`71?dRJOnZ7zQb~9DRzRD_~MOz1KaaV}#=gyyph_=Xow#q!h z3z3^70quZRa?WhAJ?08-ztbs@Xtn^{G!Gwnp?b_n8#GabxGU~9jVvfL>T7*>w=^@s z@rg`;j2?_oPhL`W=0ZFBw3US?-!0G2>_xZErdJg2#qh$#(b^u-e0m+l;>wa$_P(*T z&lI$-^89#ngoW4m$Qf=-kIo>(g#f zu@)+@j0`i*gQ_^}{Eiksu_8Rzf1_6;(}jjbsw(o-ujhHp+p#x3!CCKgK?y;RO?eig$bbcn@ufvm8@hevC_ zpiwg;^XPZgFqv+?-@_@kReP7w#~ z?>ubHK%J$cb~WSn0%mxp=X2I>-}+ohwxy9X3j6_iemHRJvCCL<4Iwgg?GD}oG5_%1 zx(e1Wa)dDxrMiM&o}8W8Lg(hBMa2#nDtO{q{p+sn{4~~gEdNs1lA2t!3f31YSu`#&d zIY}M#bHsuLe1g~GaqxA8>?o76pO8^Z zwfbj_VOyYiD5pLM#=r17xMz4`Di=33bsPu2kjAXjT$aD}JB2^_eF-4(QQ%R7%Dv4; zjRj#1Y1alIedh&bUoGgi!$d_?LqWZ107 z@=7z5H`7(l+;GS^`AuS3OPb`_>cRaS08+rKin<7DE?p;raf_ESc($9jD(-arq~AZ0~xRNZ3Q zv{9w9KQpv;LNyl1Hrbob7?0GL=>|s+>`?pXT|u6WHHZb1VRDC4R0Xqi6glN_^IuvN z_wbMj175g}Vbz}HZ)fv{40C9)RD#}&nL;$kcxHL^>CgZ0TODe+*|S>-khBns2Z_CB zmtjvRPc_Y29?KZ0xuNb3dn|YOp-xGp_qaS*bG;|O2i{Camw*TlQuX#=k{5_{CRv)G zYWNSyRdje!MVU>)ZspV_vR*k>4l~EmjjQ@UgI2$(&N14CZ)`3m>N>S{?#wOiEZR9g zHTAFcYchq+gpZy?XUlN_{Tjl$=9kylyiif?r;QVlD)a;hMFM(QcFRy}D% zt#FYPz2X{uB3O}&Ol=Gs@s#{~pumpCo??H(!dqafx~tM-biLUwmYL5&C~A+2cK^H` zn%s08`4ty)z-~4wdKM1Lukq1$C9azg$S!atBWpJGDX-Vd2KL!xzuWw|8%iu!_NkeC z0QYEhz$IeW0MJ)tU(ks^TCeDn^hNYbxuM3G{m8T_+XG*A0)k}!+mnKQRn*SpZU#=S zMd_V@sMEWp#<)i~^5dh$5dz{W+N+P}QzjqI36sc=b1B|k>G*mdo8LH)o&7%AdqP&+ z^TFmo@D(4+rm}{?8JO4|&oRZRKrK5h@ZgprQ~1k}#6;c5gMB4lVy8cn>q^;2-1sV$xkrDtc-qz?cDLqBnG8?FJ?9>Mj9{=!h9Ct(i)1u0qi_6ymV{)Rsb zC$Q_6wrKysLN!4D%emA49Q*taN!atpz$rUxKK8$#D=-Du=~=*?*gdRye-yqo{6|v! zf0&^CZ+r4f3sRe_&1j80Yy6uaMq{S-+bWU{=g$*|FdzPq@R$T>FW0o3W=qzpq(M7 zcZuGmm5eAj^QJemfJ!dmNct|Nn z{9$7`=Sjq4eZ~C8#-Yu+yu;z3Ty%6s`Pkz!A`x$o)R4HI@~p8n?+k9TX)pTLgj3q> zKH7%8XN&fb;90cYO8IhC#*P+O=3JY7hVM{#Y6A53Ft7eCMY)Britcn2$?zF_i@y)V zH_Jc={(fI#io|XQuzGN4w?44)f_W`?UGuW4Tzfef*+*W{0-z7?9-Bao1+yi_6Q(X- z+Oi=7QSv#JpY>Gzm(ZEc85(PKiohm9hSXChYW~UWfrxeO@C>z#37~myx~q4dLq%05 zZnSaG$&sr-%W%ye<-@DVp*HgKo|!h>h7g8&2hnxEwi*P^(p7$iac|>jQ`^c_hbWVs zqLJK$igB4#4t8YP$M&lnnw}>B2;MGUwR<0t)Q7lI!wsd=qZ=pC4Q?B z9nxv#RzaY|ZXF>N$A$@S@?&bc6VJD;=*tZ7`95*)8AFB4@|63ize^eARkL5>Rtx^O7PGkocAb7h zR`Mr_<__$=5u-Dk?p5BMXOWU2-z*Et4CYKL(&|1Qc)9g8?UX>^|0@AhVD06&-$6nq zSA^r$t%~Oo&=9c~eB8;S-Q~BkKY6MPMAUsGpFb@aKTbWPX*kJq-Se!uHd$JI-faTx zDZa~A-TEP?QKn}?Qq8Hq$-e)>Sy;1^T|Ta(3+ZNhUfp$Iy~)DHd66PI4{5d6wJ~xp zg>Bl+C{FDMHSDpma4H*BeWd#|9u-lA)+kk4%pPESc8J%|GfFerPBZ4?;p26e#4Yaa zoMCKJ+zV#qTN1KskNncJ3hc`p|J;L_OJ5NFEr{CcYu|QHIU_&ZJYbIq#)-Hqd&`fx zE=ql0jw-lMRH*(5ae6>uZ%}~6&Edq**vX5$2gatN5~umsUzQ65b)p@o)81@&jgS_f zVVUXCV>QwUyMbibSdoWU68|@&rc7@C4mGv@FYTRoTolck@6D(r70F3ZK(Y!55?@4e z63JOWBSepV|+FX$66{l&4Ok zp7JS#F)pZQ%*{1$NCg^O=Ey2EnW?A)b;!z4tv!ioy{*-SfH&^!hVd$Dr6@DOT(A){ z+6U0I<7$fJZIFbO8PE-deS72tR&lEzl4`>V47diE2CSXmMuH7oSdk+O^-Tq_%97}A@*eFZrVCRM!+>%?(NxL|U!SZY=v zo7_OMq{K|a8lG7;!4g<&8Osw(humgY$d8ZDV#)aePrL`h?>B*bn_5a*@dJNZ3rJzA zv&eF&FiNW^W)iVdJzfvjgo12Ew0+)U!s=R~Zyjzkd7J1?&FQ6q#7@_$e}>b#a0a|Af_JxC~ru2Qti%7Y9G~Wr}~1`JIh)8HY6c5*G<8` zaB((d_YdZaGn36VWw-)PS&jE&7RbWWGl)p-X*xxfo4j{(La5<@-z3i^X1b}}C>3Ex zh=n}xii9Lq`I+?fh+C`As#wbeYuh-%m5B?h584bGM`$&dG!K>Ot2LE`3uY2xl*G>J zW5BWh0#04KyJ{hJxBt@@3u3mbw~UMX)E&}NsORp*my+~->}y+z`2+m=exlFYl>%ru zYAh4X%FEwX^|sS6|6H`-(eteEe!fSZF>KlnytntcVUw*N+2Rw}pJm9dFJ5mDPaG`- z4)P1V=@wOu3;Uqd5L>P#NZE7N^TD0vljQ2^5mCQ|@^*iuvKqzJDVmKx?7@y{(i8C@ z0PoG9mUrva^j4pFXC;MrJHg?o%uy3n0)Xy9;U|enHDOFU> z>$8|jxg665Aa?VS?xIiV*q**m)T=1p1-WZ&YD!a7r~9z=+&33uJ!f2b8cDU^;87DP zM#Uc(IItxA&hn^wrw%Aa#5F{itI$1ZuC^NTh0ckm9IJCP;iIH_uo5?cyiG zo-bh)s$y!}5VTduwo>#K!HE;(u~Ahl^s+mw8e2NqV&7o)#5eN>J{%~zG3Y;DxNBJy z7zk_Xt_W7&_SzmyLt@uTeYhvksmk5;Ek4a^S4ekP{y6)|#KuB|BaTHX$~s3bUv9Bg z0vQhuE!?`tT;g*^+s%{-_H)SAIah={^0&y7#(h!h^_U`J;huWCDU?7ro(;E0nWo=e zIQeT5R`ah&SWwGP64p8Ly|~D6w?8j%7#w6*;0RJ5PP<7X`oeeQr6KdJ!kWZzsrl-n zh049og!v;-8TQ&m`NR}So^v1soJm>Q&+EUm1Zl0=MnbRwogprHQndFP&DDh&&aLBu z4ZEY5Mn}{iurqv9m#J8ufk%i< znTnCA#r%^-puiI!{J-H}6aGH`YM2*h>Et+%worP)F#~jW*l%9t}3sDsMOuFAW?z4|!H3he&&WXW1^}J&389A!{d|$vRu$N#EWBL(reb=vzmom?-RGL#WfF3*_0#X;&ZBXYg=qts;wBlNDd(^ zR@>e*jiE(W;lXlf;9UqyV?F%NfhWe|rV{qR!s)u z3lSUj-%G@5IoEazSiYi6@8}v|*xJY6dYza?KtbsIDTZ441E>oPPfRUi*oC5LG+rO_lD$hr;GY%AxBcYO55pw>j4!LN2BpNMNFyVt2;VV1|t+|xGrzNrU z(#fEDj~r)H0ZVhwv2*p)v6Apl30GkbeGio4!)*%aiPkY7qdss%+C65J9C;-Ed=fz@@B}6s!LV}AVKIMAsXTA?#M(AMF)7hn)ND>qo0+okM5M~X zKT0cesu>%ZW23CgX7fqhUqcO|9nR4^S&%j4pd+#K?GJwVlvh2|zX59<*pmJxMaz}) zU!rIW4p6kw#X~85o~9TNPsMz>`Hy19$^0hA2maq|+Fl152f1rhCpCHTYI=*aJ2Yb3 zGCgpb#pHgLK1a*6c2vL-lZ2S4)$j$QMp2fL<9yvAeT`frZ&?Q~TT9q!skg>4VsAhj zoYOqeO;|mbU~MkruNc*|v=O#@xeBsbPo3oFpM3<${8C`WJHEybBva*tF=PnK>|~ou zY>Dr@b5($s5B8bF=W1*!=(Zl_j*;p-8#KtrtsV7}6T1y&wN(RoElAq1U=DwApw0=I z>OS?+QKWBB=7B#uGD!3By>G)u)E`>D>~1id0Y;_*zAvQbY7_`C^kit{+?^AvgoPC=eeF$L z5rWgOq4>b)%n~nADJY~iijKRV{{9k!yi9p@lt*z!QICLZZU3#+M{TWd4DlcSQI6JN z_pdoxCtWX&BbS@gbD|;-XOo}jAUS+bs`z=Vn8U^k)XpVDhxeCdC)88*xZ~z5X2ZlwDRJ2w!v!q+oan;W})(HNL z52htY4m2a4Tszr$GzvSsCUv;|?vsA+diMRm+jP%ZUlxH-bU%0LN;qjb0-tjB-NID@ z^S!*H;^jr<%cpd?8S4Q^!`K>f{bfX~ZtA8V&{OvYp=Q)SFclO)Wf)$Doa<{6RPY97sb8Z4&1D9~W41~+x0U4rCr6uT5P zlrCnmrM|bv+TM)orsi+t!6OxfU#+gu_xT-y8<~!Hi=nNk$l%W?lGX51@apgw6fT=Q zAY_L*FR=?)!<)Pkf1|cThnJ+5T1ZN5D%3tB81Ic(*#1I$Bob zjgkOO_xl}r;A}Opbb<~8o!Izfs3BJii(DYX=)hmD}ieHGlh1(~FE!EK^4g*y&;ndwla$^@7pIa#Xa z8{-*nzquO20I$LYYj@3Cw)flS7#l;Mk%8&<_{-}KNp~#z;HK0R%=h@2F>U}Y zFHDO>*{J?h0Q18AI~45O>QV%`*HhZ)0Lc`2Ieqe+h8u99L27>MkOo@ea>MB-O^(f> z98G6!#_99e^4Zp@Z?{7avrqWBO4Jl?YAm2WTiHALo)AoiJ#Hq$-xSY!-zCm3+ZPz2 zjzMI7n)+j&U@|~IO$O&f+o6Y+%()2u2vxnq?iA~s)>N^t3}aucp*A_B0#_i7s)%a< zMbSa`;ffSYrMOH<<`;HTTYjW#;7;iIfsAg3%2;?Yk_a2DLIK-gG3RewpW_e_uCuoL z&ca_Lz#f0?^Gr;!Zw_1s42vwXNDO1pEEMXCK7PUFHEC5q?m`!n!}v_~3(o5$;*h`U zSS5PwmPOOm*p*JYw3{B;i)oMYI~n^pE2?!;b>kAf;^`jRP1ePGl;u+91%{WkD0~#T zC;ZHX;MrE!;i|G+VXvnqd`w@he7Hhl4Y_;ms(pB5I!mXVO|T4QJgc}0nLf&8=!UG1 zn!V49v?~Am)YEGMQz4?phM%bBX(g=Mi<9fSLEb8v$MZ#Dtnq5vmaiD3 zytZhXs%PS8EE{;EBTr?^o#}V9`ux4E zE1eC8cDDtxi5o&qZ3r%^DHRQ1ZB>rxCnxdQ>5x!Zz#`v#>7;FO^mEa(3s)ppVnn_4 zxwmLYrSmZdI%*RQe{{2>2#y!P?cuHZ>RPB!;T>3e`&?8H(C?a{kRPYSr~Wx6udguf zm>8bOO1+h9Vh5p*T^*a4gbO6n0EtnI4nD6I0=~XFG|fvpMh18A13li562INvok7c- ziA?l|3{73^czmyrho?x3^P5QI)Z)POf&KkZ(W4>f zmvXJQ>NTz*B~+ht$7_h^wY_TT|9XM!zd-rMxeYJacN0XQ=~qPLrW+tbd;O0VQLQxg zm!sn7)6dZ&k&w?!U&3rnBuo@Zi0Kyeutl;nw&c78YQmfH*OY)vW5P^!seCP?ky9hm z!kEX%9RVR$EjVJxn_Qqn2|p-a6R^TI7cWd(eqC*cv}7^7|cETufX8QB**H10S1qFNeujifzL@=0^eDK zAL7n4A>QjDkicW={b9$b#DJn&W#Qb$?`Y;$P!lvx(xCr@MA`G)+U6RDdGtY`;%q@} zt>6v3v-~o*uzn7PbY0Bvg<<|)&q&CC{J_CO8F_UHoE9~bymsL-U)ou<_68Et_$MpO z`Zrl&vVX%0yHxxGtgzT$vBG};%nCyhxQh!ZPPW7TF4|Y-7sPQhy@x@U{A>prKN9w+ zO*igjxcMxvTy(4hvKNXHWENEv%z}q66kra_``Naz0nMb>j1?!Vd~ib0sEEvriJZ@x z<4sKzu!;5SoXd|49Y<9KU^*YbVBz4$;6 zkU5*HInC47J+!PO#^kNT#n0VGt0U?o8K3l^eD)*YF@P6^rq4h^&GH1 zCo;$bLxxW>jY=iNpJx;Qy7|YqnGYF(ceodxAeLif>wD*-3s@_}yZwpDrXRJ9%H~x+ z0y~Dyn-#QT#0Tt36qP;} z=gJRUE6yIRz_@<&;#bBlE_v~*_&lEDL&h#oHQ2;K+(|I~x;a_6L$J7Z;y}1=o zK`x1axWqLB3)#_~@T$<*Yfab25=ESt}uOh!?~RffAS_ zYS8xA@mPEndwM!y#X5h?ri<=X%p%upjcN|Ovy-WzZ$29sh_Mw$7GE;9D_;Sr^f*O9 z4N`X0Ya87+JJ|Lsv1@)ukqeGHhf6j@;%>S()&jCC>w8hQkVbSEySkY8ACe{Nb=o`N zym6wimO2MY$ISF+>>am+i9OG0!O4Cf0=MgqHg1?z)-@D8^L-JKc0c|r)1Ei4o8jnm zXX*@+dgpn0raee!_uKw7+OmAq7c8e6;M;OKUf{6)X0QlYCR7Nk;6dhIt6N45VV)K2zsPON@0ksG2YSN@(nTQreTQUbhV;d zWqU}Z^I2r;4QIWALQY_q8U#1Sr8cq%^#ajk6)S zHh5)q`lc(@Kp!Y-AJg<^ix3p%A0(0+0u+w}c{U6Jx&|(RwT(;(QjE2V2f8w^G1(m{ zl=?30;q3Rg1csbT2O8ZWdvR=Q7|f>|TS&uk1@+rMnJ~SRS7{z!EPjd=t}{LvvyzwY z%Rh9b5Ql%^Oy(S$ZekPZiNW^Gr}a}IdL z@3Gre^#t;=sm+l_s=w6o3-f|118jV=JWxCH?pwTCg13pEsI|lh08+%S`79BSHtME2 zKoP$r7?)&gls>T>mOUs)71wd#J)38hRL_{2isfcar{{n_gt;j{Me(N@OT2Aw?(WTp)bqtKVlRIRd4y!v`buu3c3%wi|WrA;!BUOGi1>u}s@jU8U_; za+|4g+^|PqeYkwb=+9=M@^7%LFVoksVni#7JedcPx$IbXj3&Sboh+1!aKLdMDD9&(4!Nq3)x)?vDPCj4kyQ9QK7%nP488vveKm+1Fx_ z;xETO^8xt%c9*;-B~tvBj|{Cmj0hlwE8*KNGLu5pzF_b1q}QTxdm$Ztjy|PK zRng_)`fHu~$y?OC0GA1eGaZNjB+M+i%t01!Th8F5zpr69sJ$nkal&6aIrf>D!!vFo zcmR0(Xw<X!Dk|9A6mUJ<$V|^p1(iQ~)0Ezgkr7iXV|wYQ!oY-JAC2j3$MSdDtRQ1kt9&+5xe`syTTo2i$rj-a5) zJV6h+)-UK&k!y&!*r*FWJgLVZvN&{-ANs|+$L*%Ib?EDE?&H>QS++cPH)x}hdA0zJ zYae}_VPTK7%!@Q$uyZc?j-$>@z#CF>OdCl6I$lgt4W9a-^57a3xHLcd^wG(4fyJ=jw znz565T2l&^Oj_qyQistB!Ol*tvfbbdxwqUl=@1#5GdE<59GMwt)?0kv#bJ)C{u~uF zt_beheAsQ87ZuWiWi=g&vIkXqzQBw%pB_`d#4ApEk_NPqUHg-#QGmx@^WoX@zG&6+ zqhiHl2!qA^+_mvK7h3d`PlBg+H*9ZjY$Z>=Iq9U)0?+;owk=JaUd7V5d^3y5w`;Kr zh4flAkKKtjTUapRO-w~^aBM*P2%^xN#VI9A_OV(d%-KkqaygMx<}Ev2{+?-VG7U@4oTH~$W|>& zH9F1l=KKzNk0GN*&cV8G_l23`&~~IQ@2i0`qpkxHDHp#J+&c};^kUldb8>DO=UGE8 zU-<%FVd}NvOg6T@xe$&wZ#gehGyZE;UWR-!;E<7-`*`9o!o;O-5W}#v6{z@^wSegZ zvO)ebYFxem;CM>%k?ai-@p1rGJdeH)WhYr~;rWpAV1Y;_pVbU9TvEA^u=?R>QU1VK z;C!>}#^*zr;Bk^|u50`g6+|8}bxMUbe(tQXa^G1;WM4~Stp3~HY3W3QPk+J@8WwY! z>cT;JCI_iMf43|v+uiA}#u4;|h&CRI{!F#5U0N{if9`U_b~kxxPu30lt#BYycx^aM zBTyCBs8>C)@!49)Ux@X=+u{%^`>5Syzq~cup~JfRl#&a}2P#$es!C}`QI#%k8T%qX zZ9_9M$wxy7l1guAHHr${Lky^(PhY&(Tn7&7J(hA@4GJwuP(7}_%mgmELXom}wZDU| zh~1$@D>nbe^~g-Itiwq$t)KS6LGP90mTys5>0UKbTi&x&Jdyua?r}6{ljSz_ zqsVo} z4=&TA$@40x&TW5Ka8ZrXmAj&bgY1HPc59Y~lv?ZSbSx@j=k|I<(psPJO{COr$zA1L zV>rwTl0WFmx!Auf_OT$G0qyWIof8~<_f_s^qb2!UqIvmtSpOJ1rqssUrkUsavYC_@~;6&@e8+`)TOdGXJiauW(M43NSPMoy?I4JJNssV#q2cG^`(YyWMfg;r5P}QXIveF*Bz{rJJW zJB`c3eBp|{{5QIiA`OK2UW5CM}l zmuQ8H!hJ#GdRKmx!F^C@?N*elSNFS|iTg@O)|MC{PJ%VYsZh!C=SP1veCn+ zyI$Vk7Uz}oU=3O6pyiF3*iY|ee|4n>vJ>wHQl<6B^4%U{K=B<66@&3x2AICaqierk zSa{&@U5?{ecl0YyD;v7oNi}`r96vWXlMwQ1<@$i* z{8iTZcTsFRJ0BS(T)kkjdCQrMga#!h)@Iny#oJ#)6?t!V$6g8F>Jp&{r|xL6KLrsNC-JIduxSS zhWPJ^)&)^(X6IY1f98}Ge)HGS-;P%S3|adpy?|fI{+nI+{{DRWziKmKZkSV!KZo|g zowH-8)2{*l!n>4F+22S1Sa=WYS9xVnD|$#+UeZ;p=gajQZ+AaEnRgj$_$BMGjTl48OWanxWkyC36{JZp7!2uc9ZLG!<%)bDIz&Q_8f|RL z48|T09HwsSVh2|Dd9#`e1*RA`riisXy=_OS@lM%LRpa%2n_2`S_@OfoUD7`0|* zVm$kL(m5<8qNCIBqk4_BpitJO&U`gSHIqQ?^fxL98_=KF^OQ&)Nq1W5$_j7WFd8(z zb`R;*^=dJosTSqTt@zdE^R6Ld`4x;!fSpL{X<68uRa*czRU-aG;UbVHWSW0w1cf>T zGIBp=w5w8gn8^@FtN5h}?gJMN4>Y^1U#O#ae%x}^jkC(bcO224#+nWRtJvB8y%qYX{hVe;>K!`KeCm{CZfxW6n~TXrgCX z{8(hbZNwR;88(iS-(YALieG;@o#TC^HCmk(q*XB5%i-(g$)`KYz|Ud{IOdbUec%%M>rqF( zHadkbd`XC7ZrJvjS!zSEh^xQ3v(u}(L=q1nzJIHO<>i3ourx@gIbPMu( z%C#AwlU*F()iboc?0||iVoTa8fwdNWZV7uX(@b%HIs5I1hBI&;N7H22m7g!V<9Bkr z%O7Qh-GmQg1_uX}0fF?Cx%A?C!Xj^mQpow0HCshdN?%ax0(eK>tf?}8xfFVox{n*t zR$Bl-?z4dYHJdY23)u8aq8*v$qd+i$G%<&*f5r}`Yf4(HHsaLKstsRzggRYoD-gao}=HmUUq+@76vAzGI zSvQ7=V-PqtEj&S-MgO!kc4o=k$4o9X&9T&IWV!1u5y4I1)->lEwXS!Yf!y0)R9SU$*KnXtd0Na_ZKfauJ=kVj#7ot?6e7v|)-eWukuASb_f- z7ngHLkgTg(tjY#UFnQ)8P9+Pj_uXQ>%3xeE(V)zfKEdy)ROqEn*QIB34zNjIAam=V zlw82hvDcb7*z7aNACajT-PKHQl(6dDAyv+q%b&)$bSvH#bW`keGZ`xxNwtfGFX&1L za}t#5j9d#3yv_F%`f(?~9_1;|Uikc5S$|%&yY< zcJvEDjF|8f-FC8T0v&vKhTX;bGpaZ$l-B8BMr;bP;cx91{77bFl1ZZd1ltu=fB zj^9SWc&GiS%(vL5EVhSW0rQomB~&PIC6Ax9CD=FNsLo=K3wqTGg4h)D*2$dz+s%L9Iv= z5^U)X!@oq3S6HE+o(#=zi*o~zi@A9gb8j=xfbk(66v|#}gD6T?-_zCN&)dA{#Hi#M zgx%Qb3zf(A{_4F?E_FqDU12|1Ms~WE&`8-_gfk`RRS5hb$g!)}%;z&by(~jP@to-T z{?R)6se_ZZb(^&@x#s0EGqqQ%-OmDhhRJ(rSbf=9{oR!G$fu*TBNMxI)>D-NHBVof zyz(ZOi4Vz0kt`}h>kuTL;+>vP$VA-o=g} zfr&_YT0lPtk+Qy7`uH_w>7>NY)GxPcsqlKJK#H;ovyN%lWPtOJ+>y>teKMIJBPJml z&35~xE_CapzxzB%0gf5qMo-ju+QuCVN`B$qv#|~pV zGK_bdEiw+anL*9GJLy7zzLuo{aLsdZIz}7rI&>6z_T~PfhXb6;x70#s#ck=REQCCh z!r@{!TvEbI?Xz1&1l_iKf3*5$M@M&(g^0&Ak zsQ#}pzFaz{Xuswd9V8P!+-IpsQ%d&j9~Mef(^{l^a> zmot3oK|x1MZXhiuW&GUESAxrEdY%9@Z2M$x&ClbY9k0PO!H7o1T;JHF$}%xI=@X9j zaAew#f08Q;R|{J+_4nvqZU$s#N*rc-IryQ0s^;r_kKcSRtva|F*uv96F6-q{k97p> z)a59XIyB`W&3VESg0Avc)J~tIo~*u+suuV7peDFOh}LXTujasmO*|tdPAG`nTJYDU zoQ8i`KHtq_J*0D@X+)r+v8xH6L+KVJ+;b~Lw9gip+^lnjq#x}f)R8kAR+_d4cBy^8`8c~^#2$W`Jz8`)+ z_sip7KLoE=k7{&@myd@YJ`0$oa=th9YZsJw3OJk>xb~=th<+b3&D^?C#D3&>x z_!iDfBG$Qdu%!@x0bbrjF-O2kQs~l=v7r)>?{r#YN|lix#xwaroerw#bQ$^O0w>jM z;Km-Dz3;Li208NmNdedb&xc!xtf;`C8`WR@u?goKRP(!>i)R#d-y4(a>KB`L-ve5S z(g)=nB9;5d7%|WXdEtFo5@LBM^MNFm=MyvQxYs?mI0r>s8xbLza=33tr`~JG-RbV4 z_rYg-=PQUUDF4Jp>nC(-R}ruyADswbQ08pNCI{oSwFi4<-;?aB9{?c5ZXK zFus}K_G^6H0ks>OKb1gq5>>Bf(n*SXSL&FYys2R$w1UKh544qnnh)|N*~q+44*_zO zPF!|LN?kFt>zqAVnAh78tXs9s%oaWo!#TFhvBFjIOP;deMk@wNQ(C?+pq3Y{3dr~k zArjnRpS~65@Dy?~ETZqD5O;QqLrCqZR_xtU%!?g>`J*ciGw#J|R|XmEkYTQygK?el zt?KgfS4mIL=f4}UV1h}geww)p94B&X&5uiX);tWKyX+nwTJfDPcbzR;L}3q=FPgR< z9;X6=h}C(R0bu*lG!XwuV8FOtMKEKl=fg#0hpBA9D^zo$_v=cn(Uy|eCeLfk#!BZ+ zMPYe|3+nhmH6Rl79^ZuYIhC+gOUk{M&lE3epah(941Q4=jTp%|MR>16?l={ z9XPSkwVqq*14?uUz6;3$OQEa$dYUBg8L;LPG6#UqSXw_GQ+m3*TP?YbIr41v2LpyM zoG1A`HPw0g_iNS~r(%GZklL!NHrzP@1|X3$8<%b5623uj>+;qfa|WVdz{mEa`lQ_U z+?Hp04ybCAUg*y?I@2z#;>+NSaag{FkOI~CN>P-ZP3yi8CXH*-N)we(7l2>5aLGsU zg|wD_EB^V!%6nJt(D-n_YE%A_1#bAfmVos}E<%xC6xLFg{$rLlR?62hYg;mX^aZB@w11uV|>#o7kPZgM~pl+Q?^|FHHHd9n|Z?B*+;H zSu4WUJS*>d%ZID1J|4yEV#TK+YD`DnZ8@&=%>Ap%NIGjhzJ_`%0!hgXJOPv zk$I4}7FO3~H@4J_o?fdEd(Fi|O}9(bJzTvz@U7~0d!CG_VB6Pb=iST~B=84#S~D>+ zX?`BX$LrLs`VIZ8f>`DVzh`VyroTFb5#~qesuS7rcb?nEpBD$tH{#VD>mIvI(hK14*0|u{c);E+-em*cVk_$E*frPEDbza3 zcQND^5VO3CZ^BCzV2+V^uIMc|8t4~*s9vpUdPsR~0M>feZ&Ndk19Z&;VP>868q9*+Qb zL+*^tAu#X*X< zq(J}yE-3UM{_87Xuk42vGw}you34(T8U4O?P9Wjo~D?)Tm znbBVQwdmlI?mP8iIraWzOJ=C2SpT^DuUfo7j$vJA^I?{7+qBF4F;X?1?)W*Q{>SfY zr%an{zmNW|m=#`%kO+^ryjONiIJow+6JEaX>UQ+f_PjCq&-)c+)n1f8fBoTq0mO>X A6#xJL literal 0 HcmV?d00001 diff --git a/docs/images/lan-logs.png b/docs/images/lan-logs.png new file mode 100644 index 0000000000000000000000000000000000000000..adf209dc89ec4ba51ea8faec8e0da6ef4ee0cf5a GIT binary patch literal 64450 zcmce;Wmr{h)HO<{w1_lFNef7KBb_2G-3`*4R5~T3yStlBcPZW7vFVO)`8@i(-+Rt= z{+>TxEHC!jYu)#}=Nxm4F$q?bmqbG$K!JjSLi->krVIrIp8*90yNd(^{7*jqXbuz< zCe#NpVO7_Z!&GF?m*P)XmLi?en4MVi++zB|+FO{~pQ8=&oT6pO%U0^Vk?fMN>zJ1F{7ecfq5k;Tk8?focD)=@u?KmxMn38hs7Ic<) zF{!FPGc|STvA?@pQo_=C^7|ju9E$|lJX6NLHzq6 z5fr|cT>o>6)!>f_&|39*!%3H?P0lN6{2m{%L>$ty#6vmE>~xfWS*z>ms9^o`bs|#7 z8}t|D!C#wBH@}Zv?K`U%e*`ltWd*zm*c8ZDNY|~}9NL>$@j7nIFR=gj2}RC)I+^Xl z@Y&ixj|Wc|`E?`9g>%@OS3KSDQ>ai(((*KinA(DplsXb8P(e0_IuCA zA|KZR<<2gXEcag!a&QraZ>)BRGPiNrpKq6*IseScwFRd>^iy~dyl;@-f{DiB$|88r zGtsK0XuBhDU-Rh{kZkd#MVS1n66N}QgxT6bkOdFz8F9zzO;3)km)a>>pobe^D-NcLzk8qt{@ulw+AvdSam?JVC*uW58yVWFW!ihQ zl^ZnjDet`b9k+*D+|rpf&Ws0Q>;<1&z|wJp3WEIaSt?Wd+P&}0QJruW(!U(dqiyg! zpb0RD$*%gCV6i!UQuGzQ-Lc;k^@UC3wO?0loi6xPX^<;JGg+bm>n^FONf1E)lFx~n zmLz>_rXB+8edAvnaRqt)bTqGieQ@nFEh+GLA^3Z*>cN+`iw)5YRx54iiKY_Hhd22- zISa#%7^DJcqrA_$Z4ZQ#m{jq@n)$T?nFd z9_J%265;MmR&%WJnA0U1E7_92{NO{=-1i|j&eJ84rlToe)9p&vx&n!KoLmoQk^K=d z-l~@!_D36LOwk6$sXM&!tD>Zg8cD8y^OlIrb2IYq=@bcMt~8mh+tScVDDL7tnhNjY zotjfQ$vZ=QXDfJTcD&qrZ^w{cmvTY@T753}K7tSZb~P9a*ht#e=oI*(5A&{rb}=!Y&hC($%%ub~Gv258bBM{F(3(-oQ0yg`Qp z-}Ce2Q-LhzAk!4}DXtWJIN$0Kx!2}-%UNwY*3~gviGyi9qycOn$_td}=o=(#`ot>o zYC&1d5`l>DaIb?>b=-jjp-zA7>mEFryGsu;JA`>(Sg>pgSFLEEmYwC>e{*mU=?d=5 z{h;a)PX+hAOh(h`K!1t#kQc5+SMnffP9BMj46mWR)$)T22A>^s?^z@<@6)`cE$DJ; zX1n|(vYHQtXhz4yI*u+5cIR7nx7hO?%23X4KQbfZA$e%}_ngf!Bb zvQ=q5VG=|;PCJ?=r`K}hjYg=;{MCJX7$44N5Fc2_*7XoNlhrKaMGuJHGU#3plUZ!C z;Nua>!b{-|SD*xL&T9X9b0Cd?LE<~5r7 z-%Q>Z1fm$TpbpRw@h9CKH$y}x3E4~@qR3(8!eRFjCX2o9K>}WP7q;G7%mQsWe-5S3 z>@RWmmXy=-=E;FBMII0?t32_D>tmYL8buicUpugjlZ7fCgR$Oi4`SLo& z84}T6cKVPuo@bWK@VLGb8bP5aRMqQSj}dmTFHu~4d>s%R^y+1Mv!@ELyPs}%9-nW= zyb&=#IUl}DoJ{A*$*B5$r%{M!PB)|H%0zlTOAu5@;WFO)#mwt$!OX@Q;J7o&s8!dZ z-*tye|Iut}{~Cu{cCOZPEKc3TwlY+qpB_`C$pwO-2EYH!ny*-`7)1kGZIGWk=pg|4 zdmK4S!+94*^2ttXl8A*HkO41dfa6^PpbZ$jP9V?SWCoHvZYB7iO|j0vo<+rfmI7tV zCjNp&xDb}9v0nJ1vN67o&~|ln4>g7MZ)nPTZk2_(-Ka#f{gUKt-OWd-&4zf>KNk?f z3=2&>bYtdmi$oeWnEApAv?hncAUx@Lp58_ZBsIHV@_g!6E7m;)l5~W=b7Zq?fHbgn zKd-L@{;9seA~MH6_zrRk+4!7(%#l+4PR+UKsBnF>-~u}BF=$BVaYo6WyIykP)CP_` z29U?pil?WZS{V;bCm*irXSD6b~DCvKZT7gEi8oPo2{H1 zqQK9-8K?fV(qPZLK@U2bE_JLn;S^E+nV-O@WingQ*BhDs-s38t&LctsIX^%s6rbNc z;PAj)zE()bYNiYg{efNuld%s*S`xC#Pf*6UHypPMPInIh}GFjL|+pUG=5)`M5MDS=SK|8kGk&WXTUjpTzOtHO{8J9`z-ia_mcU&_55b-jIP9{ zy}4U+NT{iqx%2*{W`o^nfsz6#kJBegY}9HKuNJGhGZOw7yBEH&biJ+DPw;+7ISuV! z=^BXM6X(QcNeGKs5+!q3ldu>#0j1xFw}|jxWD6&06yb>>k^OUFMo+)vXvI6jpaHm#5A~E|K3ucW0FNGjs&$a|kFq#EKa>E^TT2q?2jn zx&K3p$X6)W zx-M-2!5c`f?n!kHCsvm==E(=5dna*1*z5z!pj$=19Ak#VuJ;$J)jWo1cS$9b#HdSS(N z!}{EskoU`>=V7J3=(iW|t!IT;Sy^?xE=Pd<4n8z+yD+00)(TCBMFhEBFL{@LIt@1- z0>2x;_08UuDK8kpM#5w>87@)IbqGYS@9vE^n<^4_08j}QxsUbi$x<*5jYOC$3^>G8 zHG4)knMo@=joXo$pIGnE_ZPmt&1Yk_=Nm_QI` zsRXlMMp$7Lfbx)-w&s=6b%Axi%(flr%Pt~4&AE%z;u9(NyjQ(>Nk8DaYIHJ9uV2?hZ)^Vyio zS`?qoGgMmsgdT&#Bg^w{Z)c$%;<_H(Cnnag5wQTiKMv$v@!VMpe6}5kVJ>gIB6thG z9rGPPrm~4=%u=v|k2UbiWI^vOr{M_T0%|m>P3o=YTAcRa*gO;Qe`W|@MWm&Bp5aGi z(q8OFPiA(dr(~f(!;APoX=aHb_ZuQ19xJ}jh+q2z5-~fA_;g+k9HgOm#=tNbe&ee{ zg`ot6!^PW={HUTjvpg@05Mxn2Q{V5gcY6c-zj_AL`r+$NlsoM<>N+Us@D0*u*H?(R zbg}Ax+B*^9MAqDedfV%}16wyNirDAyETD>OKLC~9zjBX7DDH7EG#veWCm+PN5dq+i-mth#WOZB5uvy_Pqzhc#S3a0y~IM_ zp8?BrbiU?ug>pi4V;^uF~=&5$R0d0&AlyEOw1Q|ImBL?8!u zcrxm?xLR>golL!e4rWqW)%(i@OsTx9A+bLw<)m*;0Ediq1xAvc04)pA2gB@TGA4K#Ahno|n zt;Cv|8lX~aOZrkA?0DUv?vJP!Iy^0YRn>h(583$o$tUY^zqlOy{1kX|6T`XeDhgB= z)l$tK&(aTMwr$)~>%R(=9$i+vbZ)O9FD~?|j0P$V)4y*d+gL;hZoS9?4zE5EqQ}+Y z*D5=G7OC$#%~$P@w>x^Vcp2@)Rer;l?UiR>Z1G!D*`Nly8@nrxtlvdmtH$hOkt$yf z`!4N?N}K08kTDM!1r>X&Iq}g3_a^dXV&DD*4i$_Zk<6b~jPe<(*cvEAqp3sP(7p3B zWlQgz_us$J94dc@LF!(>X=U`fbE%mImlhkhu$GdVMj=fVt8>R|UrKRQU|!I1DJf$) zgvvWA0YM-jV<807fp!&5>Yv+72@A)=Kb&+?-@1>mJAXqXB>FX88y0KWuyjw0 z@h`1{G+_FYS=VZ|qJ!>*bb|bAHk0n&aKSVlXP$zcH{v0{ zKH|Q|!XdISHCV%GF)PItZlya6>@XZa^#Ma@Qljq$-zi-0<>`>*`A)DY3@uk@+ zs-B0-;Y7BDx?DIV&R_Dx{7LSta<~%mxmJ(jxJHV0*NcujRmMXKX+x^y*c+bdf8QyX z!Q9-Gfyp4#(w~3G4RbzzNPP93W8ZK|s|Uu9{1EMekYWjvH5{s25G=`K-P4QX0>`F+^GXu&vCk`dY9J@(}rcXXp9S?T8w(A9Wy(inQrYYWt_>z-ko|(zELg(g#vLJg@gRw*C$QJN| zQz57?;8dq*{&wl{X$8^q^8Qe-dhD)htJ~XY2=O2{!#-z6is&yNiH%+{-eZ#B{FVz{ zJIdhT?MoA1QNw7@su!$mtqev|dTfO&=R*cXAEj4XcP8QcCYgILwW77Dws%_h7)g?^ zr2L_py&)<2lEV?rhO^z%Qz69^$*;zePJboG(eTgD3X^?0FF(#66S#x4$!#sf-lr)X z+;_B7&*@pzdN_SPPjdVGfJgh>2L?MW`3*#Z>sD_AU-cQ~|och%W z0iCWj=N_z_?o#NK(H~(;$BmAm9Vp*+))&nF+Q){9?o5eL;-hYo#nQV9$So||4>}1QIC{>i zoI-bVPKNsZbMFnsr5ootYt0mE8wPO<=xPYxIS=d1#7Rkd($(PeSQPQ`KkFHj1`W;=MMRGekjV)J;KcGse zUJ(T*li;5Sb)g_mx7|ht>!q#~XZ6qVdnl`o1cb`dW8-8;*euvf>tK0wY;`K^fHYW~ z4`pPoOvWM`j86)dFWZQ{uV;!5p)3j$k-gX`xcb(dOy%mnd7L$UsTVl6XyqOYPinJMg~U?N5bHE6RkP}Sw_)uG^B6;EFewA0P{)Oc9 zS3w#3kOpL2ePn*hMYy%T*z1j!cyeTWC-1fszG<&B znNN|H);jZaRwu9ldhYAZj|bKMgitu|sV7fmGAGzvdM{Kv?2XQIF2!b~d>A|Hxlxsf zPb2y6#vy~-Xvbz`=H2!tH)}G{ac9`tlRNTn0XvJalf4--3l2%dTh6yl$?v~)enl1f zYRZO1d~D(DiZ`riHZM{(=_<0#Ws>LiD8HQl=T6(PLK}FGa&gA1@?=uZWl^b`YqaI8 ztPG6<=y#NGVdR>Zl-Q^}m_B4nsL4N7xYgeo?|E~oAI(F`R=Rt;DYb!mal~x)!c>1U zKb6m3zNcHqO$DsW*#nQ^`P{~T!*{!MuW*sx_MvC`cIbQ}?Lb*Y*;_tUtx{Y@`=rTn z%;x^xRoi|4(o$3EGvUdTZta)T2SYh`{@EOn(;q+RHLsg$r3YJjXzTLl@59XJTRH}e z>A_zEMfJ*N=Qkruesl+Gi}ZHmHyLsPO=f3zBwm**(pcHm8ZGt-m( z_)$~UY0H2`Ekv9~yMgULAxKKsfMvFo5R%YColP(__%d=Xw(W9aNAFQO!o~aPG(_;y z8YT2@cTgieJ^kAWSY1*lj;rB(iX&Mrwynvn9yHQS9+i&wumPFSyK5MT6+Bww5uN6^UBvR53N zCO+d?TmRDn%l`FCZQ!-@zU*D%?rzmjapkeJ z^b6te|6&ZG^+AmAP+;uU+!mGH4_7>21NpZ>%O~*J`$dyK{a1!z0;rdh@9$J>mfyIQ-^X3Q;@RQSt4$ywS)$D@5jDk zZ~g?(YV-B;>BDRy`tDAlZV?qyhoDk!NUnpmI_EYHxR`sMLiK4rGtnLmc4t0*9>aAkWA2~G;!4OmXhJUd+MGOvufny%fd$Uj0-_vn@7bMb-; z6*mS$dK6MmDi9?(rkY!B27Lr|v9gtyNqs087CcwY_6IHkBrqbT7KI-Z`$T8`Z}?~@3bK|MDwb$cbNuwUSjHcF-dO+yzcC6 zrE_=Q!}*XI95_@=u~W5fm__$;fX_}IH$0f`c!(!4^T4NE)hQOT*qA-enKcR-wC@Dd z_nH6gLNxY?TE+@5Ym|G2f3A4rxVtSIXRG=$a0@f=$PGRSR;S zfs$iN?VU<6VbHDxo9sFVLlL<*eRNDi-D1`h8x%}SdNh<)0k`#rVxt0-FCD!r{d0eE zF3fPwxm&%;ELvG;?tKV{zGc zeWB|!t{Eu6Gv5GuDuAu#{&M)KP&xO|>t%4ECfH3aZY7AnQU7cLa>$=pW*|Lf#=RTd zY*D05ooCX_>+tx78>UA+OY9_-dzfDm`A^TVsn7!9c28^*-|7rNFZQT3=qYR3AEZ^$ zg-q;#B*Q64l^+I2yPke(L|Zu<_J(b~VoVaJ)ibG(Gb;S+OX$z-+^KduLOyg#XAWdm zZuHc{Ip|Jx`646#^!ac$fy3tE1MU|QN8qWUm-CRdo;^F3Z14ua0Xg(E&Xq=)p?jX?Q$39jMLtI zQ?TtEqDtEp{_H>uAoiW~=Z77(F~0NjF~M{@c#>7Lw5hEQ4@hgh-I@q+kH+@>sba$S zW)-$80(gS0?w4n`_-rO&C zJbQc@sdE%O9H@DCg!F}}$RVY)wAsG*UzPukK^-NQmfwUwKo>qnH)`FW|y+3=CmG z?pzM6mZL>4v`}&OVRJ%+I@TX?@zn;!*qxCq!%%F4f1JN!xAcQeBYIrDOJX_f7SN_T%|ORlteRWpqPEdF2|J@{;p z9?rT6aag+vcko#&armAG4e0k;hKo72f)-DlA623vq`-KcM;Q&zbJs``i4&tXT zfTcx(UL$)SEISZGrPMdv9{2)3>jB{w5L8g_wPA!W{N@)bIGkCjFlor%52p+2t-k}z zGG#i=(jPOv6)U!DNKMAls+f!<vt}0vx=R4yCwPh!xRa_U0jwM>#UcL!2Y9&tSLx+~ z^$@8j=rhQdRISFIA}k?xS1+ZzN9z*5o&mPGtPhU_)2W!~sfyy+Uf@EaX^Vtc&Y?kc zzJf%SEq01){@Vo(3`tDVWktFuh zT40xmd7Rqw&rnGXnJa9TcupUB32i+ePW$Wb5H#xmT}5+op~l?bAeF`N+Zo|z=qpC| z&1lKZ{CGyK&Knm1UL%s(1g!z;?4~7+ARRWDIh*My5vL7N4X)?WOgSkNoF!Pd)jf}M zQ5X|-(I5M0HPZVbo0dLEGY9w8TYt_)JAb3IKvK|KcQ}D`uPco$v_xvm0+mnLwV=m4 zYPlpKY*w!~6M)Odq$vFa*_w)*8^2QdiP$sEw zz9;P296v3ohQ<;0V=_r>T0NW#8-LZ0lwKxhtHjwffyQxV_xZ(4UW&g=v1Jv%x>S(g zuS!rKcd9ZH6*j&Y`+BJH`-kE*Hb zz>jnqBz0yGzc-7LUH1`2ZxtQZQ3THW)zLz8@G{AlD=%2%ln6LRiv53wHLlr_xTasl7# z0JqF=OcXdpCe+_HoWguhP_X$n6i?T64Y2d909h*4ay+slsNPF zFh7f^TpurI0OKM$9_6cCs7INPA>3PQY(5kf5vVHf|$F)1-L89AYn_xqE3A zPm6UY*52E~tPSfWJSjG3+4Y(J+)a_aYsfYa_)ROq~Tv2JwRLTr{QzzV}AUNMBcEHxPq z#rMo0pb?mnXPf=Z0u&$$bZi`)HR1Fu@H!hgxp1?~?zk{ahw1Iv76u7l!J{am637}} zKQAw@Q?`@l0$p50?3K?8QUM}_Qseip4ewt^9!=y&a(jsawkXDLkNV8;XnK*Yu&<@& zz0S8sq7YyLlN@n>e9`@Otv@Y-DpXS&I=s|Q6DHeD#BE{$C*Plgyot+-&l;GZVuhTf z-v8-GA!epF3|1jLi?C;R?3Cb==lRHZMJy+e%dyp5vgm78BcyJmQolwhb0O*?C`v>Q zHf1<}{P@NoyaHEDVuuQa3hpELOME=+(m~{1>KOC8U;CZIWcCTQno++nMUAjF5oBPD zk+ENZoP}{-j?p=}UmenZcNf$2`?ikFWx(W^Fl;0}j5W~SZY&TnDcU-WlE^S4(%)3q zyqVedwg|JE%jsg3Yf?(=VUufG)V2xrU0 z#&wZ{yj73PSmo!EawdJi{?1?Ub`vLoZ&Eq*Y;3Obu$jEKrLSR+pNnr0f4Q;*Y7pN& z4sj5^Ginfv-D2|O6S)!-U;&yu!8?YdXOx-bJom^%0H`Quo&#SC|xIwd6~ zU{aZt#&E9_*VLQ`V3F!>PEJmHJdkXN)l)a|E3^QI3%aEShHzJ>@1B9Bo5AcefIpQJ zkTf`AHhwy|h*gin&Q#4HutFb4A++6YCksBEM&5+LUfcbKH#8OP5B}Xy8p6Xf?Q=v( zfIky&L@N6-DFX$oEVOutl2{C?l9j^8(f;zcc&j5NaJ^2mk&twBB~qBHat0)$fl zT~IfF78?2i02lOkb>;QF?a&hLgzOeMA~ZZanjcHZsE^sWR*w$ns@F}|I=`kIN3$6j zqDK0+vmS!27dV`QT>+GmfwU_pv1MILhn?|prd-c^JVV%^Vt|UW)pEMz_F_Uo-?Q_F zti1deWU&&b^Hhp)3NreBO@E*Z*_{O(#m+z-MFM~LPJNeke|6-sUzo2N;1g#vsw-Ub zx%=tid~6;T^mw&kyOs8JG%hwahf`0;GYzl}WYiV+$w^p8=i<0C2Lsxw@X93fCvltX zB)3@5_}c-C&`i<5Z7T#xz^$xQZe)r%XN&vw4M7x=Mb(EuD^|J*{oz{mHUB1Z9B&ac zA{I$_)MuuCVUlx>3Sd;=-x+~HeuHM7Z@&pGc)!wnwsa}^uAP)A{O1QskI?WRW_nJO zx2@d8G!nR>A7w!OB+`8fL!e=wbxgeVHl(U|n-jGkvvJour_-xVLy4qDJny|ZlEa=V zXwH)v6MdO2G_E!pkHAL4_KNx^Pa#g)I@I}GJ&OKPqq>P{uOX=3w&=j#wK!^ypt{M0 zfP@F+1-C7wMb<}oAq;wL4>jf!m@tR$XQ6sR@gxPCfm*VT#4Bx^i-o;wL}7F>gVjG@ zYq_+-9dZKb{gt0PU|a>9b``t6q2Zo>yX}Sh#IDGhr;vWUCHBJ;K(!0CmI;Gc+ilp# z<-JjOANpHhKWV#XW6rM0BrpM<)f_m#qL>XvsNq&_qp#?!(3LR*c<(GPVK66|8nQV! zY!*M&jk4G8zw;H2uy=J_7Epyq@o zIdD`NtA90R&}Wv}%KLf*H!|mIEo?GiU`+uCEz5l;1B4B1FQx5Um0#-Fp0N{){v`~~ zcUD)Xz1(r}Wu5}g&OHSNEIX~DLk(cL;ijWGUIRWBHnja-VmVO|9*vkU^iilZ*)|<6 z79Qr|Y~$V$VRtv)SX;p@2aX$m=^?pATcGh%(?v(>D0o)<%fY*A9A^y}Lj({RyXCHR zk61}%x1w!*X8l7{jpQbKWt((dnIb%(B!a3MKEIvf>qjADV^cvFc=r6DtQ^?>PTynJ zNneQu80CNLc)b!ucAMa)d3^!e%+$qGe-F1uLVZq|^qrDk(4m zD_8R-?R13kz|u1HUF>BKzVkxvif8O!0k8}vR5LQ~yC)Jnx`%W;13s5OMe!2(LX&ot zGSy!qB1aJi7uWe%d%4xiF979wwE_TP0=^SER=%9BAOG;aA}H+QApy0Q)C1OB{#|L{ z$0OUD6jtMqdlLsLnfQPv^0dEn&`Sd{J26Q~QzN6dG0d6m`U%Q>uwIRs zl19NB+cHH;!DwC?)hznD7Vph-!`?`IwyS~r1=ao)xz{@9U{k%YwJ|IE zv+%&{JA@*YkOY^_SPNah!VPJ3ZLI40aSE3I&Q<+fyoqOOyV=I@cae~SU#y`L&0I@W zsc>c$Kk1*`2+pP{l^C4oc+^FBZt%u=a|7++&FKbzo4E06yRWAX=3gGk0U23uwcs^r zz6f=hDtuh|?T+9xw?TJMM)JDIlk0Y(>8dr*itMwlwq7p-#a$c7ez@dcE&vV)Xb%Cm zp3 zSMPqg-=4nO0JMuhuSN&HnrU*joI~s%5d8CGVo?u|2s1K>!)z--u3IV^h6)869Xs|v z{$VzNdi)Qwfwb8SX_JwbE&_~hK*7e-^Hged*jn!ir59ns0y9`mbffGq=jbIv^>xMw(jzH}2I8kdU|{W(RmNV%~yGs$Q~=Dam! z)#Dw%Q3c4ObMo^yGL*6Ka#v=vYWDbIyC&JqGuoNc0 z13eV{lPX|loK*OGm>WM(CKM2TVs#k4*^ywLi`>{a(EUBzb!j{6*IKlCBIo{b!e1kj z<_-#hf~%TYGq4j`-fOh z*zC4P3#LAo5Z{BLA{g;_<$?Ta9@39np<<8CCHtEnHu|Z4{rUxvY`|MDRT)=1Rsyl4 z+5c9vW;dL3ImjOff7kK+-SQh*DXH;efIx~8I?-tJbmQlReaiHI3$F8fr=p@lp0SGK z9{7e^AfWjnOMc08kgEL|v>Z$|~lw8t# z-*36F^>BXe_9$@ZjRt_HnXF#;5OXY<({{R#8c9zK6NoEAPdwOD@kT$HvEP(lp>Tzw zg56zzGzF>K=6_@}5Ek$eyG7O{t~ItpMRWA3SvW=04QGQs;1GB#jNtCKE8PJFYFksL z=84Ye1&yYYxzxj@{BW&awBwefQZ}%)yFk`*D5-@q!;gBszFxH=u3E0kKST?VM3}Sy zr2e`g2Rz(D-H7McaH^;nDjAWd*E~)I1=w8b(`isrBvG0`Yx&}Ox>UF#J_D>Ig4%~aS(uUtFtV8*hlkHA3qNx3 zRNr=#q)ARO*(TeG`2_?7goVA(+7lkDlL7`+ocCiwbCo0uLZlt&8PWg|sn0_eBub_Of{0IdK7D>T<2f)Tq)YXAS_I$z&M*06Fsi+{F555$J*I6^VNi9w;5?A*7$HWWuhz~~! zD)509CBtB%fx9m9T528fpzCE1+r!yP_c2tO&&XZW+JG7M&<~o?aJj{etKeg4(lP-o zBH*vInk{R5wDjDDU zd1(y{3;?oAxy99<1xv0Eu-=6%uMy8y0=!p(8b)w%@UfQQn+HI1VL0&*cyBeU7_AtE zm-P0z8^y&<1XQX_b^jEFm!W#40tR{6Utpuh25oL`_J$J#S4wzYabmOx46jP#-!uz_6EP{hH{o& z-Xw5>MaBCFjD`XU{Puh&)YGTDeg$+dN$M5r-3^0;f3#2^xGVAK_b;x(re-r~@g8C< zHOlo=RgGnax`|de7s469CqgQ<%5^9@Sx?rQo|(RT6Ia4KTCl+MxSgG&Smgp)1|}qT z%YliAZhkBI-G)seH{_}%cgdlE=Dlm9+u*zOa`s7I67Jp2VWo;0AOB* zp1^$|_^%T0z!E+A2Au()`*>pGv>x57O05S-^8dOMk}*G1sMmj8LUsU#NB)$fIsru1u?RKHcVJgMOl%RYLdr;mFpzYX^`6 ztiG(j^T9%O7UjeFR|EqHTV*UD@S7}>5lO5apSUtD!r|2HfwhyS~~h*TSmw9XaL z2?gTArfH4rcET3Y7T z3+zoOTm*mxAUr@6CKnR#r-FCT1ul&(Ns;h`!WBY>pc8jOqczI^r2-y8zeQJ``*0gB;&--VD+z!k&JJaX;e2kDqC zF^wpmkuP*i8!FSny#q0Vjo7cw4T9@F{4Fy6w0FZ*qfzA{%zV^^;r7sF(>5maW zrk%+UhIIw-jK&=P}fSXN6Ld$Qt zKW+vhRf24)SRH&m3ZUc8en6=J6fl}KP9Sr{X9;~u1n^OZKjK!_Nk$N&BHD4=Juu(u zaSd7V-Wg5p-vMUS+HV3qfV_=}MgR<3lmNI2kZYNAnl8Q(+O*R~z4(SsOqV|faN7VN z=JH`0uQ68%Fr~X<`^yE89j}9d<0bDqoXT7O|3Y2CnJOU{oj5nbTLHT!Pa&>ZX|l;2 zj3?c6YDF2KKcX^gCEEU~P9hn0zxV-xPhZE4%ipfN*)QPLJ$BLMGqYLo=X+_u#^}<#H=B}q~}@l zaTBU9S%Dtt7QSQufP}|M3a0OChJQQOKC|I|3EskJ>Olc0 zL!yJ9mezc|J9v;;RyK{#4TuZ704QG^V-3X7&PF@!S_@p1H{9GBmalw$S7U)l?8rA> zhFi=OkXjX*MB7S_1pqOc{bHqIU}zK8%Uy=cgP9q7Heb5H^iJfIKmDa2_B;RV5nv2W z9KxL?9s8mGMt?ge64ZaBXFwD~}(M!yW zFbrtT;S!DNcqW}99lJfC6k!m&@8^>l8O>@Se=`K-ogt@DqU*JJqn`h&YH&#sO?BPQzB?qCz&*<5%>Oqpw|s~tJm9vDK< zNw3cu?4NHGE=F9Wxxm(5*7Ku35Uk5v?0!Afs!+>e*ABgs4e2W zG4uLseQhAXQo_3*!46mhEm;JqAXA?vo1Yz2FgX(wdLKXnR;OT-l43-|SinS(tNw3{ z=)*y-<*}}<;Q>SDCS3#M_1$^@N7Hu5I&T{uFOT8KG=(32Y%umVYQ>YcV_=k`(M9Sj{w?fZb&H2Q+k+{YJ0* zmv5+m%vCo&*ZjIvPH4$&u4)U&#*A#jWF0lO zDhX{e8l8TZ*nn#}_<#qJhHauqk!zQiU*zqlA|i z(qB380=?AcQXLr}z#BW`!CaT<$m>G#eU=+6Uv-YMKB+Za!&>`k>P_Z?|9 z$pn+3Pxgl2LTsFz6PJ=XwB63zrCG#}NmyU|N+i&EI6frMN*_I090oiW(Kn;DH4Dda z^THTpo&9i;FCJ&nQ-mQi-37=`IC)=!|HIo^hE?6QZC<*&CHJPgQ<_akH`3A}9Z~{r zKw7#%x)G3&Qo2h*6zN7n8bm^!#r@pg^E@-hyz_pTWBlN8_(9zM_xi7OUFUV4zXd%i zj*N-|N`T7AdVfDmfEpzG*!?4X9uKB*o15uNFfcK-x&Dm&OW^IoBb)|ugS@PanSJ3c z5&Pm6#?@QpRJOeyEKRnX3iHkm5q}IcWtfMD2Pg%$s)BfY-yz}U#?5?|2#m!)4G);~JSoiy1pw06r>#Cx)3#ozHtbgc-f8T*^gZRl6Y zgv6Wuqk#I|xEF)2PR4T7>T2;CBELF=+x=UXl*-f;^iF=%Gk50R?uGRFCr^pIwOh+> z;CqMT{NDY%YV`I@VBOWvOL`bjDstEF4E~kQt^9`+j{obPkTRdQts+cu*|9DlQPhuO z^%c^qGTRY^(`Lk>5rvy_*J_-znRuNv!qTPc)P%J`q2Hgq7}o^i6}bpJ`fge4&2q5O$BLBfcATZYReK($3F z74&|vxg48H6{Q3K*q+D8ccV03X5H??4om{lt}AWZ}Iu8Fn26 zCmo3=Y|CH!8?L;;j0-eC>Z+=`7Ibh1Mn>@A?qCG-E$&uEMp@9!>8T1GX1~kHlZ`>2 zZ(n$A$H-&QbmwU#`~jQ7@XElo05Rq_XjDPHd$`c7@#kNv>1Je$`)_NL$610;)}MfP z{(+asZ!Y662|$=k-2lgfp#9{%T!2tAEmh4N&laAoGC1mjBUMyXn6`O!e+3F>dTwr9 zC{Vbn4I7vs5QOi{vc0TFpcDqFP68$HG>+b%sc+@+)B`=xV{7E$4;)INloA$vecKN? ze#fgatt{d!>j=7`K+**5?efo?%avA7=2JhQxbpm3TduPj1ez9TFrN&>Qq| zS~#T}CPOF~wT4=uKOKJYnw9T;7tvr3o=rT{F# zY6;}1YWMqMK%xJL>W@Hq4J^Budu4x4=fyDo|APT1fx+e7fe;Ce<#^9(V~bqq^J9c; z@bSAfg?VJTR1DNX4GVxDEl!Iq1U<-3GvJG7>l|k_2d%=rVI<3l*g|eFKdX6nC`*UF zmu?;;^X9rO0+%|e%N?>q=N9IVsN?r0uZx9%ERIG3a8xb^l~jX z4Q1sl5%wGya1<;4aC&sKe-K z=AgNAmmXQtb!15CRcQAY+N@5WeVs`6b;ReGA^Jfp>aj^5FJAaZuoEumT2r=6akZ44 zsXX0lXdDwmn_1-F()8kD(cE5Ao~BJkdQ~L~RwYEv+qsfkkzLG;Oy5 zI;q=ifMXZ$z9p!me-afshBw$xLATO%$A;uy!@nU;7&kfX&cChF|3_C8&hJ_qYp>HX zW-DJ&uoIHX_;gl2zvWC6r<4GGB_>+1OYF>%f({#Si?j=n_$de6Km*;f#}E(KMVRXD z56yjruy$|ydE1+Xe!x|ulNJCo(}@pm7C`B4nh#rs5+i^Rtkx4EfO3e~0G%t)_&DxI zjAG;Bc%^}Q&#@hqP!-Ha2#gn4WOkq5|95dw4&Iyj|Dn$M?}>;{GrJ2i!OO9%-}~&r zYtG~6#D?F${f)Fs7y`LVk+TmDBx2iG%J(+0e`X~mbg^p6ZN4G~MoX}Xv6{Va$%rhq z0@Nh=qhs7}UqD|qS{VU4uFGm#f*@duB>f>Hdtb<@T#01}OD!eX^2IxGNGA}9boGcJIz;@Jk?(wzVy#diLuoskoSVL;KkuEdUp8q5t}k*2LQH z)OE>Ja-OeSnzqAG_nXTjgD~>^xZ!LQq%tXAJFww`?ITwzxFeU{9T-A`&!-fx6gi$J zOmzeXM7qpy|NRnJ@L3JqG%rpo>yIeP%U>Zrr@a!u6UgZ%K33RUJ)*ilIk8L}c zc9m4dWCY!fgvVy&uQp)s_KS)FWSajF2k(JHb_h8r#!CO4oMBTgyPkH~CL%CdfL%LH zU*J56=#QeaX?b^E140o-&Y>k1FlR$IE%OrrB0(hQf;Hs*77Pqj(f;6d(CZjI_(ce_ zm$fgya;G^@Xug2|Gujif#T+vc_>LWU^nz77M@U!dd)nAh~# z0AoJb?mz(>t^&G1P_359qJ90o_eq6>D}lwD_*8KVeb~_&tDcymivKn#AB*fn=Jn!= zAdQThXoV?U>ftY??+R?SvdXqF$BsCj9vOSl8cvAm-Ds-G@ID)%9k-7Q?3C>{{z(9l zXsE3FL|WuxC`uz8*Dy{E*J7^U+&T%}>Feoj3BMJN2&6)?x%Zs;@lB&}9u!=)R?2{v zRQw)Yw1gxO*j1ihX?iX6M=8tV37-AGU!O;j&;i*phY2kenmyDn6-0j3mE2I1v z6S@oB&U6JymxAV(;+z`V#y({qI@?UmW{rl+b0IEkmgOlLV`lj7+_Qyx#ATn-4B#lKgbWEo3BSLO6RuZ zy#?9w%PV=&?{ zs5LWv0p~KIqSKdg-Bh}pcyWJv0QD>RmW1KZrOq&OXc&!wkc6K!x?X)L z`YzS+V}VXln}L~OZ|{n$aic>%I%`fBq58vzhK=?FxxBuS^w^gKuJ z#pIq9Ui|2);1&4^6ybo=VP<)+be+avkT8@SJLFrC7mfWrMA!6dSSVa9bAE~thk1g} zgB@Q=3LFS0z3Gw6JUTx$Sc&(z`C*Hj%owaHSMkrbivitUK7zjlkZUG&#%T&enwrCZ+<+oHb{ zIeV|teFDNe5*GB$_B-T4Zo6Hw`Q=qEKSmVlMo-pdFuaYGRh-I(FDz$o4;9;B8pBY1 zk@hKTB1qBp;1)Dg#u5uy+dslO-NTOa^WE+MdoIv>V4bc$n{H z+1RP4&Afd6F{8TLt_&?=6zA|&m$+AjftbH-V)w~f1Z~Y4T8Yyy$86Oyp_SJO+VFm6 zM?`;_H>iO$OfjMos;~GKe>!ZPR9G83ys{(=D(NR512c}deXGk4WCb2e?K52`D$?9B zxUoX|iob^$&sAPpXr z(i4W{iaSOk$BBhX2LH;V%&>wNeSa$maqJVm9nI(JWG%Se8whh4#buWr@+*c&XGg|$ z2;d;zF9HJ4Y=sV5Jnbz*9M8=Z|98m?b{>3!`y4u`DV=o+>`}*hhtHXzxfQ-a^h{~` zM^lQlKf#D9xr$e2eo4`^5$1o;L)BNfj{&=NuURnoK?m70)12eHDJF1_qCf{L%G>=;Ww<8mpf$lE^4pRyR zM_>uw8oSVDN{4;f^Ru4sdTw~ygT?&_v!@9x!VsjZ;n=2892zEVTHv%PvTMw|TYgO~ zi>qt=0pFbj9{5tx1^mA3{9T|Y!<$KTI94F*IXV6MYwLYEW~T*SX8c|t52=ie4@W7b zi`wZJ(eP&uA$yKJ1wV{*qF{jGnaLgqSY%<3+zPQ)jcrR_1bmGjQ40g z0{uKAlNaob8WUTnc&uj3*aJj@A0S0h&!zfP&UO!%QUJv(HnDj~&YEL-i#SrpA*&i$ z9pk>IuUVbt3zrbLwt$$d^nAkgY3z$bfhEtO(awf z3m2AP+rl{+#&lyksbnkoMg-oktAY8MGjlF|VbbyJciV%2QRVyN#$~S1J32uY%fAt5 zFN#*yLKJU!xsMW1RVjY9QM@IgSLa}@1E?M`pZr>*yJ!zkUEce4&9uuO3PDCcvuHLPS?8H zPZgiix*qZrcStzEe_!0mIFj}G!((|m4LaJ4tw_wPNjbdXI$W6Ob0Y6y(Q;r zldY0*Svr)23EnPH2V++vHUuFRCAQRMB5cMhRXM!YEyao$hb%ApU2O zv~09b7a}OO%es~UUkeadaM$P4&Y041#IQlR7E{>Qg3GnDJj|g zVtz4VjHB(4g=Ib2a#e7<$%yCiwz!Y=`kuH92QQ47C{3%{S09-X+#q%^AC@X7bGSt{8g? zyG^69_I24uypN735iKLelh+!bGV5je)K1zyfij;DGPkWeh+Ocn=+?6rL8OkE(kV{q zXrZc<1fqrtcw>5O=*2)#I%GFlv|10_*}$^p1tSj&g#u&6R8VPCdPoA(TxgJm5 zyh1y|U5p&{VXwmD11-dt54ls5L^mrFp!`M`u~CZyO=i2wG0|<$t~@+(O*2|%pB;sH zg(~7NfNxldkze=yk)&IN^s!bl6Pc zHf>H)W>quNys^ZGf}4BlyzqC<60u6y&Q^r1lb6ziNF;b9sPUAS$0v&sbJ!acZwb&K zIK#+{GuC_F&(bJcK{d!uWYqsBsKR+}EM+@^Az9?i&Gd?DT4rR&5{N z6P`D)dx>GAU<33dCGvq4U;aYwDbgBXVW{QkR5+f(J@W<|_>QpeH?O@V3axrykzvDv zfk9#)j%#(g(;?#DX(c#K(lgScg$r;t3m5ysuaW+l3{Kgq%wwVnEo6&~TlepPm_?+P)j-!H~)<2q9IFl6fEdYC90Sz1iw?2+J$NS+nW&Pu!c* zNms|8^;3df$yK27OOl7YEx*ECu-<-}&AmZYAEsmM)x_)GCQMHvw~!GQ&oYWHqRE?p zzjz;g#R2z)F0d^nIn8y_Lwz-vg5=dm*Cy)C1Q~K%XpbVL^NmyA8`|t5TBB@^0l%WW zOL9k5ZkT;0YwQp>ssOleO>9j&zv**WO5CdCVu*C5UKP`sJ%d1OW%P8}Ldk1!8?=0I zvB1AF0)~uago*xY9FR?@wOI~_I>CkRH@EXIlR~?s5I5YA(|s~9$M^D^25wDnQjbtl z|F73FF-R&4Ir4mfSgO?ij)0T;+}qiJemgC&a+1!n%MA>CMpgtAg_sEQN9h+soDiXS zNS=fEnf~|ZUMg*g67Ov)5Q{Z(iYh$AXV+=+fiO&j#A*(I8_cH`9M0kH_<>l$iYGd^ z-DSeQPtBjnm7Z)oP)}xrd)(n(O2oIum~Q6JmI_O2svLr=eio)b=ZNn$1l3dUv=Di z+@*5B&LqTn+~_Gw!#6&zR2^p8-6ZFw%~|y2)ii76Sr)f^6-APX?tGm(C!{(~wU1?y zWNhSMu<-FC5yu5*aTYBoGGodq(;Q~%E%H)|=6pWwg;(e+>4ZYiuA-3)wQ6K#NYNe! zFbYb!HFQ2xdW5KWp4z-D?7Nv9isseY0RSiDU4@hTRW_WwMhBNG!RFjM_{A1Rz^7-% zeQy$3j==4H6raJ14EQQ6e#s#Zk}Ibs08}_+3~N~4)Sf( zFt0Iz+L*WzIS6BNw;!Ec43*0r-`+m+l`K$%R!d2qd?A_`a^qBI5B5>E9sD8wZJb7O zJ8g+jj#aP^4Nu7HWQ*CS;p6%onbQE@H;t56WA_~I%zhM9P~9~QyP5~mG|(nKG{GHY z`7-P1KrFJ%6b1?xCN$o@D8D!Pa)Z`j@70#)4D1H>1No;*6&#ysl%!}NCZZ!M%hnoH z_FR`_(a`=yF;h|1D`9%Arm7c9GT14d#!XsI*pTyG={lKBjTaTluSQwk9~1mp~5#cBR3!SL*MfhU5<*Qq{35g*{A%V zBq1w5a#eR_j9l{9kBv6@w|$yY^E}TgX{FmLWHjsRyR;d{%E;MbvA?#>JY$AV$Dw>? zZ(k+&M42kSb6|DX1DLmIOw)}{#^Da$4v)U;+VrqpRi|+IEN5CP8^|`NZ&U_~Fi%z@ z>7r`@Pj4YFY!Uco@let~we%~GtJ|e@p%ur?`0fM5{^%#e2bz_-tlaz}h)C{iY6m(( zJmGO0gdC^%6Wkcccw4|Tlp*Ekq(zUo$1mov^K$32oC|vc8P19BC@ns>+mrpc#t!=Y zf+D8KqSIz^F0xO7QKs*n?*1Zo1SsrN1KYVDMbaE^F78N)BNP}1*S~&#zCU$pa~Z7o z^5*t7w@B@X($8+mav4$dtQW1<{HMZ;{xnW0LlbLwg5-bXLD1xtitl`Ho2RH6^yFzT ze5+oJV){{r#GER5ga>6t1`M*><-bEMViA^QvR?@?(q!oDej4i=CM?q02++R2IGY;@ z9hm-Y&S{0J__C6u=pwz+KzMragi*YbGXD|AvT#^}EXK^sp~HvjTo`=X%2jm2&+kDt z0$K}X9`9g;8W1d+rJ(c8Mh$3mha8Zfpu4(hqod2MeyIxx4*yjjuzx@B+3h*SRw{ql z+0lMAdTVh8k)|57{*lCQ`cX2Z?W)pfX!)~FzafE4qpq!HFZHFIu7KDa8T9@QHole0g4EGPphnp|1^ zc3^@VRtM|vL>rXw5onjCzW#n@VCO1Q%|&2RD0>P4zx^%2K?t@9Q|(DmDHfyxt-h80 znKlCNVp7j+-(5E7FPp%BiNX92(C2?bKJM;p*(3xW{tPhc`UcF~Kv4nnC`tGAFw9qx z$VpWuOv5vG!G16#lekulP7o9QVBq%xAO8d6@Byg8g~7y+!0jYCxDt6p3{-0FpS846 zD2fpcD^JtV)0m=rzn<-eB-{{mD+hkQH2Q_6HGUIq`rOD!7QIdy9-3gnFv*i3nfAWd zu&sww@ugSiSRUd{)-?R=3)&0eK>2iXu{B~M?=vY(sKKOZwbTnOa|?>var&-K+{|cux3*qY4Y>olDxd(BLiW zItd2+&T|K3A&_V&H)*X0(>#y4yN|MnDA5F_G*1r~=e#%!>o-B>qv4i;nb`+ea(?n0 zL@qx9ayc-k#cTk>WLI!!(9cPfJ_C`Sc+s6OqCEe-3h>?`zl=Jk2P}DgppoVCdRa~v zKLmc;=00T8Pj-2McbN&oD^SV2V@C&qcTyv*R1noq^;c928FY7ZytJ-0^Y#4O0ik-E zPnCLZw35$S81YbGOuW2xz$no~aY!iFXAQjE+Q>UGmpfB(Z5v!D1VMD*V^x7%#0>uxbb@H9tYduae)HhDIq@QFoh4mwtEgyvBKTQ+Wr(ep^8OU9`U}xiefKcO!Ydnfz01HZol0UB^T`)uf&D3S2`{^o_CU zkMddPuE_$VYi#P%zI>P2bj>hgv&rUcpz+a{EVYAHgtkqH-uC=&xIfC?wDd=+QM)lSh z*R}A5mhn1$twGHe@EH|Rvw9o0v7dTIM^Hp&wsQ?*zjj??{>T`v{_B+`&Ga)W39gs# z<#EvlCRHmahQPQjgo&RaWINRcF@?sI43Dq8=A%m~!C;cu3{-_i%p!Yjo0yaT*#QN~ z5eP%fFE!Ei)EXQLxA;u5fL9e4vcnSfPE@ZurzbzT$a8^@TfyM*L0m1D9*cd6cTbZS za%J5A-aJpxxGC){8cuR=$Ok^X-W;)eP}pt-opBmC8_mdaw8M zr>BBO2A}_!)UrwAMkBQNI3$SX8u>7k2DI&AvTJ++q||*?HEor^g*LKs_Pj7LDGBOH zaZK_GZ_#}O=`J8MgitWRb1A)oj>>=C&BZIz0~%A#kF*J9_N2%0R@h9;jEta*Bae8JoJawi!J6*ha+^zKiKHBJe4F2#RGlj)EGGQ7nE7|Cpm0_YUx>e)ScU|v! z5QcwTqs5^^MkMhsdE3AB9lpb407H=;rGq0k5wgLGfBwGSuWeW1X~irSBR>FzoD7rn zo(DJj49+6maqPE#-rIM+PaUz%gMWH2!oaHt`>BXNgtI9<$p%+~;#)sBRBNc{W)y?kkUxi?ahO_&Fq*X(?w!v;-#tR@)Pqo6hfFxcc&gYiE(dm3)ZuK7U1 z3A_I?DICc(`25yuJ1lE$N3t+Ef*cxQ;knm^geAKu&;5qnw*WOM;PE}GkvPSPJ3-u< zkB`>x$?&72{8icdM?JNT%gLq!-?~dU!-r*(IkRJow4XBU@l~^bbbJU7+TqFazRJpN|)71|2X#% zH}Z+L{;p4n!$}b>!QR+vPFOuZry-xJOxlGxb!0it-X|3&;h^NZXsNz1AD2NNMn^Fz8wE z=1#m&=_jYNu8krZdvA(rHO4+zc;8f2Xn!1n>ZKN$L_I?p%Wp9(3gYN|lyzz^4c^yb zGR!L6MD-|b?r-8k)G-nfES?uITwb;FwUR9Jyv=qKRl`v6wjCWaowL$eFywWR`SVJYy*<&x~3ii!)hD;c9rbnv&peF?B;L3EaggYm{b2Db;*Ha`b#_GeUA zS|K+Nz4syvt@0@OucI=hggXwH^qRC=KW3+mXNy`arbn>pS5%_6zQ+*z6>6ph25{DI zluXH!qNAgG9@EiYKlb{g1)xfKH=_<()Tn+(=Yk)yDp+#6fU>w(v!Ns5}A#qF9J^3&$QHat2W836+o& zF_@r)g3j|Z{r-uJNG#@c3O#imiJAWEUd#4W;H5$#-Z`{%-g`m5jY<8;-hUtFxeF&6 zn&1dkfoir5A~y-orv)6gGKW-2rFe!TWrouYnw4VBk-~m#es8a677NG0fIoUdB{n=A zS22n4c3O;}LLU*D7&E;D%92IFy%66Nm9tp}PW;f*;ZZd?NARR!V2XJx-RJq4c}(WNLV;eJ0l_4Cj6uE0v#Jg7guU>V>xb<>AiDP~YICV_G~xR<*WXlB z3&Ut0@<>?qal7#w@M`vN^9qL&n{XIo5mYpWFlNGeQxKCFcS<#8pmSk8US6jh`ZBBK z6`57!BcIRcH66TDc_j8tsT9+oCPlKBf zl1?@hH*(Kh`NXzAY4}(l4b(k8eX~YX3Mven^Ng=dzb{vJU2Wq&eCM%Q%$TYT^428K zj+_c8D`JKmRr0Jngd}t4lRX2L7cQhHJAQ!I!921eob;0^$VD7Wzk{rPo}%1S!Gxql~pYZ?GlgWy9%D)oy#KLzDRsC|~(5 z<>8v#RC6ucN!o|A|JEf4)OuuCzbZNt5~)NNf?cuY%Z+`ug}y_P-Qbjfw=<*6P}0n{ zU&m-=@n{*`Ss+F=2bBq$778DeS2S|`RC)1ZBYxC2VcQs~c*aBDfj&ufft)QEVYra_ z3Rjr))x{WY0vx*1tZD5Ep)&^{aNvzkqrZ7@MJrkor`O5(E z<3+QkW&BVyVR~)rA!rVa!|L+tfN$aiv#C!Tn*@;-5-3cE#s{DMBBGvW+a z`?`h!3BTLcN`h<({iE&c?^~(=#mWF4szz(W*LYA1m%TI-sFYkuy)`qbw|RLRg$y--~`v!l2rTpe?w4k zx$-Fk+J@rLPM)etDXR)`RbRl zx90gOAqkfjq!lr}{BKLPl9F2#=HKQ@d|57^|L#Q>|8<8y%n3Zll>b5`0Ok(}3t0h7 zW94y3-$+0usP!T;c2}Z)ikaHBahvX#}!>l9N;mUUznOJa%F{2esp&&45 zQ^5=&P#=$XQuVk8jm4x={}_g@a*Cx)6oF2kr{}9gADW*4XSvJ~WSyph@QDeKh~m$e zv{wrZyj?1}#10>TktBMMOIb?l8Od zU}+;wXETUbV!^frQ!9YaRqmCR`sMakFXJpNV2C7W0t3F1i`M^UXYo0S4cY`PE#Ru+ z>L8#ZjiK(U0#1pkleftC{n?3c7BPl4M*2Vc>O^|do(EI^_?so*bFL2{Ozu5+xOcXc z6FeU!Braa!n_|$hgC*8*8#TWg{UbjYtuZZC^~xvOx?f$?R6UU7%bX3VCv~%t_RY@;bAH6 z^b32XAzPU*X-ohu6%*j$QLkRA;~=)B2l9A~;VoPynlENhu$+NJ0(2pRWpW9Bug@r& zW+Sa0^GqK({8I>&+3b2NTVSA{^7@&QvC}7cF{1-Kl~Y_`EXIazoRj1ba5KaT7c@T( za-9!BF1(-5_htD9T!=gTYMs!6#Plg;1e*r+lvhK{!6$K zoook#Ny3f~>|6e>%KZu-9m9z-)*_it)%wU9F5D1vwYan$+~pmzat_r5w(X}A^V$*( z3PQWw<&g{JbQoYzZG0f6VNw85Y?yO$!VK776a+0CG6KCkO^onJT!3FYZXKVmijMy`{fWQHQsdui7O(fz7Am3!t6nnb1fdWynUf!I5K%wJdBOs%&H$^atwjgW6 zHTEm zz9|rUioL$A$9N!nrzEQo4ophRmL{U9Op6vgXl=%^v<;ZU@{E$&S+>hP_hG8J;9jsU z9wa0!+%Nj-W!72p@qDrmcME+o=MePz*MTMo%Sb7$DS#6i0QC#xUmeI6tlNmg414Xy zGS-q*%N7*XFH!v#~`zCntbpYc~jJqt1X-}lE;OJm6#u2 z*OvcR!RKe2k5=Cz?vt2kqILZKbpvKuS&}Co0X-_;#okoTtyS3O1Nw+A3epAI6%$0I z2l8~s{Gu37YXu(&-Y=@Sbd84C(;oD^7nc7ay%lCBaGLfb08L&9>ELi|5 z+7g}zPVX!*HJ?wc&R~g3&2wU|`~u~FlK-$^95(8pFo50Xu$ShX4At_UdP@-U8Y*C{ z+nOUedJAq+BK$3Gb_Oh=3{rP8;d@ktS#asjxn{xn1B}=~^#ISy z3(-{CYtjZ9icW!UZc0u8yl-S&FKHmJVHC+QbGOZ*#C6)QcTQ?l{_)JOK)>*KEM+G4 zdI$NAw1WElP@wlzhE`WSjF#L9eem1Sdf^)(Mt#IsQgjxx?If077;J)aE@V^5htyqK z6`yvAT9}!5NTex;g_K^~v95|h9r*T&sgXJ(Q*X|lzC>`pKkfkpwJ|>;p0Gv_2DDPc z@*EYSI@y9prPtXdtcDTYZVwY_Rulk6hlwm-p@8e*a?i8+Pv}ly35e+3ErGLCO>OOS zF8&9PWeU`@&X|h*p8=d9DZj?mOV2*ikVpzSuyyup;>{vCe_vqwxcl9`@=B&IrPNvV zd72Rep1d-T9b*O&CjNnTiLxl?SFNBYw3*x&BiP7!^Y(ZZ+cD#@Cexp5H?y7Fd%P`% z(e!zSxWI*O!Dr*boJ@5e+oQ}0*kO`xBdU*?_A^biPc&7H;$%F-I8sGfLHI*4XS{-C zNTL`E`f73NJ{Xn@cX8r>xeb{$52l`r%*K+(6IGZI^Yl+V*yKw|QMF8>gv~bRd+u0& zAn1W*v+6i_Sp(yfb9qqOu;obbY>NPEOB(D`;1-<+%?rz>a`ZBwF&KHszJ(9jOFp<0 z+KKK?F2OsCgBKAn(6oEKo627743@ff+nL;`I;7sK>{^SPS@3d!pf_D+`>8voA3pX1*39= z9*3L>@#m0=jQm+HbBi>(tL+ptUMFjDeX(~tW-4}MOXis=kR|s%1m47}y=m&flGILP z*CAKQ1mxF6WGoMvARxh;}KR+5S&kPsRZD4&nv zQb{w&zm$(#>mcPE+g%>hK(IudI~OoeVo6LpEV4@)TvIqt^>(Li+=YZ^qF%BhSOjq4+R zvO+x3hyjJL!Vowshv%lBVC(GvBzR1&q%ofp=$zSAd%K67#P7MSx^RW-Z-$|Y?wc$P zy!4-o9}>0u_B9DiWh)kRQTHH+Z(X22e3f$eM+Ho1)bdgI>L9oZbS&C+a0jjipO-M8`u1RHP}NwB`Ym&>_T5UMluqT8;38b}O1CyJObG0!_R6TLRV|YP6TqU&&AHKp{j}KlGYSG2`Y#mT>N6S=W!wzK%8`#S9FPV<)@XviBnrqaGGT~l5I@YeaB}lc#_O5Al{~1pB%`cQ?V0S-&b0F@wjk^uGnkcVmHdLym>jn=Bp*oDl-hD3E_2Q27;CHtepAR7hYk1QG^vKo{pDckAQgTZ2{?sY?1s-p{ zw_3=LowJ6g9=frPOZ%8+jdbVoeqHL4?t$lSuBSZPitf{ld&O3!!}pdk-W<@EF5aHo zcjC9$g{dkea3bk-wb8^5T0SFB|C~k=x3uC+&`781lnlNC7Chv3Vbc$vl!+>@K@+Qb zz%eRq8DnH;ocXE$ok|Ol`uJ?vj6WTvv+=!!03t1;&Y<>4NfE6$&e0IBaFyJh%=>L- zhCMSS7~nK6C9-!28S8p=Dq0_DZ8h~IXHqN4+RHT2>Thvp>y$I(PyCe2u9uq^;M(Id~^OGJ1ro zmZWt{lw~a7a*WYj_+FHz#|CWmxU=A`GJpt(~*#p4;m)&9<3(E`@lj zn3rTNkV1;gE^Fu}h}lxpPmr?ruxfDdPGyuZ8OsB8n-=IZ$~sT|+-Q}2F#BSomeb@> zs(^0`RtjOV6b+~_fPU;Mv+<77O$BwggM|tQ`=dA8Rl+7bRsisBNuu&lC~|5UF?rYH z2AOfEeV35v<(Fe@YQXmU^{W8f}kwYzEV0XEZu7MJI>Zs=# z62;kqzwW^5@5xNYAPOKD+=fZmcx}CjQFB3AN?4C;^6GO^GcxSkR^!5hthJ06&qk(^ zhv&-?z*W_UOA9e9y=n>=kj?tLn<9YIBH*N-thVENFS@1+=`L~8M|rA_Oc4PSHtO7) z&RJw{*Y?^Of4EWq%lsRaXM?|IFN)_0mJ@mV`TgDua<}9dN1vRKs-3s{{uM(0h4{pi z4&P1RcNTqn1()W@jh)D+|B4RNN6X+97QQw31y>G??t_tzjkd7&M6?zPyU)Cn-LdXj zmoJ+O><$rKpnc`BbQAI5)MOEiEv|rP_#utuYf7@zj7Iw@*?~IwcoBfe`f*7?3GKn1 zDH?$fhap^D%$lnVnJIsajnZ*gH+YoIV+3&fET(;tz$p@rYpV#{mUACssnX8JT(|#{O)K+l#*3Ij^?ChNY0!;O%6SstSe8fRzq;#8MEV(u13t1c z+0vCaiXBA8zh-J!%yvunewZds9J<06C|7%&)O_qnBsP=f8WYeyot+f@z~eEn=mKX5 z<;w0dHfyhqe%5AnCi6(`lSi1c+uxL$GVTmwrq3fM0rRFyLRrFcS<-|4-4PUS?mb1n zfMhqflZJ2^!l1LFFNvq}cce0*HPR)n;mH-_yuCEkAg+x7Ry3YWF z4D<}%jh}Zs&qBYyC{kO^-Te)clQ4G6L4etBFQ*)-&FyNCU+vl%2OSRYr2E%bK9xE3 zAQg>*MY>AI#DuzWd#Iy#N8a?n$OM6PuoR8oI?8*~uLE9&KNzFa2A(J01#e9Nh;ss5 z!2FDUJypZzr9?rT9m<7MkZFtC8rbMKur%dR;LpHq=MNt~oD>A~ijE)aSVN2e^z+x9 z!Nb8r3Xn=^kc!UeG8MJ7vXVG#OG1;Lzk^YL1_69o$r^>QyHY>-38LaFm(X9+g|c<` zF8Oad{q4@bsj>Y|{$B_~tgbgs0O%}z)BBytDeJQ|+{UPsloarUMt@O{{N6VBCre1| z)&lGQCkI=AUP-A*G!REk*%FcV0@Q1u^z{R&(t0e^##q0z?X^3{vi}ooDlmku2mB&7 zufn1tn|@47=uMyqf-6WulSqLPx!0xYpHFGR=J5n|FqghUxqso8*X@vt9-Z&kMoj86 z6vlhNZl(56X_dGf0&dXgbyrnYP3JO=1}U&wLEb;mj{MvdZu7eM;+T!zATi=T zVa-R98PAM|Y0{_PDqg8%1kTFpGe#JMt36{@%{?7JV;3r` z2#I!enJYIX;S6@u4GY7edE60`sQ<`ELS~g-@mryI!`7G*YM|1Wd8hfQ*d}rBvBrJe zJU@ArBTukZ{OlFsdxkhZ3y?12fU_dq5P;Y}vHd+l$#YyqpId1d4s@fraf< z!{GPDLnV=KWvwy#mU!HhE4GL+7T*`@sG1z2m$4C$%auuc-A6*2Jvs4sC(8Jd6oy*= zBS+K||KJWS;MR)+!Q5mGCT;>m(k+fnzMPz-91#+<^{U0+9u+<^EK&?Ja)AC!HPXa)ZdoBWKhovA-Y1`=RN?WE( zDUg}={?v?d@n~GyiJjT<^jpJ(a(I69)1&1jUGes>sVd`_%jEMyG9!7-V0i4mm1?kQ z;L9%&^Bd$o3wR?Q-1pps#Cg-Znn77vG4!;yQW9vW(!-Sc@eTdYceF+uHL00!7uk)i zy8{oj?4m&00IBW(wfynLI6VQzrZxmeYqH6J@G5UPW()ivsQ zm)5N?XWIqUWOID4`OQ3IePC+&r{y_~i3i!gOT$Jqz%oW-dqtLaj5-mWaPL^@PL)L+ zoaD>W54$PG-ddS>3uH!-K;S6`tU?~Pl;8xMrf8>JC^ofNBVfUSMZrHIh$hOJ9C5Le z(B!E)aR)4xe5;RBv=7`=>ycdVf?C!w5Rz4IRvPT$ig1Db3X!jCEt4}&QU;$s zo_D_nVaq!R?G~nGoL%g}u9)liTDo+A6&RZ&4U42vDMS#K^)B}37ZQ^e!iSWia}?so z*|QG)xun7IFusqvP2xeLVGdKc+Q-J#MCfZcaQlfbl{6fw9jC@hEw_;9Nn95cLlmT@ zruK6)S%bs$3helSz()eeo$t0x7W`2L!Fk`E@-_qijZxy7hWJUCoB(%pl%FCU)uW{A zxHr{=O}t)h)d|V-({D_O58;7N_%qw;MHzMOMEKR0@y2p1HX$Dmtc)Gn89pW%sJC!$ zVA6b(sQE_=5C$M_)?{w4Q)hPO`g2gdq}dlee5k6LvKf|T08&Tb$D9AKatKLi#;1^< zePaWTkv9X3Qtn)s=(z+$0;h?u0w3S3P9{&3P&B_HwR^xm;&jHz|79tiYh>)cfH_ET z!e2c8j9I3bEyDFO8e&6ALu=kcxRef)`C@M%vgGh%U4bmVjDcwj* zcXzkaNJ}H#NOwp|r*v;RrF(NH{^N{$?-}RZG48$JeqY?%#ae66HP_7NectEcb@F13 z&7{hG_8~9VzA>Ne#~cqIiIo90DGTxRemyMtwzY4lyq5z~SM7*zIQyxL4-uqyJn?Jt zXZjASS69?8EGgr(bDa=HbcYqoEe#H1)J}e&zPmeAJT>wUX{|bA({!MWl>#{(nDLSrxCs;SOALt=5!r|Bmu23ShB>lT*xvUmM~H)K>SSvLMK_J z6ZZX1l})xzy0zW(#|1r+i_Vjo6<;9y(XTQ08##9n41}&5V>p`OB*f z!Eoj@wU_tAl=Z+3jjyO=>uJ08^S%par&{e5?GzwEt!`czIr;%hiQ zzbBWz(N4)qBM1p4a5ItDXPT?uU_J8htUk<6(an7M4{E#k+Hp~hd z=X>4)vOR~8{Trp^KC)r4qu7_}EZSB-A>(~DJ#+_Ua zhPb}!H>Z9vmq1VbIxofgJtRa#s3E|6YYmV1&o>}!zNW5d&c6>k?@Vv=!||Ct&VsI= z*YgEj5S{5HD!MBjdSs`rb5%zuBHHzSf6`T6$%3p7i#x!^xhVM!PEXTJ`)PCtLjt+& z&Ou;^$B_8RSaour3lf!D#!77q(e;O$SHaxG4&;N}-CdOEr)p`QIg5P`q+bJoz!CAx ze8mAvA2x3Y89JFJceMd%k@>9_hIYG6F?V7!PsQUUp|bj7Vskre^KGnnYs`@FfG^cA z+JHaIwHdMcqhCQ3Uo8;fx&QBWew(@7HYNzoFP3GpTNPHsbdl<7(9IhB0Z)2KdGkr= zMhK%pZ9-(L@30>)tKl174IkbYqtfv1Vr_V1$kmB|On+9v+W8scpZTp z{Q&7J;yQN}vmKcxjfAiPN4p)w9k*^4oQ}!@k$<(vo7uv<0EQSs zSHW^Xz*5!crhb4BwwQ;!Vx)Bo`tnXO5H;h>G95(BY2f&Z_Lbksx&={DBFRc~c}4=# zpyzwlQ8>RBBIAbjIssqa(MBa{Cp2TqQ+By>e6dE~7e?cw=naOsA=l5_WoCxWHK`<3 zKz>P&ZoqG=7Yvv09@PKr5@1^9qCn|A%1YX?V>Oaou$636B2g*+NB2%`2aV}(jFJ%n zFS&QNm`4T^E z<~Xeyy&I)MWhrKXRO5J7gRcp*O<=nR)}pwh&Z=%q`4NJbw$ui;t=!JFBpL7^RCs5b zKR>i_foSQEjX#iasH~w$YXGJGaXRy!cU1TP{6KbRiNe z9nk!^$kO1M_O!G{Wt2wO#VL|xXD*y!8)OFaW58dtf< zUl~G!v|yq&FoI%<7c_qPt*svu5idst+Jj5vQlWAD!wnb_8Wre%)_MxR@uvWxkz6C; zb1D>ETg%uUGMnYKu^2;#pMmjN~cIvN`=)BhFKN>QpDF#FrP54u!UNmQZ z5yqfwfq^G_b9RyA_;0+M0!d95kd|fwTf@}SzMawznGFh!JvJYEL{-lBzU(}!>T=*`u^7{C+2N@ zNiX#1UtaJ1l%&7*T_K6zg~};^ldprZ1(Pl-ND39{GK`7j4lh42IYU*T?0U<}Im~9W zp4oTC-^>2zqN21~c4jl)DjuCk9NDlSmHZ${Nc~U-ON#9&UB2&o5oyx6?G!e6HzUM_ zTriJ&S*BzH1q=%V#PN`BN1^H2)T&KXau8W&t4_dJ4wDtYKYI$FZ%B^%i=1ZEvtBJr zx=T2ONwap)pe)PxjGvvwOczIye$jW~Id=#?xg6&yVi-a&J8~6kr9M(hgh+q-_ILL@GlILxYsY(lQjh)U_f)u=jNpkhqL>prQ=~RVVCZVOdbr-;!u_{UJ=4Z$!=I|1%EULZaQ`Y$9o&fF8wI6A2 zhjD6e(atn6yNV_W%%96{vi16$6(!jU#v{L5FbSi414s$e?6k@sq_A8yY1%Nt`1!ow z`(}8agbW_V7h!($oW*}BO1f$~KO@C5bhGKdabZ_jUF+IMS0zbp5UVjj|LW3X0<&Ie zBk&*)TKr-wR0{Q^AG2P{pdi(TB*NN%u-nv+l&#unX&N~bKB{@H&By1PK{v6TWM0`i zb#f#T&t~yqJzJG)9zZY2IrAE^O`kSBX^04hBq+eLq1N;Kas1fo>DEQH4&TBVph#Lf z|3V;1HZa+99=w;Q51af`{=`m#rGg_=6cNIc)QOC-OQS&ky7iUo=yZ)$ua^6mn{Q%+ z)Ork7ZF_}j$5*mvUwAL4qGX9VTFwc1U*M%T_x1In^^N@OZ11zSpg^Rd_;uzwf4+OD z3foAu-QUUhd*qds`YIXORItM*X>9Fe$FrZACqydHmPcaz}o2;a7ovO=zYBBW5oqXvzn@ zC?|s=1Pn0(jbf$1S}4m110_-$siRQm1987v{`$Ork4V1+5;-{}^`GUVXhLpLFua3abfV$h6en_Ro!qFT#TsR~V>~)e-_CD|!^=E8@IJAfIx90w z3*2yCftR`Mc>8Vp&96$1p>eh(k0y5td8z(fHFu8>dEMdB#)QYmEGHrJ>POuxL0>uW zoTlS>$uBKeCTOKo=a^lZZCG|iD4 zeuFGq8RqOl>z>$JEVb}{(NGzVm$ZXPCWc^LYbCgBayx+-4WCK4p8C^KeT_5D4CP$;jIIED4IVzxD4T^s|ss>_tcW z1ym|DY$|=Fh2=EFb=p>5Zcr9WeM;Y{Q{HuAJb|ixw7Y5ab2EB_C1;vO6-+i9-##?n z)p-t(WcQxJa5doG%T1)LJ)`#inrb!Mm*UMUk$5~pV=v*K-_JzNh2*!TC8R&;c>`i6 zX8k(O0?6MAk_!n@YKftxh@X&d?Lto!wu-JYe62bEO#&scnSC+sN5uCDE2H7IAd`Dp z6iGVh^u zeR~E_{`NFlDi+woMi!}+?_jiFk#z&jiHlu`+RG~-`{7kP5Ql68&VVhjxdR=z(zbR*)wO=x;wj!gLv_4%Cg(#C zKrB7CXj>hTu`jT8{xL9Y{@P>=xe&Ct*i64)tib6!G=cxQH5MWwWK% z`8q^hWUe0znlW1UHqw}-mV6lnwxhQ%4 z6L<{LWx)g_&ujNp!6Hh-V}!E)z7g!h@n+@!q>n1l{Ezg}zT+2>p~rR{WyeOS=a8)*tZhtPFem8wI)2FwX-p=ZYi9 z{kc1}V&SKURO}0N`WoZgap)+>f0ZQ(sS)BLfE6T;tLFE)J76TZdy@G!-k2=xvZA(7ZF|Rmr0lB!Q%`eEh&JQ-fFJ2T!g%cIO+&jqe)~bTaD9HRbM?laQ z!QKv|9o zS^?z8{~*)fr9 z>EIt83R#hyy4YvUjyV1oFHT=vN`{pyo*B!A%0;2QIRb%+_^Ow$Io-!F%zEw1nJI`L zAF#sTz{B1PL{p=`HJ>csf>r z29Vx=pW-_YYo!3<<|-6|TnJWxcL~e@RNW+=cx7_w74wNA!Opb#JOHDK%z zv6EKGZT_NMA5+cbTKw4VwnXo|((!dn*HvG@duR{^AjO}%9ur^;W)3*lBqZgGG;fnS zeB^`h5Llk5`@I-T%6^}3*cW43f)R`=voN-nJr7$YzyDH1WkVpxrVcdroc9~pyt(MW z4?cz*jxbU6DSHkeO#y&ZnOpQr$g>5ORpo|`z=;E_XpadV*@KTibN~G2JW?SikK(|K z1pI6lki9D7@{Jsz$)Cx6xA1uZTKkOu(fr8i3GX?Gfy7tQu8+g6hJr1Z3P_rz&lkyI ziY{K?dL@=)Vya2099*xg5%?mv3Ba8RN+R%=GY$Qam+XonIYd<`BFa(?dUm7bx&p_R zn#uB%z@3LG^55)N?jUpM-Szl1N^%QAGeAtzcw9J$zMHP>W@&3YWnu$_YKpq{*iVa% zPNr*P7|iped;(Zj%fJt++DDU5#hthIU5l#ixoOmk4WMN#)-ml~da&+r=LpQj`zCeo zW4ln~YQSg?F*6bCF?-&`J*%mU5y@gBFFSVl3)T>h1$NedkolGbGqRVNnpcyM(U8*{a^b;`ViT6cJss0fq z(+)55> zX9;Yp;}EbzPt;<7(*}6*E-9NQ3Tgi%iFv{cfWp8QBN{W&8E84vYOPDGn6j>1dmr@Q zpzU3}nyo{DichzAjm8Rpx$rvcqq=n}i@raZb@s|2;m#cKeG(Pnc`|10gp$~LwddI) zX=%4SN(Fx=qzPSrR!U3zo)K*{K`2dBGf!N*YjIKuXg$`XhZ3XBDdFWZZv|&LO@%Uz zra^%C_Oj!I3~<>a^L|g|J(jia!pNcW~4v#mCX3=3Ja@M03XM!Cw^Xm(iKB! zWIA5&{x2~!{T_oFSR=r8)2ek*i9M&d-jsOC7>fMCXi5sk@>H^88qQBieicKwkDAvd zS}oz4i^~qA6Ja8hy?PbQD3kaqE1}Q`4vD==h$hIoh4^z_N#(_N)3RnNYC*C%sT{T)7I4Ks_8fG#-9{5@k)+#SDBvS7a z2x55wb~sE%Ojb?~#Thc?9I)gO{xKr(z?%$L540{vY06XQ?*7=Bl|8w+-;R83v-)JH zJS_U?>vx0=@Y_VehVon@ln)3Nv|%Vo=Ak;C{rE#@D` zAjfM`!hx*D3q+g}=tZAm6iYCWDd0-08-^w9)R68iCH`Rh4Emi*Dlwrcoh?}xIMpV)Q->{H7G59KRFVCU&LfIhG4WgSOhKDo^Uv zB!V^&tvv$1xT9r}Vq#*hhZay3Fd&dk(nfm(Y9ybO{1oPue}M#R^>o}Q`u!kxcuW%Y zp6zDnrkwq|fNaT>L#uwEebIC45%+*!V|XGpA|qQk-7*kA8=24P!*A3Pi2Fru$<-)I zharopUb<&F6{TiwLCbt-8&L_2x9l4MN0-1m6Rm5QlgHud96guhGIj@T`htdBH*5Qe zR+k#v%_Hz=_2qe#Vqicz@~om!uu+K1H5h>=jx_Ytoi7r8s` z3i?>~zN>|eLE;ES0fdknOQM{Z=+IyZu| zT6?#fKtxLjU3s%2o)Wiw*QhV)w|9J8%7UNwZUg{%mHC@f^mmjohJ3fM23Y;D3&JyX z+d@gKON>JnwnYgheTyZUUz+PWhAz68N-yKp2hN1*iYh>!ss`c_7ay1HcMz-~U$yTI zQYIIwurg0|=i%O-(%ztDiYxe-iX@7h{&Nv7Am%uu;TyWRWQr{)5_+L{E^W5 z?q3*|*kBvBlAJtcY$aV(PUVs=&cZA-F#q<&l^NhD7kIP03AD9uR=~}nV;ig2v%^wY z;TqXFN+5zRKGSBT$1L%1`hB00Xmk~YW+NF==-twgv;W73W4~OhYO0%TU%HS>oo~KABM>Ma}`e>Fk@Wu#Qb@GCEiQDw@wDW=- ze}_bZwyfnsV~06AfDTRBk&B#XFv$NKpGWNr+dkJsB%;Lea0I`8IP!4D*Ja48&w4%^ zCf?py@jbygUI3hFuFz6_Ji@Qn4}Ra>M(8f#OB=4bjm86|USPxmZ?%3tN@0~lzsxEe z@14vky>CS9=;yY;RaBoC9xfT%o#R(Ef_30$-ed2P#&s15xK#`n;mKMyA#0nb*csxpwJ&sak^!Sn(NN2DVeaeVLlhzZxKAu&-<{mX}n3EE6F`S#4O4&Dis5?7VkE zo^yo-m4?-hUM5zFREG;>{p39Fd<~Zcd-`1FNjf%{VA0TXXD})Knn&QDCYQJ>4IBs% zj=KZ~5uGz(mdGoUlYx`-eJ%5naK)I{cnZupf{P3emjnwuoBcwLQO^>W)|pvko&^Xt z$~ZI0MB5MUM7YBsW|(g03>dzd*wV|bN{2jW6+*KM!k6%V)9YcIL($gMFr|GtiLjG1 zV-fRQfZOm-td~v8$yE&ENNcO9jpu#N6Q&nC&JpD6mEt3DRV7MaE3lJNX`E5o2Rxaa@P@xw{g)sF{co^H^-2Cbgib}dX`23iCBlxxI=E0-1;gIW*I3F1(a%^d>}LBef{=UMD5=_v zv)}Yb359aBpblalXTBiC@%jael)7=)HVVxk90qrAz@>~>fd6;<=(~7CX zGWmPaVf?qB1i|j8WxmBv+bT&W7V;g33GTaHU-4I@_u5~HS7tfbk}CJ0`lOF@|DbVF zwWYdTTrbx~yi&^1dx?nemzx?0^azRhQ7^WGu8D=V^S@HbAM@Ytv!3N(tfumDt*ipw znMtL}wB%%4!SqaY?X%tm#vwt9q(_e6JPy2q?O^U;=YwGJ~0p&;nUiiyQi7iDFX?5C3 z(aa@Iyc*GBg3awnDYMW)i(h#?JZcR>=IYMy-kNR~v`$-Ra4)v`b{~aZ%VvC^wwzEdpVO{#q?#3JU+~hS(X#6s3W`ihA?A&%pMHZP z%F!QbNTrlw4YFmCh%&F%&tYX%$kn8jUOIkDS&@7lVhGrzT8u~@(rtoI+B#6{(poW$ z=~e@!bji{4Ro_!#`K_p3N?P2md`*k_9b^J)4|7clw~pD_4j(Et_$&nz_;AZWuR^q!(e4Ap30b1SZB5D^tKXqI*+rSLSYudyvA z2tupHOk`!@`3y{~9);0@UheE_&(*L7{>n1_Mu^VEiywLd<#5v5LKU)sQ4KzLnWSe; zHpoXRG5qy1MGPnvN)2x)l_TlX>8a}#_5D_P7E~#jIf^`W(G%^DhN|x;rCcu(w2pM` z^WPlrbvkh5zbIZJ&*QKD8&dn9KxqH@8@B8JCNJDR1n9s^|I3g8m@t(CYHkLX-P1@A zxy%^hbUD=eH$sT`9Aq)sV^k>A^dZ^$mY<+*)z{a9K$#{X`&)MgfuA=ufoK!cQ;RQM zC)6B6zGKNU3;80bF0_1G<5J_*WGp&xlj6c`brU7>?>Qs+Cf!HL+PNq+9Oi>Tv=E!& z;Rh_I+`#q;sBr*!w0uW|e?J)&D1D4(dzm#*^#PkhnO=aZJbJ=upQECg8Ez> z!ZjD22%bTo;*08&;WQvHW5N|81u0Uq1(U|n&V=G53GMpw=@gBwvQTT(sPO1(j&>R$ zv1I86;YA<8sHVPD?(!E5)K>@#MZm{@f+O;bU1A6^HQo}TA=Xww=j4`;w+SR=UGy)d z@M}&99J#BF^#l6*J78M`%q@;jtm+nD+6Y+A{J28kZY3xWult}J6?heL{M`m*zM@`B zVjipvvW|eiuafENi2}E)ap3=|SWdyO|8VK^aEYty$$Y#9k4pH_O(-}6hot)9{>Ue) zE=pJN?htbiVp3x{ds5eSZ?zVC{S(bwzWN?e_QA$n+mi~A(`H-*J?}``%0Ysy${7bF z9*zI%)7tC%ZYJ;Ot9ClKpktFqVb-n-yYTv(-C``9yqLD&*UNp^TNxSY>CoTh-t0QT zoWTzd^3}zUOmPryT;hKU14Bz`+s=$ZB07@Ba|y;F2^pDE)0C?pcNV(08k9UCXtxh% z`2v81$xD0Z1qCVxxQtpK*>+a}JI7|aY|*9lG)-|N6fH#xMWr6ZL_pxQj|BSXi;7Q> zk&C_N_b$2+w7F%^)1iVN)4U+sw|p~Ix3&RL&UEjaop{2~UIAwQ{ip!ZH5h(xT~P5F z^R6Be70Jw*8qdoz~w*{sdV5@!CjjNmL`edVZ=<0WmN3acKZ1`D05SR>$T1D1L(RMO_9?s}$6?_D30GK=r!ufGFv`nn zK zARU9-@=%BX^ffInYWX1@@9tV=>?$ zM_4BSu6U2Pv!mV|CfsrqQ$j5r?CsZ3V`i>_veh-n51`c16ZOI9HKl@q5p=@)`9!xm ztM85X^?>dh?+o1rVD<%ac&_sW?#(>6iQ)aP_OC z;+cPpDjr3w&9;z@Y3CTME4-k)CI>8-e}+`hD!BPzgq$CvLPltrn>T*AC`NPnumQm< zYds7Y7&kg3MN#B=*C$T@TqL(5s(-%2DPgUY%}(IyI~7Ck!2VZt(z2S27%83OLGl^7<)U zX~3JV%a623c`Yyz=)TbwC3ks}9E;=PSV)7)adUQdzQYeSzP|%B$u$Jb{I6FNk+^G7 z_aJr>MSB%iux&yVpN5?Td^Hxti@1boVPGadK85!*3zaigD7)Ie1fBL#=mqOF``YqF zeohV$L-YXI=|F@{+Rz_lgz@P>^&`C@Bz9w>xc6(gZPdS2*BXxpbfJ~oPO4edhh1xp z7;S0g-si>LBPxZBSK4a)pK|KC=&+BNM47U$O3LiSgLS2wN4RPzmOiZ+#u^9pLq)p? z5^t*_`(;BZ7@IL&QeTtAKZAjx;sEu@7NSmt70Vu13^-aqAo2nX0|E?ZD*=J@2f(8-dY@@JdyjU?J5z}|WluJ|3TZrE3u8*)yDM9#tvz1yzUm}_-fam) zg$WlbsjUU|=f4T*A5_z55LuKM+*7ztI9^(l| ztQc~&qk^~n1O|pZwf#x2$QtfZ2*yjGqZi?$K(ZX6_A-qSBh2F`=pna~-V7up_s~@| zpI{_-xUMzGs-oTZ&^3djt6m^_cieKh6lR09k(H(PaZGmY@CO*wTp?Xya{Ck*_-p6K z)>wOV%OBR_yULnR`axtIr{xkbl^;zarFgM%(&I32c%luBzps_%EL`*Vd!kkQMu zFNzAbG?+dec3mHu(|~_?PsT%GP|-QAow73+*OaA7LD*m1Z@&KcK+yt|st%W7pUwcR z{zHOHGPK=)t0aorKKcbP`M-WSon=whu(>7h&~T~*1H-jCl*+voBh^Ud&8!aG&@_y? z<|(Yhn6T}VKKeqY0q2*~YHl4H2b@WfUjRcGg=w z!7)>dyuSWL=B1IQYTl_@I_Gq7o4tzW-K=-K@WEx_K5iIX2Scd+#V1r!BlboCQdT!| z^B`UwmUU*4f47rFlifcRp)YIkd#`7?^&9tn?*TbD-#2?Zcx#1=!J5#={TS_1`}+Jw zbPswA{XDHk?`eOibesW4r?dPADiBKij=N>#{$VTWwhfm^pcY4xzTU~B+WJxNl&Kyx zNHBMR1g*y}^F_nX^M?d>Z~Z-+*OrbR zPOD3{3v81}K0xzZn4mk=CvUKZbdEDR8CxA^7Eo?`?Ng`D zFOnc0qTmV`@t5VAu!YW5OK4GEtiNHH!(KK#E@;|psS&WNZdhv-0%I6Vd-Oa1 z_G6y`O+3!X5D1;uTGjS}W{xbSJc zv*Ei<$75nQKW`};Tfq5yHw>=3_UQXtyKEm4q6D1cDwlJOKWTCAwXqU8n?YJ*3vVm%MPLH zWg%ZEIij6dRlTd5(F`4M^?ma&+( z2%I@otIPHR1a{`QDz2ada>Egi4-q+9fkGG*Ivr6k9e8`=bHCov?b8eucz_y$=@rH{ zCvu90)=U6;Z9_unAgYl&uXRo0yW_}&dtN_EsSe@z2UYge#!eA+8hmC@j{jT0bt zf6+adRQK>BwIB2!DkbRIU|jLVbi_6UrwyuG#~AhZcm1;+LM4me+?I#h+q;ioD6!f! zGI?}1axQtdt-P;r8Zn*S-B&Fg=DJ>)YSMXFEbvKB!1?=NIO0^c;lyrg{lWrADXne# zsh%1dDP?9>{qrXz>c~g;V<>G(oZu&Xv$v>+ejd*mOdDzOT6T1xkf=2e^%A_4zS3O^L$uQqaUQ+k6kY^mZh{~7I}!oo@R z{%C8Y^^$}$V&-~cSXd3)a_PRV_|0_2Sx1sf#`O(J%$#FUM$FX7IvS_9!XH&Ekqoz`Sz+>Ks7xM`?9zDs%0-*`XAyrj#;2r4x%S_E36k>Ef72MbtPiho!R zxEDy9YU=F9b>ezh?qRr_Ww>W-yjt5@UOu1hWo+GE^UmhPv1Hv_#Zj2fctPuVkx9@b zMhA6J{kgW6ecL_Ho6+KNaKzYpl_kZ9$K^8Z;==*$DA>w=m^wb7sVgD?g%GS!er=2W zGPEhLWiDsBR2$Nyt(kT=y#-}$`t!Yeq(vU;kPxZa+yeQXy_UPGR`+0ge1)@N9q$GF zbI2O^p(fr-cJl_=`NrblW-z}M&f6>6zOgxFEB!2%l^GaBu!%y?P+seWRvNTL~ZgMgP_PT&j)d5tUg`)Wwa? z2vP>O-o>sM--Cx>c8#2L**;)`T=yQP&C1F?Ho>CuP`~W0#bt}iyRy^ynp@+${PP@t zA-q}Pqhyy|nXsw5oo;p;=n=D5S;?OUIcZIdn$Riflz;V08X<{odvl| z$3b33`+)RP@n;`+iZ$+5KDMnZ#i6v@UMa>Monm=lwQ3QMVG~==&?=wvPEFyl2waT+ zi>8*|{&)(k+zR*?#-Gae@#81f|F(txbJ_o`)BaN>|5V989p|61jFI?$n^}*|t1~i_~y`+{eS_ z?)IKg8Lv>^LeXB#7En5XW9`S~+vu%X26u|)hlGTZk2`Tf8`N9VdssBW4R6M7wW%_z zWEF7q>I6sNy}mgA zr20NdD_3X|?@=cakrI&YFRSoJLjU_@!bSo{#Umg=tI!uOkBOX1E{5Zx7}EScZuvi0 z06qp6W^~qx5aID|ht&lo|9a(oB0kz9&IzL;?<^bftS+Q`ttIH@gsb;GAd~tS+HH-WVu4!jeIdYE zfeB75D62Fn7NL|=4w2Nst-X4$yzvB{-2yeT;3EhTTM$yp$Go!Smst;Agbr zfBglxY+?I}?bIlpm8FInLnUXMjP}F|$H}a~RqYB2V}^tZxe#_O(cEhLtx4*1?hBxP zGFBzs{#aw;S^LpWYhRnen~b+qI)@x5JAoUV%3$7SO~NT*hK_V${5?&$L3~+sTCUKv zO1P-O!8Xn#D9&Ea;PFq9p^~&>$9B)ZFi&PWKlT9h`eZKu>`6qLTrr2ZxfkFFmj-QP zrFfwN!53x%;~^wMqm*tkD!hoeM;MAre`6RG11H6>df`GZX3ReB1~zP&!KrViGR5p~ zmCW?Fh?va|q$EV(tB~|7C_NPiF^K*56ei%}c4qmpc)rktFqU3Dw#Z~2cyVQ8$Imm5 z#p-=exs`%lP9VzANl3Us$N3R_KR)P*NC6V}ooPG|I%Cq0w{KTa2H^X1lvej1JQ?6q zsG!W*Z$+rGLqz4hQqXMOW$)lpu3l9u6mYW)z2KA+Xwgf1$C&mAs`YAlLzklX=PJDK zc?J?ncSpZl+1s}itl1HMu_UB&UEwlZ48~n+v;%xjZCjzezdbe!q>(j!h!s1|;9UAh zLXzULH`Q?Bph9ay$ZlQzzOb>v&OkNb`T6fhEa~7>DOm`C;lec1qj0 zWV>ury}crQl-J-+D+5?0 zDZS#`qGqq(O$vFbvv1SV=8lVXfDDKsS|o6SZrQ(XvcwcR@>3zcxL~rx;C45?{jnc< zsuww7`*cLEP@mJp@puX!fn&Z9@j}R1C9Yx!ZEHe*h=6}~OeonSjMIJ$kw9Iw7^R`@ z7C`QNL^)Tuly`kwcHxiM^<&1!bBCqJ9&w(PD+R}!4`WYm$+liHC^|5aW?BEedhGqzu0LLV}c(B@0a1!ou>w ze+AJ)QCEvydn8d>r0K!`ZSRV2Dm+p6L^lLsL;s#Gvc`4)=Q;J{0{36Q3G4IUZt(vS zjJk{uhDZh&+aL94Q@4WJ%| zTc)S}@IAwxPMSK35Y&Lrsa2+Tsivdrc0&(xNen#Jy4+TGUAda4Yb`ZR`s=^EOJlQ{ z#Gom&BIMn>fwyQ>)rEk=y~C-RSMt7MJM{ol@_-*#Yvt61a{X50R{L7%9fx zV8r7wA8+0usNLAa;rnww@Hw)%R!I^&*YE{Cx4CIX0vuJ4Q^T!RtahuUn}i8GtY;)zD5iCF$&ZzGQ} z;RcHg&Blw)0<-zy<-OyfGbM*Q!+ghE@1yX^#xWWbL(jI$OOHAW_fHe=O!7JTxNQdJ z2`-nHTdX_buk&;3%p5-jfYMUHNAE@`#&3)97DcNGA-(T%qbeG(vJIvr|1G^C-A<}7L+Mgp*?ymxG zeK-nyz8H^1q9BtHvR?!(8r9B2SHCEvzJ13gyv_61Y4vL8H2lkzb`J%iQ4RuOyBu7uw6a2r1tQr~CaKA75F3J% zY|{~fqm4)qMH^_Ll22O(KSGP%)nN9kWQ=-r`cbT3VYldd{a*AMG>-!9fugKNSsteQ>Ie(Sr!iMKXIaJ5!!Lx93YP>71Z~$_Lq7K&;};BW`Ds3X zJYRx}k(GGbdu()CG}w%aw=HUItoX~)C82Bb%!`Y__W;a(BBcBWyo zrc^;$AHCO)A-lP`z^sg2J~{3c)P&PfF*C>56=labvAJwv_#k3G2Cjoe&fg~xt8}RE~a?TldomxL&L0%We9=v z)&Pr!&%r4}xgm75LB+;9b+SPH-Zem}bu7TEfbA|cJ&3uoqD^3FlsYN}lvxCg%PCZ(|UUjsxfQ4$x zM_1qk0yrqaTx07#3FrL|Oh#Vbn?Y*MJe}u&MgbG)1Nbuy>oJElNWX!6o+{okN67pd zvS?~n2cjut?K(*_OKIZWg~H=v#QeEm0G7Oak4wr_q0jDzztd@8`%lDzVVZNf2yjAy zkTlEVg6RMGa-g|fgiwmd`!q${VM}ba7}$cK*fcSKS-}?))2_e=_zT5T7fy1)jTm99 zL$w1;kHO{4{$ZY@=IyXG?05sZHnsBYK--Sy$HK@;h}kO3)j%f7ef|dHdO>dohyUjR z+yDRIi&jiKY|AuG^TCpR%wk3O$fmaI)RcTGl>38G#ySj*Q10j1fE&Q&bLi!-;qHuDcm0Ro z+M6gc3{9PZ$l`+pI5PVJTZ4U&8&0{BxfZBTo}ACg?-Fe{g|wWWgR)oeN_6Mr0**Fv zi6O+>(7?I1o~dF{)7A0dyc zIorOAi?iHZ+lXD#Msu&f4OF&R(!0)PAeH&}IIC{-{Id^%;@KP$biSgfHwXSk6_gal zoY4=L~A_AEDAi9~17Svg;1ZRT!0j(ZFTP0MX%ITLQ@yV9)o2EEs(t2hRt z&&$jQ1QD@oJ|*QI);)n9{4G`;Umda~b5LJ#+6d~~IrXI~{K%X6>}K&Mittt=Oz3s* z;`}?xxhkWf!4H?=bM_V$=&|Qlarr!vEzNFj0>%UWO-I^sHxoR0UR7@P(8D3Pa;x>5 zJ>pjO*ECPLil+FhsO!9|=^Z9A&tAe^?xiko#jI=UeB`Uv?z0&#*?MWc!(8p5#hG;; z71aQ_7Q44;^pH;JI4Wr4XW#f);dY7hz`tc7h>Cy z^$N8#0wN-HIT>B=!_hvMGn;AZ25Uuo$uR3qs)f@uwO+a5L7pEU%r)37I{b$=_&g3s zGH!B?g8ioxQsb&0YGj(fS2aE%wDMrdfKD_BAGWMnjPSQ{_&hY8NqN+Ho9$HcQF3TC znJOH*u*^--ygFvK^X@-KTVO6Y^*bs+{=)mm7Oug$&AqKB+u&Hbb4f@hPqgu2X_n)zQ)bjIP7ZyDH2x#*!7Su7`Ox{e? zp39r`-lY^57oV!6Y{0!dP_cKhVrrs4-x$P2yBpxY@7H^l#f`NU=g=Xwl)jj&M#(8r z$U6(8tUHVxHs#3*$*NxR8rD2MJ9+k`R&UxG$m!XR4F}9`v^7||o#ZB_li+x_S>4Jm z^P@-|QqvUDB64tN>y|er(dmXoMouU4W1ZJ;H=o{W#Z>)Cl2P%|`RVg?cxUk_6_ZYh zacADDHwJf^+g9KpH2NO$g3rgn8x}?o!w>RJ>d^CG)Ta5J-OP;om~XTSmyrAEW(oCu z$>jE{K99?mG=M!_TN$4k?~K)=)e+Te=Bqy_Jj-%Z+B8aB`XM~BK|$>$OUTmK$RV(GS`zj2}-2vr_N(2t4atZqJ$MY4G(E>O6n0ZMNLLlpa_3bD!Yt z9Jc+o#?(tEF21E^Ze(C&zS(q&l^ahxbm&E;^K9s3>vEW`vb&g=vL$RkS@#2?gse@p zqPbPtrU}P#!$D^Nog(}T0&G6^ zvdOXbBY)w;iM|VR{`!?|@9^Yg&saqz-&S^kU8nsP>|*1={S|Hi{2}`h&&e)Mopk#0 zH7Dgrp&6^;2@}4I&lxl&e}j_U%1I%rRZV-Wu!2?DH=Ay+A&AF4oJRWj2i%K;^KFB$ zx-*$UHw9Ohn=tizBopGrhCfMaJX-Ivejs3bw&ikIIex;0&wnaI#8noGWoy0EOc`2K zxiO{QS)QcgSZ>!-iuU3_k?o22Y9D)x@k{TCJfCv8Q@t?V)>f;n0@}3)SWgD_+`H*o zBa4dZsr{4xqqg&oYAV|rxIPA)(E%Q#g7k41r3pA9z3D@Opb$a_B@7@$dMC652MdZo z1_(u}f*L{#O0NMFl-@xgMS&1n5+Ec%0_3}y`Qv@xTJNuKt@l?}_C0ImoW1Y8*?a%? zJ_jNIl`-;$Qr{)XocsQm4R98Qxm8mB+aFc6X>PXfR563G5s<|wDvpO+^}q5YN=aML zZE}la9(?5Uj(X;H(9CO(heM3uiaC6ZsA(yBq7=XJMUp38H)uK}RSa1``r&^wbwm~H z-NT#^LOU0azhzXN=73^aYe{$CN3*?jM&kTFKg=p#5ShF?n}Gb5irUpE4)aNplXz`U zaq%y9ITMLj2&JLBo6VTLYO|9(b2Sk{Djm5zbX})dp62{+yO51wg9Yq2582}<<`*A# zw-$nixr}s3U0Amk_=ZDPo@)=|y=P|1a+^L2X6NKXjno^B4Hs8)We$tp(|hPWiHXqMGuN&SBuyY^K#Ib&VtrZR&}%ctHh zaDt7#cHjA8=&|%M$yNG#>77@l`SI1Nn=4I+N7?-kMzkXlq7BHK4*37L$ z#ZsR;D5QDR@FwD`(ie-xhBqhDuC6d^&-)_{LmjEz>Dj4mAp9EdoAY~^w@f4p|-9{p5o$K@B$P;g2_kJZ8HnV$~ zV1&=u^7CNb5L!keqp=dMBm2F~RK4$EOZ3QNcW=s&YF!L-x{OeJ!fsBKbDg%@n=D=w6LzPi zq0ONO1=fvu-~YhZ&+>a}O2QT2&yPB`@X2<;Z5|Xb2J9Yrosx6@cK_#<%d~eeC2=E zZ!4G{8@vB!1Mw6-;p7N6I@Y%pXC&AL~4T4f_MuEuea)CbgSZ#)iS-(A)Maq zyOa_sDB94zk=&b*7d=v-b82~SaK4>Z?*a$Mwa#~vrgG6&50j-^U{>Q4%SS)7yVIqd;g6Af)P`^6^*v;Rl4onTGr0I}R{b|K)fA zUDv3NrU26P@{pOb;ceLBn|Je(@gNYr=_M4BdIKa~v+R7vG!9rM5R1>EM3n zj1WY%+ghu(<#TfKYket;yQ0N=pd^onKPlWOLCZNslCLaE*yZ$)Be%p`wbkU{yoo-6 z>NV#sW2q=w7`;OE6t2D_f3~9Uq6Br*L8V`>ue--)HU{n@<~EOf zI%!0G4+giLa3ss>u{oAWkI?Cp9$!B84Zu>kQ@N6@+a>xIsq=23)JMob)i#m9c6A-% zD2=7}j1uJ4Yo>`Y-WtI4GF0~V`>1vJHM)US=W!V=#zE+}Y&lbnOKx{F^Lq6`GGf9wldVAoO_&dg-2!Gda>^@1IAKh4>DXQf0W4e$jzqzY>UK6R( zWc7L<;5^YD33k>yID_=DyLLof)-d`SpG3rCfs-l1`z{du&z8HjMpa!|2>hwBMtE9*{AH)V@yTBO4xhVxZ#jjcfCoDv z>_ho;?;*FA0oj8^_p$TwW}o)n@KfM_BN&nldyMmgoNoW&-DF%PpecZC{KYG_KYm)? z5{n%pn#v95I4A(osbSt5$3qSV*x)Yhe~*YSkaO7oH;L>3mr(z?3ptEXo`j`l+QWgp3f((S*|1F{oJTz?dQq5QXn5pTerW&>M+3v`{1Ef)TW zRV8a+>`UYnOn`%(G1fz}Q~Y{o_uPYnc6mgd*C7WEG{(s1D>`PcNjU_|{JVg4p!$-Z zO%f@0AbHFV*P5<;C=mfoMZ`?t-7_02A* z*a4^LWH>9;dpCRE*Z@X8u(S`mfL?fbC3)H*R57be><Utsh&X-6A{qh}0PdIIPwCO1vI_9=pEE}!r}Fy9Bh3T?cTJUIY)>8Us0UK9!0=<`e$)l`v;vMR zv<*E;=lJ4R(tnbDyC#^X>#=kg8_+D;^KEfymZ^eVTYGk>sHWOc5>zVU^rNiaONX$w zHt(aS-@>)sbv;RC)@CSNLCDY^Wk|?MZU!IoZTnVLb;1hWSopadSwDC(7l_F$PIKN| zEQ0RbEPRa?r*VZl*xTB|KdEYuNNRerr!#OcUeT$gw*8$_)QH<*BcUzPX{v?#ApN1H zlwwx&al!3I?VDX#Svje>S3&%nT`{*UM_%%1rGWvB>6)7jpI(-6ZUwBeuKlCbIb6ItW%-$c z!9}wvNPDN)*@EOSmjgw8Lt#9ERfFW7GNWh237NdtW{&6~;+(Wb?hWPXVh#la^0Ig< z&Fx7d1~wPM9KkYLzO!Bv5>dvwE2WX-^`t0uRzcw@`LuOVdyv<~w2iyCkReu#{H2(! zQtJyQJ;Zfbnk+sZ&UwH^I*frew!79a62PAI-5KNTmLC)}t;<6O;Kfo#Q4nh+bRR|U zFW9reB!MC=(}3lC{Vs#IoT7ZIftKuJ6<51ssuxUm*YkG7nLnwkI_*Hr(doM%7IuB+ zOXhBjL$QrUGZL)@>u=jo3CJJ!{erJUZR=cub{KWQ{lWyZejmtyO`AcIu73bpeg0u# z6}RJO=UFin-b?z87u+Y2)&&3kc{!yNJxvvFYeqjwwY8P9-@{n+W6v^vX-2jaC=(c* zO7OXxq_>z)X;OROnH?TR9+mq(_71WDxlADN^14Lj_Y!)GE_iX>H9d#_s11v{)KtpT z(lO~!h7z*(KR=aso51t51d@y{2fJnU<^n71grI@ELAP5Eea3fGztkL;;;7sc-dk-3 z));zTUOK0so4kRDv@#QQ(4D`J3HWl5IJuk~`Bx)L`Ca z3{ybBR@5Oh!?n>e6*?3Pw>zViY-)NY&>8gmf(SXrIsto|Q4fQj6|bH0=Ev zz9w6HYOQza+mzhxcL4;gfszlC-<}wBu-)NCM&7YG+6pb`y)FX@Qrt{RqjV%U=M^~_ zTF7$G46QEa^{qKnuFRSV)?JIvTte#%Ygt^H>SL6JFMJ_iX4X zfQG<>HM33JQRx=hMLYYSPQnQ1q{-O`rQg8j`>9?7i3ZhoY$7yP3$E{q28cPh9m*+~ zcSJECG8xf3i7#{<aT+f1n@~`aZio!W;*Ny)p!HlO?`)xMx#s1I=ds9#OP&d` z&3dh1ODsIZ?1)}akQ{DbC~k_J4jwAoUreZ98RN#v-z{blCe}-)XGogcCxjQ^=|!!+ zA2V-F6LjmsLA5TmPL;8UoAcT+8XY@+UD>m$j)AK=bMe$$71}p^1=KB3VMkONq3n9` z9|Ez35@r(Yrg$(kqXl?VcS>BsLK;=CEUT*pNcy^ISQ^xH{2p^unaI@6>yf@%y)3rw zA(YnSX}@FBJmrOdQuyRY`cAzP=OFl&&mcK03dP1wRSNy>8~5(P6s#tG#A<0rAir;VMoXaM25oTA10Q)u#$Qf)n)mLZv`^qO{hf`mSaxO3bU;f7WjYIICMzWJ zxzLEJ;UC2YA2HuYLe@I11?`F>R`QPAYsE>2i}-?hR%=caW2$+|18mK&oJrE)b#|xG zikHl}i`S6DNe2A^Hr`1liHoW;N4PNg}*2Q*C1Ql)qmLH22yn*xa+UI?SLm!4YQC53M0oWSYKa-H9l1db$q^~ zq`6LOWS01xef%nOWDU+(QPV*U$e5_Kuo?k}FLgAH z6(3HW;|FMs&P~x>&owG@wLJPNIg;=e8~(c8D+?%@Ah7W!_lR&|@l$T{`$fX zrzNNtr-J~hQls{PfoFA>yTR*6zoEYB9{6L=+z)|(DkOvP98Vu;W03{KvO+txlvRh|G$ z*5^DIJ4Zy^y)nbmc}Lvf>Li8WX;Q-+J@JIr;cdCR*P0LJSmDc2`o4z`UzuM`RB+_y zMIS44XBHJ5gh&Bg*gP>`&+p#1HHm`5}*Ji{#C*dPGq+YEBK&R?c>R*ailO_nt}OXQTV4N zpUforFyk~r;QYxWD)9|)PLWGM;4nSY$N0!|?C^l7Cn%ArH<|nAGJ??(#fn79o#TWK zdpi|2eof!sP5XlEp^%@xKWbap2glv!I*`$a@~f4s`GuNoT4Ff($`w}=eJ@1RBxkPr znH^->#CV(Tkcyvggsa-=Y@nV%sm46V&9RpkBu?ToT@|rg&FwhO*4g%9WwAI* z>nn4WeP=_zJ}s&15WVfc^_Pd%9=p||R6hT6JC*gJnr6>V$(lS4CvlFd7IUnnOgxKxZmRCbd)=6a4uRf(y^YTWv$Q&2$*uUreTjM2Br zBt>g?ZJ3`A8XY!mW@5bQ38ZAApaCEfLIcSh;Bz3GnoBIJf>c3BnJ9ERwIC1e#kFSnoX!ak;XPoGautNr=gq|+-L zxSi=IN71{pQ!&5A>B@Dd7&6WhEPA2gUsYDAoVTt&-(Q+|FH_k5dGQ3J+$CHpv+mbL zx`zc4@K3Q%!q&JT0X5#^1y1kqsK5MqFN_haS60sU^H(bUDXrRJ2}YPI_z%?x|MM=IqqOr!6R|~xhwKw?!#pnzVS5rS0;g>2k3`pwJ*cdP3ur_lq&ceuIOg-++^=TDX!7V1|SnwfPx9FOY3q9PYJTtaRaax|0PbY!5#wyMt7I7Gnf&3jM07SqMvNJ4JToiv0b&C%nEZXOPM>}KTG;z9xp z%r7GT-7&0s=Jv+X!_uw$`Nql~3=MOP$m2V5aSCjw@RO1@LVdc_rjtJ8_|Ch8EPvOr zFU7;+B4xhkwrpdv8=P#weSfCi%gz@-s$!1AGAjOV%7l<`q+${qRiP5-`yA)aJE#sW z>|90Le_PqfCn^*ZJlo)r2|JW<+ZZU*r`?;ce+3S=t7{WuU@+@XpLcPVmex)l$PGN5I z0b`M7;p_c5uUyB4S)p2&$Ulcc5y7Olpyrdrpb!^FBSzCFm#;*snj`9Qb7pfo=e9Y- zsdsc;X#pZ*Cqs^_MzHBtob6S0^rdjF@*L5E=kXRgFG`#JE`QYFA%pO735f-B^*bL> z=H$11LfaKQ$!!ZB$bN2{&TLkgQJ0kFdwJxR%594U=?6=4A zIq1tkt;K$qopLcLqNf9(zul^46(tCEX-{DMXObKN$c9e8H~9C$uC$Y}s410O6lW3ov$ zde*{RU)|f^?B~|a7IO34pMB^YAKzL8%3Wf9orUvo{RbvetHuA9nBRpI#jjT65(p{$ z?CDea+hXI!sk3dqW4GMuNA=KR-nLCxb4kZ ztu{ft*abL-oLhTYJ-_e8WT~!P*r%L-3n+==XWQDonWNEgCa7fBSK~&P<$i&#-_K$r z+~V<=>Qbv&wVK^>1$3ZO& z(fIxQ_W~8Cg|Bb<`WE4~n?uGUvIaHwj>7ylW53HJ@*En!J8`WItgGcP;;a2H-fWTD z>6@wJRc4)XgVP9!?^4x4Kk%bu=fPLY3h09NGr5#bO{m~0D3}i}`DtY5e$Z=|&Fost z8aWHDI_t%z?Odt5IBF5ZgeC*M&+kg!dZVqfPu$lP!yWhPr4XOP>=|(X24mr!CCYae zhb;lODwoOZtvMoIs9Zl|Gb61H17EytUt7v0poog6`;sWyj2JFI!P~BW=aro(%m*cawt@l)9{weCxXjc{WzjRAVkViEG5+ReZs`A&s z21|xwII%ea^@jJwc~;jq{VJF!{3tZ7U&7~PVi($aKB-$e=(J4Rdcxv7?>-)z%&v=L zLP>8+~>G%$=y@sb94ogg@RylhwU-s z3v1^plAU_DO@caBD-tfFs|-7~%;1=mnMt+?W0ms1*5j%6d6&G)NCIIIT+)eS7cB8 z4g*lso%Uw1fn&n^0rV6qb_PK=6dcMXci(?lXVfWX%Lh+br%Yy-??9L9A)jI2K9Ewh0|!B;Oz&5&R5K1~U#s*aHW&AFX7SrHR87XYO^^*+SX^c-0K_y z@juaT_7%Wz3KQ}@o5_n8M*xR?O|{aT7Z(Fq<158J_-v2Z|-MoFc&-!fjv3CTk;e=m)Yd8J z1lqjWwOC4ARt;&qbLT3I{aUU}S?7ndghGGqnKU0n^tU3;M{~sd?53K;oomAHqBB6q zn|F2<#r|tOqdMgonO*OWJ~5mfBEimOI_0*~(%4umPn@;N^p?}D-nHE9ASopfr0^)G zM$i3;@7v`GT4%$rQn_CEUl9{ORn8H))J(3I&nwcD&h2_n!KX2F{yfznm#fBM?lF0A zHfw8H{fLz_d>2Fu1+}VUTqHfW*MqUbDfkwF;&2cD$p3b~b?)oi(+~^@26Tu;v*7#Q z$6w8UhmnLbpF)8XAGP^@gPd+n?0W6ZsNnA!3-LCU^!07f5kTBbcheuR{j+}~!|Rep z?>3Q@whT}u%Ey{jSmI<8?%3MEWA42;Sh$DO8v4M1rm*ObTc+?jTlfx!d5J&>vH^nv)pq(1E~Mh zVmH6?6yl>~P2Ub>fuVZeD*Y~HjbxUBqJJOx5IQtgF7G@XM@$t=*8HMG+R?|q3x<3g z)rX7>oL_M}_y2))`V71ZIha+WkM?&Z-u|E#cCV8TKRIEpP$4D~UvBk1FVVlBnV9&^ zbN^kuL=NQRcXn}cM9o~rWSLJk`qg@BDbFgNOr=WZ)czcdhLW;Zplc(t%>{9cFlp*~ zKv{u9CF03AnBADGS$Odkg<08KyH#B-j$F)n=}kOMy!9{vH(mBtp1k(b-UE0P_;i!o z=$1JAB#@yNM<|YQzy3d6{tef|@|^tkLF$Zw$`FLl$bF;ex(fV^nfcg49fHso0J@_3CzIB%dm$4REqu6PCM>uxf<;_Yu6` zXV)ovZYyjphQnB zP@$9w4NBm*8k#5L%t+=)fAfx;ondEsSakICgQ|GPi|6473&eA^$WTo!`dmrt5il92 z0m;du_Fxf`heZ~3DNurpCWa}vJ#dnuN!jW1BvsQzF2`Nh`#g8t3r)g5aZyv_Oy29m zKx6?;wG+JF2VFktBJUr#Y{$8&^;fYMM|<22LtKb*^`&wb{vie!Awbowv75dCZu{bi zd{G;v9MH#Ik3VGj6a6gcM$z72=MJ3z#=v?-n*S>lt(#ji@}?hj!);izlIheU;_^gj zMn+lLz1mhglfRi%N!H#z@eRION$!g+PR0ag-;1WhLonp3ml<-n*j%Uzkub!Y0N8*I z0Ge9huB5U!)?@@P$hb|C5))BlmjE1n8z&Ozl&CH%2oTe!LRe-!3Be=OYm&Xo!g>=VJD=huSkd_&^Vs#-5AQ_u~NP0qu!tNBO4%DR4VGeJg z#R=AO8bKTQ;6k%-2x>dkDl@cOsuUV0xa&i7j~iybXuTQoP2IuMsCv~EVc)A zziBLrhHIISu^+C6>jizj+bNv{3SGeQN|$5vdCJdNr(%u#%4>rUZx(&+GP?5LcK9AP zU%tc1f>G?X>U}d^{n<=6UAr*#0Qr$Ga%?oOn~rJ^21e;?&mW|Vy*yaJza$628=Fut z4iZSs%P}jomy%i7zM4vRhMRTs#uMHRgAsF0KI248(J}_1IcO3nu zp1$kF-mlMcF`fXUSt9Qy`h#0~McQmB#olhV|BPVCe9raR4DLR@!{P2}RI7wtwt+i3Of9c|!M+>=_j7|CHNa?w*>U!&Vp@c+pvAf4L(f?70Ug-+G$kCE^2COVAS~xyZBH0zY+u-{chv zdh+ToZzWOm7l*J~EzMq>y(I5TX18m>e*P+&oO>!)N{p2LNtIj|a$E|FO5Zo81V(@s z@#L?Rph&~OU(*9Haji!mIntkb?)7jQ1`4`u*r(*+lCo)4ZFr2xYK29nwJpolN0z`O z|G-}?`Y%C5l$1ap4e(%!eBVZ>-Aa%6i|pvb64<3WhyE+sVAX5<%RdOD675DA=Mw`f<(lJ z89b}a!{UYm9#mm#kF6c8-K~ACgZ?T5t~3zXp)N)?wMf#&!1d+NSQx-rOn^(}09b7r z3MQV21)$`oKbK_OtY<^V`?I+8VI=lfWTgLowdTj-{I4d(2>ZV%RI=d91)aaQ8Agx< zIo2-oj_upDhavLDbvHyz&#H~C?iCGO>i z(GC*yIa!-?Y6TUkX?1rt4jcDiZP$`#!B|KjE>eG=eH7KRpQ|g;8C;vgh0EjQl3bm} zAiWAsBM(C@j-8(u`!6?YH;1z4>iJl4Js8dhqKJE0i%aNSpW1W}vq^-8_$>wd>6YpF zh%>BR(vrJ6GXLERPhJ@qG<3;vxI28kz5A5zp&Qfob|WrbAK=G8&0^Is2PBS#iCBnu zz=~@8*}(#|8}e@W_T@T}4eCoKmG$S$WXTuIcQQ51i-ajJu<9{!9H29etS?jafu)rLhjMUzzv|X4g*;kqFti$*Q zK4?Rw-QzPZS>SV#-emI(ybL&+4hG%vpUw?{0)Cl}!5TJ#?=(gPxy)Zt{Z+h(@V<_8 zS*8ZC)Zr~AnC`NWmn=Ga-|QnPHS`oWk{=9o=sY$F6`;a z^n?j_!Nr}k+UkIWZB2l`TGiwFH*j*c%iGo#|MAbPsx2*BT?(l`&A;Rqr?H(IEcmE; zR9o$zTptD;kNPp~E}UKk4GAQ>W9PdTlE3q+aNmX&)g|rVpd_{%#St2_u!--O62I*4 zQN$+kTb5Rr%ky^@f+V`|FA-_8l+>x_f3eES`ziJ3)YRj0xVzMU&R#z^GwZq5GE-1WH>iC91u^NY0N@iOk%HdnI_tUq@VtK4ohAGY*>)`*{E&go zEw;nq-hJ`;T=?=sr#pu+UGm`)7WY6T!d#nSxe`Je9i`6fc_5xw5!JZnx?PGZ0nOk) zShv9BomQCVF?T;~fGO93=c5OletO&~Y1{es=Opj)A~R+HHaNELM4VY(Ul+;{II7u9 zZhX1rgdcErcpfosT45ss&(9I)>ex(oDv-Eb*-S^BI+#Cgs7AsIe!-qDYU=0PUvKuL zk{|ZW%WCF1zzS*04r`<~Oy}{+Zk+m591i^tsvAyC9*LP9Z!NxzbrSw&c{f^@NfU5T zp9p@vb3S}-(`Y3sk`FHp$n3nR|l|O+Oj?$bCTQvz(2ef+#UC?DXh2EpZyV-4ksn9I&{1AT;>_PP{z5h8^#jIlE zlIo?LoXoFNb_gi{TDw6)^AX2qI62NW4lB4X|Ap9m>E8-l|Gw*W?Lz6w_l&$H=#sNK zk0=fmQzm{E!h1Dln)<%@B7FAhs_yaNEuy+ZF0Y|?^+UvSeBQ6@HA?mrRkm=3h5L7R z5L*B0^CNC{-j;N6e?HbpT!9;UwDkSg;Xn>TYjZ*c=IwpjA2kf36>u$)=#K|TQ8vcErnAKwM;BlTvzmlMejjW@+LLYH>-FCco4tVK>ri>>_Eg?w^A^D_O~S zkS2QP6mVFaell1Hm6$Bltu2(8$w0e|1#yVG&52!3M0RmQo1w4n%0U4E(&3UHDu8eG z8oe6(`gZ-}VeP)A1UK@qhRyh9;j*+YEiEk57hb%;6uS(^$k)((4N~Jdo?e`SZaN(6 zV+L+51^O5G-~Q0Nv$EHAsYafyoRJGpCrp6UHnol3-leRF-Cq8Ra9L_bz4Y4mJ%+X6 z;}t!8MV@0nf13Dn-OLO)9FwO*eJ^oSp8i5iELtglusqk)DZ9Q;6Bk%-tFQ{IRW?Md zbHS?*OSvy!*#G+3K~I}9cCjqcdUC5p2ua#!MHCfD_dzydlpRWOY4qp*x2i>T zy}5L30+B|%x8)Gg6t&cxjZ+2r@3Yr0US7BA-hFZ+)|+6S8n}k9@P;9q`EMF3WrU5L z+-78ZcQZZqr_0#Uu5CtP2;tRrut3gD#JyXtqA#rrNQwR8+3Lb&O^eLC+l%7ItsG}8 z`XvKhrBCBU&-Z&$Ay?xMlCSYnF>gJ~lJh&&8|OM|%hRq}KPY9xPhwQW?4~u31?EpL zZK@GMrYr4tpk_qvcbv>lv-;Pn^O_yv@B8s6Vxv?9zgf4Ic-keu;#Etwoi52^##?@} zmCB4ads{ZzwC?Z$1iEt=)_`#@OyB%S99+>=L9i7oET4m@t-Yt6nyF6`>j~FgBi_4F zgq!B!l3v`7^TFkCiqCM_YScE0sch1%Jg`Ps?GufS(ITR} z2w67Hg0p?2x_Y5M&rOIyPdDJBe698)g5T_5HX`hE-urgST{W#x0kip0;u2+xM@OVI zU@JvFQu>Nw4Y|REhF5nR22q2@d8sW?(A&+{=8H{Sn~2uCB`5B<0cj?{!W!P)7^D4~|bxl?L&OJrPUio$tImQVd zvh_2yR;g^7tsx8euY|8TCax~aL9~~XpEY0*>ytMNX}%?LJN+R4$H+m%O;l^I0qn@? z;AQ<@GaEu#z~i7j+$~sBD_WL3`rIl@qb00gbzSf;ISgB4Gcids?brS$$E4R^x3;3P zTI6N*xlFsRNastwwTFz6?fhi1$q2LsGJ2ahdRV^bu_DWhU@A}JHS;iPgiY#}AP(m` z%YAPlrFezKxHhaWK>>9fUx~i>*PqzV-AqbA1k))z!%x;H;xl#bK4vAI|DaemfLBaK zshU8(ZEq4Y2O=yt8e_N-YXiu|>~Cz_$_Ag(P9~w{1b!ReBlrY)i>Iy+p?L7S7d&j+ zp}~sn(GC%+jD=sAp8K1(Py86{W9SWEDgAi)bwO@CSG$qOZlkGjT{c5$uGRf#A*Stj zCv65EiY~;UhMy2b`yEI(GLZ; zh@3J$B-LGw!$i)O>Mxhu;Z0goHO)ycI1i66h2#i zRL`OQRqxs(zWc(Cu+iP;)KUQBzwJjO4@2v)T$Do>N{}Rzu}vSgRLTYX0;e z{z1xS(>&hB^;Zj!0P`%@vzC4^%fR>dQ!{f?c(cZ4+_)%Vd4fL9RG{{0C7jD~O&Gw4 z^3d_fXg0$9AyALvLo6ye9Mb4P|IjiCz!&Y(>nHT1H~yEqurR$!d4|m5v-&}c7~yqG z56~hBdvHxMk>4RWpo)v(h7mDto00&^AyV!ViFnVF>aJA0GRt7aEUm1Ca$I0Nm{BB<(u5>FwoqOyjV2bQal?R-x^%5~D&D^q(Xy%(#v9Uo3Q!9P? zst#!sUuyC&mDE0hPXxTs!Xwtq+ZPiG{9qrv!fx<<_k+*?pTa-vojz<$r3oVBo7^I| zJ{E#k>X-OLt^$w>i#1_efe-vv@0fL7}JA+tD-2Hg+y?#UTGpWL}lC5Wv7pj+>7b(^*_}=N)QlG z)fw@L^Z#@MU~`@bk^Joq00ll=CL{IZGOBy_wmqy^voJ?IV7ANfn`ze#U}sv7LFp%px7BG>Th|c1=I;K~_I6kT(BTsq6mF`7Aw(zLZo^`j zPBQNvsOzF0wju-5c`atY+vEWWlCd(w+6u43#oupKt2pTc1n?k$>=W4UyJ4X4Uf;6)4dz$ zO%BS8Goj49<*Oj==p8SGx85RId)?ue38DAYg-~jXW&oS=JICZh)WxM=D`_7;o}Kh_ z%iyWK{pzy%(*>1)1Wk*v6_q{T_k5@2)c`~SWc0?}M&j$%%IfMd=>R_vBO(2oZBT9d zLL%tU^~eo9gkVXEn|lnbWKA}lV!hSVW2~$|&2!2wJ0O;RmFz%Q_w}y)0y>WCWSJ9* zYq}K(x=IXVi4Ya&m=H)79TjrwWv4Fd8ZD+{biUSM)^Sz!YqPq$IcLhZR7+W@`54#d z<4j&fwoaa_lRLdXn)i=<)XSG8ybJm&J}9-&v*sNQUYvC|#67*eqoDLM_Wtg$9EJb0 zWrmY~Zs#4R+LQY&$LhlpolFKXPFLm32;9F52^(T~*hcfQ^{SWem8?`lR=X6irQ6 z66j@U0?yQxr3(rQ*pk4KLE_FyJ^*fK|JbCFJ&< z;S6o<)6i*H7&>Pz-7u3OV0(w#6*g5eVoJSzLVfAVjn#?D6CA^(qgH9&TWvRepSjhr z*3nr33vd)}u2$nc4tbmwMXO3!{zICQRDAl3}No>y1|Aol_l$-dB|A z%9VS7OgtoVvU#%J57@ZsFOP`Rei22QSfU~8rk3qqQA+&4?{XQ=5sUUV+np*G@j7_0 zI5ghiVMkJ0_ATPN*}OLi_1^s+T~34VLB~#ydv(z}AMyb5Q6>BrPf#?v;%u3I)z5fZ zd0`cK%5^d{lupiY9n? z69P8zkx9Wu-z7ipPNp14yrq`U$2n_3yfjkJ@X!7CgwG1Q{x4@;`(K z^KO(-xOv3mHL2&xcgNF`cPFF}*5~Q2Z>7!M=fW*^_e^IG8c3G1Ts(lag62K$ujm4a z4!v^}#TF*`lITZ~oy_~2<>m%~Ms_kl=`|9Af0bBm3?N@I<12Sh1h| zVXDrQ8I7=W4|ot%&PdJEn^+I~E_7;EX;|P#;&5~erdH6{>2^+#INzmSggeze)x^Bg zW&$l+OUORFOj{}_9GbNghzzYKVq|)88fU@9Nyq|O>gOfU=NoH!-5EEO+qOI~ZG(8K z0FQ^9-BqVKxd~0uv;Sa2dBFeRK-)VqPOaSFMU2REEG$|efJDPr& zF_bNWNv<3!U_FBJbRLLvXuVP60y{1?0lj$0#>R#h9aQhS9&ou3AxSVXEP>>Zj+(#R z8qFgTbVR2{j{|-wHYSFWh)z(cGitWl4g@^l5e|+5)(5jdLGOQp_h@ZIq;nnv2({Tv zS7bK|WskQ-hV+D3o7;F>h2F!&TdD&5pc7_CRE80wkWXF(A35|j{Hicor5WX_5~ySX z`#v+rs49A}V39=hQ8;^bk}b;=@Qj~i!r%qAlO-ed%8;wDhfvr1XZP=J0ogG?`8(o+N5I{z=JaIS_*~^SQE+4z?>lL{GXQ~A;GT&hD6c6H~rw7SOCLc*# z7BX3dn<|e!(>=+_{u&##_4G-`61!jq<;y_PG*oOEoe+-swC#F-X{}!?EnWyOn(3p9 z^NaVsleqQhA!)UUzHNORFQ<%7uN$1YIL1CME#KWdeW` z?%QKmRe^Um20biBbw}m3i_tN_xoZzaL?MVF*x1;!%>lO;L|Eee$?RThJ%szT!jU-E z>{xt4LKK!n;-9=&h@MoUns-JLKC|Ym`jIx*?Qah#+XL&A(wY1Y&-U^CSo@F8=S6~o zzbw=`%-y%4^DYrm2)5a@@TIln{Ei}P*w{1s(7(M$b|BHLKz=EVBSX@J{sX<6_jMGf z{st*8nI)SnORA)-t&}nWEsw>yF5rKPJm*-C1=0ZeLmLD@d=!UAy7Uc~rkH&KJQFpQRD1vx%RFK{a7Dt|!a^{W(v^&yWenUv#K zMztEcA4|Ha&!vvbqze_|X)22pzA#y{a0N4LRC@L*7j#l3KEN}YT2&OAm@7-@b>$8# zvuk`svy=H5N9w`YAozS|^0T9JKhbZvlNvm7bg4RK0>5fX1rLMW5evw>O1nH5bvlv! zsc?9%Qja`QB!)BW`>k~24Ua3jd_N^l_A6b#ICDwXw&nwyr1}~9mPlI@X5VgAiV-Y+ zMhhGYFaEENbb?uX65jK$dY6rNi3)RM@8;hKxd0GqyUQ%#p)HAPH1?At)7qHN*exNe zb+<7+JNTr6ELx`QC!O(_cSLxmaUZ4Ke2P3C1g;ZBY7TS+qeZY=i@zW^JIv#qg3d&(GYaX&0F|RL!3*3-^F>Yu`f)h7&Ft={Rr65wpD^HZaFH6kJc9vU_tM zeA3IzXI%Inal`17IZJe*2j8SW8%>qz z=dCjrNwC@HzUV1vRlBFac~0X-o^_(eohDtM=Qfoz62sjRi6^m{0{?v!8J}c{0nyT- zWA}mf(U#plh2<)LY)~?5uKUx9=5Htq>g$6CHD`+Nt+M ztf-Lbl+$z(wWHH}-F&%Hoe^SDw6v5MpJXeT!GVEY_}dA5!UEAbHCs)u7(Y$>A3F%2 zrCvo=JXx|c&Gvc5wX;ryIJcn~j4L|VpU%NbN=Qh^$-&!}n$l0(nj|YOE(X9pt7gG_ zoWw6*7-w7^=4#48tt~iB*V>6x_dWX~2^q{&^f)N=1fLn(bE+!ew!%;PcW~(EALa!w6uN(lFq5vLc{`qc&xn7hW|JLY$g(Bx+v)SIv zx2@-2mU5@t=yZRfc}=U(^_yAHOVqb=^K0dn*(`H>X-hQwL=!@(%zr|VLB8V#Si}q3 z{J%lfnng+S`FUgW(Hb(VwcbE0+YUzsKC%1pT1>^11L}Jh2$uh*H(6Ldo!XP4dPM!Y zMndFXL&x;oCr6UF9!kTrQOZbq*$=l)>{NPhk|?gjDaQ>K)p{Gq9G*9AC<9Kr zGV<#V)oet$I@6`PPDe{WDybzM>9>tr1MdnUfjFzgKi7aTo-rCB`-1-_)*04JaOL!y zje&IGn(+b^0C!TiJI&X9YhktTw|cGQc>Y%l$nlYv!3Nt9bd$j=76P; zpXDGSD-yan!sy)GE`$uZ&V_f&$U7vK6W?$|0bE}aHo>hY=a`q_qtEpPEjx)tspH+l z{zaTPeuvpyliprB*F`oQx#x7Fh_wVfA#<&ijx;}LJEn&W86xblplKWqSs;6lJdG0N zw*~6oa3{h4N1P0W>fr0H%_fg+}}K?D!e@_ z&d>A&vC!OI}W*w8qy9&Yr+>`Qo9&9R6|XEI-FQOs?mW`y*Vfwc1qGK zi++ckx)t+h+v9|2d(UT3zJ2@l$ZEP+Q-SKO!gk(sX|z!Lu=mHpXh4cM^p@&ryVGLR zH4rUWx&|Q4!^h9nIw?0OiQi00E*#adpgaWuD*ZzN zm3|Y!4Qlb9C{ia3uklYTDiGzh59LY4tgV=hDawq z;86c8TW(OTwWZiBO=TW`-<0WGsmu%Aq{>poJ*P58R_UQq$`EmJ){Vo{A_L2O4=G(~ zV^|j2C6OD*Grp$Rgyu;J5Z97EACkXg1jGcz1GSPgsBb+>p$zX`pvQ&(hSd#5az=r_ zxJN*E(Gwp1tYRP44`~1<8EaJk2^Z0%2tGR2YkX2Tbkn7Ns1f`cb$Fc2!j}uObgP{o z!!JHRHyKZO36Pxyu;E6(CS8X8yvMSC1AwrXel2x}QV_MrL3r1UIk8&Z@~oTd@2gig zbuf`1{ny6t!q6<<2$zU_|NcS!75wzK#1`5Sw*QtdEcU#3sg{^_kVS_D0X(8;g3!7; z!9QUDR!M*Z$|q)-4`pF^&5vq4P5J!!v%geZynhDy~JMC-o#T!T@WsodYB!52v&2j;Qdjv;r#CK}oS zXe>AA++N=>7MJw@N^YzpBy3uWiJ}j5oo7x{Tj3ZGV9dZnLb(En(5MM?^8I}|vc&{a4nwbuqoqt}>REn}42!^!YteO>m#zL|B4 z-Kp)K_!!CwQAu)L^$sfrjri*!{drssR#Q^RDh zdSId`44YWAMb2U*SIXa*;Ll?taK*p|EfuMWnuII+N1d>#p2maWW@|l(`ZUqF*Q@oL zIia=mGVh8?gDzpM|UHVZ1%DPNCPfYY$14CfyD$$l;D>C>lE zMe4xR$2kBMyw6sWPnycNnHC!MP z;6Ol!0rU(e(BF6Qnm|98;ciB?mx(Qf^-)O_SgPbO86C#pg4ldrJUv{5n-iG)@gsV3 zo-Wj6nFA*1xi^C^0T04?0?IA%r)6d!Ben=ka}g?5+fE)dUz(8W zJ*)KC)tRXv3Jksf(3~A-Em^>l)LyY?1f#wfEbBN|`$G>f`E9GMM_vhah*!b=sEKrvgGNVEC6qXqSIxe=(k1 z6C5k4)7Wbvzg?zG|4|m1mo))__!~Za3SRV``<6WxyGlw*eZXN`0$K+d7V%egKHw|fpZWQ74_k%iU#Ui)4q?aKuRcx0UZmjR^zdxd&NmLU11y(k|yR? zGsO{d?}zHm`7S2JIcyjpxr$L8)H|W*c(My9ADC4uOqv@6ff<>(fbcGMXwzpW>IYi! zfbRLrH;63)TIc^~CNL>aR%3}JAYeBm*|xe)-0fYfb*#wk1%>t9<XZv53N4en7$WAM1=@3sKz}So)G7P8!+mjSW_|&o(-$}#L zv$7tbVn9YjNP5W(;(<4fA$4fE0|=m5ova6dI`>#2&>tZGau`7cYLO`~Ap+1x_PTQ* znZ}g!7#;T7Wi}&#g0V@FfLU+pzYk?y+?jIh@lwjHwEroc*Z=Y5~bXC45hMFKsSM9ztfqejU z_Az1HGeWq2y{ko?%=AbcqJNZKJWH?AJPJpVt$?BPaSzwk^~L^Nqx*JJzS7^)y4+S< zBzXG9XyW2zXL=N17*~E-YJSbs?S$AwL_}lb;|}?l&9hH{+5?<5HupD{9gl#6&*_!D z#+$%KCtT+}Qp!gsDfw6}I8V4#7b@AS)^J39f=THpHNg?Dyj!*?y&3K`=cZ(FFRdhcnNSBU-X(~-oz z^F12^JZj$U~F-yAHGRlP6EaHvl)m{45b1**JMTw+#} zS<5Ej;o$*N>v6HMq{O4{9L5dbx2P9`sSPWPgnpf?0b=@P9xY+u>Bb;AhNSf4=hnH3 zEIqg?T5sNlH;U53bSkobiLYU>B%@7~>Z(#Thuvc`1p>0bN+d~~$EXkJ7DX~JlAe;X z^$Cu4VDk~oOSk5CT|7`fUFS}@tp8)bDZXAR)jNJnO6G7I*IaeeWp@aTS~$NRi9%{8 zzP-Jm<>X3pztKrBPCVoB0EpFKq#gB%7QYvG?FFTQFOEIep9iHJ`^>kYn#8AmHofi!CJ z=9&FkpSv1;Z=I>1Q}=J}#+B7sI%)}FfHL4-amFEP6z*zr*mbnR)=;QLJOQ&aPUrbq z3h`giw&wbzSdPks-xgk27!4EJ+fE^U?cl#34)?#W0BBG-eg{I$lU*1CMIBX7)?9NF zIgJ~%!Ux}@{0+E9vI8YS2?T4f%s;dPLF!-S|ECt#i}k!39b*F@{RMf|LQx$k@*EQn zkCg$4^PeS1V3z|n{uWy~ZD7-R*KQcwB(WBPiH&V1>ffsanqUr#$E2HJkkQcxNaBsC z&j}*{>HY5x^ofU7HQHNr~4_f@_Jw0DX{d3%`XgAKfd`)Wsye6_^RyG%YX)bL^S>m7yvh?h(5HW2s>H6BBcE@V)L8rvCA^zQ*bI8 z)j0zuA~p@|Gw=WA9EKUuvjDjE59qq#z-Oidivr^YNBrhJ1RkVEh}*+dpc<%T@<$Vh z_+ISk1Kb6${r%- z8kzu{(>p3oz#Ae4_>7JKM-%fs`|2GRAK$I}cV%3O0Ic37dK$}dK&fp+dg*g)kEjO< zZT_p&6i!2(@L=?$v@}8Uo&*Kj0C&K50)!Rd+TCltALgpgp4Pn}#BAu>b@#*W>humT^>)__9P$wlwjSXr@s z6`&@~?fNY)fGh$;08ojSfVR>G0f_1T9LPVF)4m7LQF}Z9h_yQn#UBO)bx!S)31El{ zaKinrj+WQf)&Plq^%MvrtNaF8w)1u~f3<-BC%`quYtg581(4f>auxy|%fSo}K!vSm z6=hjL)e5~mY;6UM+TYrFl@tS1#fid2nbCiK`nyZNa4R!riWI%=2nN-ITfn%4`rY(c(S`kl70?}Wt0N%aE zGW`_CgV+DK7+=#P9#Eip+~ZrT^k8CQS_eR=bMPScTeOSK-wsCG#zzSOr^N@o_e>)O zK0}S_Pg-sdWazMV0B=eD>rD%w&nCCIFl^B|hxwvu`X~l1u@I8K&Jr92`ft4WO%H&r z2uJ?Eu@#`fJ4f8m1>aK_(0ZdT4=B4`E`W%@wIiP*X;rKX&56sz))Mk3eZBOzXfa8# z3mV}2f3rD5td>|8hn*c-sUWUy&w^?#Ti#T7 z9*zWR^T*L3eRvUdpXSE#joi*ger>Jfui_)UcI-eezQ?{iSkbk;&_~wVv>;PrZ*;fc z`^6VuZ%&W`$iM?we2<+8R^x`}2mr((rpgWJ&7a%Pd<8gJEifD6>gxKd(qb9);Dq>& zS)7=N$X(4>3@Zc}h0ij{Mn#TDX-OJNrS+x;-IXcUjQFCTIK!`weFZe*X~fK>!s=*+ z-LW8mSwKpPf`&f-30JGah=O;j6xxE*4S)v$$N5K(Q&N~Yg6W*$=x7o1-vIcOFh}PZ zi3C*8Z9C#He8NsG+JS1C5R+qi$rxbs4gvONHLhbbaC?9omDxIGr)tg_^@m9(WOZ6% zbpP(y%G45pXPvYqq9dg*B~f42HM_L8$Y^H>;KC=%EShCbe=27QTkgRY4JvQT9O{B4 zpT^OiLOxVePO57QOU&%7`7!)#URCb!y0_Hv@Ib!Ke>5u4z2N}XhAq=$Al|w8_S}!9s++NAn6OxKDMLYF0uCTnG4P?nGvC3Bh%d?%78|SX9n8;*r+KC0 zC`%rD3=t}Jtb6Kt>1C==2!**cDeY$-Yo8WqC$(IG+2bZ1?{@paS`F6UsqhJ@J{Yb4 zs4LoEpM>V|Wl$eq3Vyoq6$xV?Vq|0lCimu)@O`W0fJr4_6}7h72Hx?^1FZ8vxYvSC zThiV6I9IhAfciF)7;!sgCe1ehVx^aSZabj}9ddpg72LSOhsvS07(8&s|mo$`|SpKWpgl>`o<_Li)ILVp}- zXJ-HgW>YpWRRiZRX-exCtLz3gI>4U~pP;r;!=z0U82C~+^wFqGfSPx*q8;G*PJClL z>i-0|**ebF9vwsvPxrspwEeFrceU~`Z-BbB!r6MTW(y{+QK;C}7n;+eQk=Hp!s!?Y z{;|xl zZvy%!ubuz8khT`;#Y>31LMO7#+Wy{Kq?!mUOah#N{9mW6UWS!josf+DGX1-pV`RCP zC&z5DNpQ&Cu$gmn-)0&U$VmGSE*>KR^`)O{`>ay zy|uHl7!`koRaB~$vDC(U#ep-r!ehtZs~aR56*Dw#^48p&TDg=`1$EvMJ zA|g7m2fguP9-G@-?0zGEPHS9uF>`FPc5+|>(SAp6gVEOY&yrj)Yl9-FZ38mb{!-)% z*5B=JZ77H6kE@XQUO$shV2$HXcO-^}g#FSY=SqqA;thLs85F(5IAsmM(p3YDfapKI z$|Di~29oQ+RPhKnss4HOq)P>>u>YwRsxEoWnz2jvW`uS*xP>FbeMb;J1tHe0PIH<}}5@{G6(y21i<I#uJxl;vue` zyE{K3p}+j04x@>^6g)X1A!2*x{WrxOzx2LNwFiakzg4QTYH`_Wu9W}_v)2D6-*Tsu z>pvB#TYnd+F7uN7FMd4wwjt}!_p!pXxlVDUv+7TRgV3JeEWLv$TlI@V`roXkG9J*BV%&*F4HKmlIFuD(pnnQ#f_u zRQsYO@8!j#Ht^zsf^47s_hByY4iDzBlB6W>+uN?aJeBGh?xAweM_Az+qe zvLjd1sG_MU<*^x!PL(##8wS3iBW5hkm__I?Y;NkaT})JzIOOT#&)k5-fCg6pBsf2> zFbrTBuKmJ%hL?}}4v=gfXQuI4BU9o~it+*@>7*#|huG)UXNkJW?+N{p7?se}P^NJ` z_WyXnA(Y_K{=bnD&A=6dSx!;x7v68!&oCru6;lKx{*)1QM_lapQ|-{0s~~(pb@*7q z$aq9hMt7nWnUTV>@f2XXJ;OdcU_Pt;qXl%vfWddx4?k8gP5Lz%i~7;` zbTbN`mhOJ4%}BT&%FO=mUAI|IoC}9hbtQNEgJQi0+o-GCOq8s6;5>c~=F~UkPok|l z3$wV9cEUni=yLwtlDO{0_hEgr z<4?-hjaBB5+m`9eQE(z@>7>iH*k*FES&ZeSU?$q~Y(QI0Xh+Dg zd#?8D-5bC4hhCxo?Wp&!f+cSMUkc&QuSP0vqqpv|%a_;Ld^FEhjVheK)p|d?ApcZ7 z9&$+P8L zE&u)X>@OFuTG|5JBtrkzsX-Byz>7^b#`x+Y($_!){P#3a0Df@%GQ4&AhDze0>E?JY zKy-b4zAWBkP-A`zMuqI2M~fhDP!WWL9~v!xSLQ@#{KiQxh2GjL>R0xhG>Sqs%#jl3`MJq&EhGEqH-<1XDX7Isd@5ESY1JJ^+)lB5@XE?Hl9o7 zAQ@rg%SK2M*5>D+CVDJWGsm3f`LzuO_o}H)>E>@-;RppJ^KE0Lv5jw`yhzxZ=_W5@ z$R!+C4u{$0Vd#=?HLMl9gRZsHJW{%<=X`=vx#xs&oefMn60i-H&S5CjqX;j1m!rdC z>aRTB9E29@3$JmyeHP(&c0c5E({5r4BlZ@+Ve%^p7-D)wa;j~T*pJVDbi$Y^>B}#z zoh>fpxviskf@Z141tA*~3t)4DIbUviL*OG&@o0t#3QqLePYTFQozvDhcnS%nzK#f? zjTm-7==9ca>cxoqPY>&2W7Id8~q! z$gKSeq5T^3$KLmE2vjcIRj6!%oh6!}43zZYy+-on2Bm&3C{FJk-QPZe-W}Zipir98 zCiE27FVPTlT?uUa_7uQW`XY%uJ}SD>HZ=i{>}0$uEiCZNcDvMZrgHv+%M&+HoJ~m0 zf}{RyF|>i|Yn`on+J>uKmPvy>+;}p(VfULA_}|xyKYs408+MmjjDq~nC&s0ZTT)~vp zq8(DSYohYkoisR!d=P|*--c-h-2vuK1Utk)+ccFUjxCcLX`di%yRY zuUbs7bF*GHSpE=yedEJM<&hV~=K<_wGu39#+yFkB``}K00*DFPpF2od9&`2aOsUJmm^(c6AY|8<^*mRSd^%==_Q7@h&(v6LSz%wU= zbTJQRKUHJVJb1h2CC{lMRa}V%$D{4SSUk^Sg;9L%x`=BojxncoD#FFEsF z_L}`pFeD=NRDxN{M$9j9)B!w(h7o9Mfyn~GR%kj3%`30T)JH6Fe4cJGnYjKq7RQ`C zIQJWC614GV{fr!P$6W3i0$yD+G`kG2Kv z!2Civ75g7ke}}~m5Q*q8=KAfj5mC3e;?X!y4BM=MsW_7^zQ>4QlKJ*}f`-W%Ig>iS z7q!(*1K=d?Q@=JBV8B)?3vr@6D=TL0-I3sr2@GN)xZ7@qY z@R|~s;&usrW5RtUG14^A2yI}*TzpNjF}PTB<7v(bmRn%<{o-KB z;gha!Z@EdMCUc}VwNja43bCayLA@9)ZU~Pr$N7Ldt=1Td%n-k#9oq<%nd9rr<@fs3 ztK>0y;-Iy}bCW|-nj}q+$_4Y)GWEixe7N=SK|zgosw+paWYV#>oxpY{bG=>Idf2h( z36VdtQO1hz)P2gkIsWSzLOqx3bW1HVRDt)fpy2A`)|$>=XSTn*Fh%#5KfDnko+xsD)vFpU1azxZK|g`Tzo71|}& z_y&##kW=>?7oYcRcd3smsFhS=%jW7-7_jZz5A}fIRYexc`?rt?e7dSItlSkp+wz9( zLf#jtY8-c5W6H$1mhZ}D;~fwX?1t2N+HKfS7c&m=QMuPS1QxilBsGepM>9pVYwQIO zJ~(GKHVGabrAv5ow@^u9$F&0+@b8JYd1<3a-kS#bVh#>7r<8B<2^w$H2w;|=e_-6) zT!j>knAWpN#inc61c^PBcs9cswWVW?FU@_f#xCQSw87%ic8ts}lQXG;y?}j&S~Mt} z&i(2&@5!_*Dj0+$It{rWlb`LaG;St+zwAxxO8Ag3ot(v9<*Y#uA0!{9!tQ!;KY7Re zFsj_#&n(|0Lk{ebWkuO$qfoIsMK~Qr{>^NI$)q7F0C3 zWL|xR#kij`$EfOYaVzc3QoHh)rVg6hGq#82aW8-Vn0&0n%TLq-EG-stV<|@FzD!M2 zbTqt{XdVhk`~=I`?9GDEHjPH4m_wPHflP`7o;$bZmRg&xn{ye!)LrcP=wieUyGy;_q@dDaAM+vN3E~OVIHoKP%&W>w_hge0F7vsK$@JA; z^>dlOIydwk&3tWOQ4?3mSciC^dzspx9-`aC+vCYJz>7yNSNvd8FcgCn$E^H23~9b} zlWB8ar38u0rj-<}F(lDQZ;KB-X_AiHVnJ~|N(Ey?WE4Q;-W*3_}X z8=N@={GYH-HE2p3$uuAdJNQ_H=-g+NbuA63x=Y_-t?ENo`1nF%KI_?UNa-)?KIl&N zTFWpeuIt2ceNZq$W>6b24UVixjL?vMxV@1cr+n@uY~^0uxuU#Dy3WTK(>Ub0bIO1e zhMw{uo8NRdzxWjMynNlj!P$B>=0YtBoAMmJFdG2pIG=P#st-|*JyBA=BuYqmgYpLB zYhr}|%e$+s4RRvntMcL$-~k;niDt31YgOTGEM{}&ZK`SxOoMGX$@quDJZIS_-sD}S z#qxSNkYQ9lkd))(>t!_>ub^+8@Uo!fR?}$|p)c>8U$5Dnf{_$DD0h+3X7w^gK`?DpHPLyV%mj7APma?fPO%A-hJREjjO5Lagj55>=qJ zD9F@hK4rW~br|%44K6@AKbVRo+m)qd+Vc7t z8Ij{HoPG5Otd=FFqfd-?te>_JwJ`6JJi$T0;VN7cD^qknwg1hDp;A+b$DoLWO{1H- zWoRz(S-ed_Dc>!c`i#@N1lKBjuq=)`FKUm-`;uS*ky^3^V@6<~+*1k2mtK6BP6+XZ zeL-6u>z4&9txYSh$f!$3?!zPDX+ETn=mS-{ZGp*bJ}N?je(Gfa{P#7fea6c>g| z`|vA2V1$XLki-_>7~;Y(K6Xub5=u^^zf`*|(KX1Re`C@pJO{6fumQ6~sR;4Si!f){ zwT*uVp3l6qvISgC>b#6Rv}5db9)Z+{&rE8HrXnvn6xLDk^~OFhdB-ebCLSe{v2RannRdu-b1xDG#~r3l3vxSEyxaXIuGz3CXo zgGP0Rb_Y07923Nz_#Y#w=~KJAk3yS`W+d$R&7QMp_PY~57Cw6IT0&5_(ziArl24xu zX>6<*glf#Z!ShQQ*s0__MVHEX9!s5>yuVjnA6{%eq!kW4NdPpvIMT^+Nl0h1^sHk* z)}V2r@5w)mF;EC$QQKhf3bZqVb2J017#v^F9Df<1z?z`&@X6}`l z{uEuv&s9q>-vqI=cp4m2j=Hm@IMX&3J6sbU%iAgf;rr|aQT-K0`DXaE*&_XJm@V0R z$~l$|duf~ZEtVBTQ(rVP1Xb^PLw~Ru<-xo7cWBRE$lQu2L~!zDAv zdbW=JyI~N&0RPommYn$SkFy>^zb9439Q%r9O8Jj6v@(V1Il^$Lok&+lj1KHd`|5e# z5{*oB>%6FgF9R}}arFvrKDxH(E4@PWbvi4KXFBz!dD}@EwJzW3qY@Z<#@1=WE-ks8 zwkP<2pE=e*cjVC#m^jBTyV6lK7k8~%0hs-x@T}TXmUR|fIQuP|qyQ{Bw69uKfy6nk2`dbqfEJ=zq zqE0E-^)yaq<%UVJ-5vc@n}WCD4OGX4o9lRCqL0+{w<_8Wbr#j>yyWn@$~)5e{6Qkl zE7mb0|8;}qwSi2ar%`a8%~NQxTADVW0crXtuktG`ND&Q2wUJ*BLxl*tZ_3z!aJts3 z4$Rylg_LqCs+goA$J)7%E z@Q-HK9Jds9y|A&e;M^M9A%r17~fq4;i zZ2rT%=Vh|CDZw%)eaI$H`XXn`e#B2S9zHp&q~;3v@#}E=IQNO9M}umO?!^q-Dp#Dx zw*b-A_cex(?qQF8io&Qn|526Xkf+x)HO-(Aqc{gmg~ciY|2Fv~( zG4(-FE83o|$*sg3C2{K*-pj-|@he;s`#6E*k>0{g(x|h+3bgX`r(U$rh2y>!f>Q)n z)P6*fQtT0T4HcX6(h$S#qZq3WQu#!TRy1@{qzTu z_dmvW-t$T0I7WfFA9##kgWLm<@){k#?1DrWyC*%qN{o9lqkeD`UD)Z?_{BC2oBZy& zxb_ASz(W`@egH!cqmQp&K|1@izn0^(?twu_ud%Y~#?v@-oAO~Z`bQb8*tz4S81f4Y zLCM#Zi;use=#Je+X2<$HmPf6Xg$Bn_GS2bF@ujr&7>9KeE5E_~I9hY|=(BJfXV*Aa z4wK*JzA1=OGvV@B``tX0%$zTvf;!;RH^MyLwW4Ew4C(=gGg(vWk14v$Avd+xF~|vp zv@-2DChc?S>lO3{SIn`Ar3-e_iik++BG060IhWsG8TNAE!ykV8_`A*b6!5Ff%JrDQ z{B^zJetC=-l9H2Vh9DprBwGVqj`l8u;Rc3jNdZ&Wu%R>tQ(a*HvsaGh2Qu7OAg!VKgNVR^!st*U%ZF#PpYRFL z?nx`jgBC~PKx|5tJ>tL=0cs-BI1FEp<>1~rgA3#(3}rG(h6NRJe0w(|xG^gr*yCf< z2V=Ual>|m7AL;AqJ#XG1P9>!$h$GTNRKeC`>2X^Of*H^PfximeeZaTm28WZ7r4yk- zD>iJHFbaz+Jwg9Tmr?cH-uDfRQJ@I<00OAL&%RWIYEv-Tv%! z9KFjwswdNDD~#0{l5$MmZUCsEPJk{@6JBoiW|m;sV{c$#E{QDwfH8dEhAO-jOwy%(QDY7r8{5JFSl#!TQK1DOmXu;+zEh7`pbaT6akED#LB$apOR(dS5U87#h-lq>}! zbWJSPX;}jJ56!EyNifH7_EQ)Hks)A9oq#fQb3-w)XmczZT;}VLX5&bK(GV&Mqq(4C zI6<`g4Fqf3vJg)omJHF4(U#rM*6;oIe4UQV;`ISgc4!n3IMo{&Sy=94&na}N&iuO^t+ZihIBWvVxf9=(5R z(6%-Z`^1jTj>{4;Ok*iD1by2=Kv zxs;eZqt2a2NEi4CE-H1Ne)r;0`QSzjP-cRBs=Tl?A%18qxU@mZWbm(^8IK^7lt-pu z&VC^FUN35j+TtYXnoq%&fBB$CFZ@q$L=9Fxh%0KsEmSm;Y`r8-e-d;Sj~{?8C9g zGZKO>qrK(U{dfCSOs(VW^61>8Tb3Ft(mQY-?O-a+{q`xJY}-N0p5ttF6+A;MnDxsg z1eW0H(XJ#Lnb(>%T72S@&+KG$F0=LntgzG}@n{L z%tR6B%}EIf{2Xs?!16>La z^2M~g7>_oHb?%4wCh2)1ZSC5F4=I7nfbkgqw_Y82q zCw_J&fKyB6P327+k`ty6s1sbKW67ro3Gl4PMK#z?o*_=%M3~e(fT0KG$ibr>Fd4vB zVsJG;CT-s=Xh@g#OPBpU)Po;RFZHEd-t#vvO4Uv(+fWQWE^6K(II%DZKQK+ohM`eV~j+I4nby-6`E4V{z_f$& zL!yu-vAQ`D@+~Wb?5vPA-`sh*g{VBZm@X&YsH}m1iw8^Xuzia5xogrt(okVoj_|t= zFf&&qHd!0_bfKG9AR;HXNh;+hSW&I6fK612DUxdc{b0~$NWl|NJdC*!>HF)wxLw1T zM$M4~+!1k}bz#9MP7Yo@u3JpWC~7LbVlTA$@~dr$0ud$J0{f;5d>By%LZsnS2`hW! zo6t7JEu0ObL+3Mkqfmp4CZq=U*w&EM)m5FVcr)B)TCZjjDd5u*CJ|_{SR^YzR5X<} zS7nSBykK_&7O29B^C?9_R(w`7%_DLR6HkZL8NHq{n#kRCTaBP_X>H+qhJgDeW=sHR=UiDz=!eQHEix!G4KReae z1>9WzsBE~U_7;eoDFNW{$?-o?<@x2rC)wA4&zyb6N-){;4in*tsMXwhHLV40%w&!| z7Kk)BgQPyAaxQz2D{cm2kcq`v81Hwo!cMthFg-6{iO3(uZjaQxF8Xk16TsU-B zK#q*>`oM|bFH57~v4nl+2GvN(6ekMd!b4-EhkZfE8e9`BZ?^5c6(u6!4I_3NC@dh9 zreh-T!X!32dci(ju;M{r;hF!gK{gB$!5-eyU^hmtT4=zyfex?yIud(|Soe<>@N{G* z*|eXD*Q&zBALh9x(4m`Z%1v;K_e;0xaR8tijY)OKkt7aG*^DRI1c zb9s&D?Uf2L6*hgip01Ok0Jc;7mMq$_Dkmfsf}_-Wp>KV}m~bwUvdre@ooHtmN~oVR1oako_8krW!j|2dbk-dM0`0LXhfw!c*2IB zc%AKo4Gv#wFcmCFc$j4HX-z6!PqyoT`}~PZFR%A@r~GGSmJAb|EZNuBSoHRg&`5m^ zi z*ERR|)emxzLey436_tb_w}jE{K4||F-mP0wk6VMY5m)Jh`*nGhh=+EZPk(go*NQ4U z1Vbn4Q(l#>zPk6gcgIk2b^c&$RwPD~3C-L(hY|O@z{IDu=s{04$4nK2r}h|hioKF~ zrS?n}vD3n%TX5}?L22I7ppA8|kDt8Jg$_J3oJM^dTaplU(|Wr%Uztj^X_e51!?1aZ zH)96;Hogj*UDxW!MWli}keOOcO7Iv%?iVHwBP|3s9Nr?eJ*3zuHK&(ox+1_yztP|e zHx&PAqRtGD#5jksSpEl7+?Ve)=*Q-`#tF7hVMWabXhf`gKpof%7ITU+U;C=Q9i)@` zVlKbFn=$+c$p}6*zZ&Y$S_p@0gOB|gf=HH3lEZS*@1x^O68P}wm{)KGxS=Z@ zr0zTKCpNJyQ_~*Iae;0t#XgfSUV#HL$eS2(+>n#gUBg?ESjAy?;+*J!OwZEOyhY?r zN*{xW&7q#KW`HY34x@dn-8kOO`y?hXzBZ@uVd~+7gvp8@11VDwIH|J<1#wCbg~Uca z2%f@YpnG4fCu$E{#@RWna)kU~O1E51(pV&|kcFcw_6v@H>0hEb36PSmmMI?*k59!F z3+jG9e-(UTm_OzC3(@fLPuFy4W^*L{&n6q@QFcoTf-LKqIt)X|up!kvBnL?f*Mqbsm*yanf&?HZo4n~b5! zWMV#O8-1&yD<3e5UUVu{G-yGa&hQ((8}^wdSY-F7Bj+)#zSj z?Jov2Gz}s@e)S!Po`FGuTl%-Zv6aw@eUP`%oP7}MXevv6#^el zUFhiDP@PRi9iwQKocuC^Rn;XR#>QmiLkSZpPC1DC7WV~Ohp<)i9(NNJ(LG^7@ z8*B`~xO!F7k>z3fU>eJ#G+Gt%iFhd3pu%A1YAZLKJPkvL_xFr{#1+`9Rxjxh4o-Bu zrGjoQc1Goue{SnQLwm0Kw^)EHKllav|5*q4+XM91qFJ#%5aV52Te~N^0an58m$x*M zJ~~9EagTgm5*fvcz5(P$3)t$0DyIm)F5qrLADlJbOfl5HJ6l8J=of(&i4Yo8plbvJ zdcxyfRh1C^QwEAer$E#~`0&p{blnLzH&cCd-GfhwsHcW#S#4;CrCypvdMd-Bu{9O3 zLtfZsCL^aOdU!F=BZ1WmMS*faENBZ7Cej$8?0K?pAM;hi+u3-CR-2Nm(8NTdcN$(Y zM$YYD=V{Drw&z(en`X=!H5Z zI#4LEWF_nvd~8WJ@Afx2rl5Y_yg|y8RapKw+aF`AK|Z}`!6NnTKI>?sVB340RW7Bdg#UeqLG!f z<1{PZoBNLcgMykRUbD%^rnSrCHKv8X5ubA@cJ8hisxcirLBND$KpjX{c+XRCc?tMLOE4!+)3--FnT zxQ*?9{oDr(kBpOkVCcC?mGx!Y8g|IksNdFAVlDrn`F52Ua7(Ap^{omBevJx@g9M6k zt0>dwa#|-Kh&Z3d=OWJfcfDL}Kth8E$=beizU)#taijZQn88+9rJ8I%U&ka)Pegwp zL^Jg9udXrMR&=ljm_k9mpKY!kv<~n|4q%sggypP%~@F`_pFL{FCyef#>gAoHGO`a&wEC$YKgI|8O{e5?vz;zu1 z<2}(VSO#&0S}D$}zso*KF#sz<%+8RK|`d zAydu2NN}tzR0x(Pc|NV*Wr>VZK>4mJOKV6lirO|LVM_6^t`4ChvhNizCh@XqnkgVK z0o;WjsNBDBgF!PJYJC{kn)sP1U29DFHNNR-`^xl;r-mzBJy<(A!#?5fTI+Lcbv69L z5dMUckHoBp7(zM*LGQyvOrDPpC=;R)BlfRZ@k1h+h8}kOs#Z&8FVXfFdUfqtM)7zS z*L0zzl1whWqEhx&u0wS&!4*bzZPLE2Ff9TEa>(}z^bYkC+Pt#gdx2$sTckr*EfU#^i{?W&`F>RvP&7Vu4$1Ty@Rt6 zME+F;40I{Jy3wD4sj@q9aS=R?2WjPzyNy!q!hjV&%ETIi%Avc-$VW^m9K?3Li=ygol_x7eD3^5M*&OEUzpu*=0g#NS#mzC=XXl-U%~3gpVdhWi_8k zVC{kQ4pPhqtq-~qyU79~qZFkG3E`k*^QuZPzsBRZ*qDEZ^Tcnb z7#L(S_n0kE9X3?BHR^T5Qkktn_9<~S4=#l5RX4S3W{hstiwH<7hC5q8 zdWL^cxHO)LUxlzcB$*ZAVJ)Vc{v(VMt03Lh8?<`FA(2!`m?gt$E&p8K(PQLR(!1dT zOtKgTY*<94QR;Wm=T-1Me(Iy~2w)>;f@Mo{1oC%DU=3SEv9_mj#zH>!dtrv8VZY7a z6i*$>a2hX|mbCC2#N<8Yoz(Tm{prd1-~76zs3iTVYUMplN%RufOQ&IHE;X4ZkVH zPq`1T`vo4QPTq<`KEiw+iUBJss~zNPcsALcwO|)xwetYUGaBF0lS(gYVl90nY6995 zYyJZPtP^}ajnz(!Y`Lmk?&2yZ+J#}*7U)NRt}HI)K^LnZ2r@gwwlY_pGP8fQfRU7E zJGxA+9>vu7WwV=2wAvw@v6dhXt#_2yDW~$>n)?B&okQ6znaUJPkQ19i?Enry4wU*%K-$Kfgld#k65`uI^~$ zTrq<4LLN#NdX}>9htgh+$c)&gO8d9K@>SBxB!hIUP-g|(68`gvAM)2m!Le*Y@(AIM z6O>O(UHePg9q+IpWW@~UI)d1x_mAu%B=$hkthCX4?R-P2tPIQ{ll2mZey==A&wO?- zX>bLQrdYX*tT*mkVVPv1cN3S|hzrrM$U9~>=E)C>BS9!~P_W1uy&>feS3^rKNDbS; zr1a^Vk#wx&<|)*mh!oN~A4c0|n9Az=Iy83JIv3`QiMP_WCzEG;scZNhxtmffuQ!3m6TZNK5ak`-`#_5uA zJ)JrUm-EtS88B4mz1|giMMq~S->arV(PR#itJQ3ppv*sExUbL*c?ElKDx~qpvmW+| zQZwTs7pA!aN#hxf{E=xo?TBoU3nGCcGo39ij=J`!{HwDtCkc{ZxF>XK@31TsA?uYA zh(YPj&e-!AQjPV!?7Zl+jxh8xUgD8q$t#?hc;5sS6}|>3IoVMz@cd+Z-#ORGSv|_V z5LTX8{)Ya+v(FkaT0!a#$gO)*2G~ENn-7qY@ww0FNlMo_j2Oe*_YK6d6Uw=K{WG(& zDi4dF{t8_YV6fo}q9iK|`gv|4O?=wZ^uDpub^q>p6emV^FBnXZDf`lnH13?3R0-x+ z94@!cPJg;V#y6Q3UmULFmNDzjc6IDvF8YcvZ@-8z*Qg0`0I^8=>y>bK=Xv5H0n-ym z&Gf|iFn$TQrVii&Wy`9Q*dQMyjmIl8Qh?q(Bqo7TzqPPAfBXEJ1g<5YQ`CJyC4s3< z7Xv*h#G+beN=g77BUbFy6G;pmob$;lx_lZ+`%L@0x~2ZLhngUEX2f#;raOZ{8Ur$Z ze?UoO{!<>{kBszfT=8Jyo5Ol71M^)8LX%HXKPbCms)%uvLB^Lq593}PGgmZj@5mqA^6Dsf~4+oE;<^4mbRbC3%HfXTltvf zwojsS28bzmE@dGC{9QwkK~Ri|*yV6N4AIYdWL3bYt{D@FnxiTWVv0#6Stl#f@dt!3 zGJ;o}QNtDP;!FhTVQH|9AI0Vo8VI>5%S?KPpd~L4<*Kc;=*p=1>e>}eSAiI5$jKx| ztMn2>t3>^DD1mdaL|sGBswb)~Xmx^*587ImXh&V4Zv51EJQgw}4PR?8mP|hX_KMkf zhJ!#%R7uZS*nhFnp@R_lobnv*%5HLS6jM2e)~5YK-zdQwZq#`Srh%A8Ewpd+7aM5b zQqZ3`8hSt@xSH@*9oYO%8A%v@0msO1B*Dffg@rOb?Y1=H?7`+8+epoD3fHriJVgbW zx-zZ7kOw;4&Wl*0J1#T!o0`P1dnrsJRXVbGAMy( zLyg~Ke_NsM;Z_r^#+N5T@@C{Npw?rwXLk&NWOR(@o#olgGYxC2Zq4Tv%f|#uiic*i zChz(1L-PXV>JLv&sWyIKA_iUA_}htj#K_us2as9z^;#>zPXuK05y{4FJOJ~> z`z^gD3z>uZJrom7=cNUc4=%cwY?=bhTE!7Amd@SweAYpEo_GwK*V*LwFyEgQ(vFOx zxB_9DwVa?6ROjdWP+1D&Iv+Oet;VT<*v?oHKaUi5Ffk0e??o`jGzDS#IYBS(`x3WE zRTbyYY|M7FWewu{u-G5W^$nU$BOQ$D)RA2-#vS?IK0_ux@6o6n$3FD6o9`&7_ECxP z0*h}szFm*EV9vBo6so)$rDRmZZLyth!|X^^JgR&>Kh6XZ0W*j2D{Vvuph4@ z5j(yp#ya7c+ZMh=Za`8kdHzru$HZdvPJcI(GLL~Q%IPB)hJroz|E0PjkV# z_$s;%!ImhR`Ajq>Dh7OXMPI#icF9p00Of@{0ULLlyw>m8~xlI-*Ho+nyx+FjT z(lflzo}0>nNYXcuIR`C_-ZD(|9=8F=O#?ImmG>z>BLGSAxIT0EHn=)mdb6hWR{xGu zDl>rFyv+w-vr@3i@`GeMZhtQJ_CmJF0hQ?9r?#FjH}~j1l^xd>PDxmBLIfh#SklQ1 z+}xkm$~l@J6ukjHSO7P*``YH~%cyq$Sl}09cAY*DztkQZAwhGO@!o#xJutdlaUy+( zRNi5P?;qQHl`BzfE>qZ+T_67k0|@|Y9sk@V0qQxXx59bP8e9V0Xs|+J|3{P}0({lS zkIA_Kf~^S<;X&{d=tK;HH|u}|DFGtu=#(zpBN~9_)CAh9f5Q^R8T}iU=>APy4+uln z@kP*Bw_vq$3n`0FNGP~}^IX=a=?cBbXXjnXz6$* z{AdzL4*&ovyZordlkJR<$miwiznF}q^dPCOfYez3uNbse5dcK|+vbDH0fMGO&GbsVMV#hz zO0}}Ve1B~mgiW5&75>G{;ot^`8wSob%eA&YGb5w@1>p9n(_V7^jm$aG!$Bqc2P+>Q z{hpQo=Wj9M^azNWvQcbM=t_E|4uAY)hbdG1)BI|-E6lecJTI1qsA=yX7X^N(ybgyC z7r^OPY&Y%xD9u$kkM~|$bAukB`FD19?gvp`#LWMMt<>df0{qN9=4pijhKm9$7 zxji78`p+0Go`Fanb2Nnr_a!D525?~jSm_j4^1V)oX-|eh%-N|3NK)sMq)jTSst$AS z^3k)mx9#U^gVF|lX|y^QLFBz}97L;@r3n7KBBRKx$6d9*ed_f3oIi?t`R5Lk{2zj_ z;F~+(rJr(EHNCV~LC2e=d6)xWU3$Kn0{7MwA%Y$11cJStWK>zOB(^3OzrkTxTvJSo*sc^FeAUL-~_Rw7!EE68Ddw+yMFF|!4OA%jp~vj z^Ik;2#;57`-7iIv$-6P$J~Ngg%?FBYd;xbimzS5|)(6SOMi4_dLC@rXr=O^Qs_iXv z^uUE!8A46e$+QX9jz9lWL8MpVPSyOLM>eHgAF6>n-fT)dNZEVp8OV`rWQ4oum#h%- zn8}^M3@fW6*^8gf!(^t?=HHbWAj^j zQiUPe(++VB!S73z$W7VmCu6TU>G?3h%=4NU9}FL-C6p>s<3wNXeDRP;7mJjfj&sef z=9CIgw?Si^%~=o&5qrU9VHo7YxYbyewcN3L`=L}TtIl=N_{!sZFPr|i8`m$52FXv3 z$9SmTe+b&3p(LWS3`R*ibT1;AQP9S{8N_R4oplluNHCUWbaEEnw^uUB5w}}74;*hR zv^^8^J+bl60WSB$3m_-tl24DTj_nWg7=6@mEt>m(a9H&=JL8sfkN8*X<0N~f29o1jRk%|g(iEHMDa zQWs<=Bmj!+2iC3O9r{oo4LcRX?qcVKRRb|I$EJ%mcanFKK;1Wsv)GJ=Or8BGJ_C@^ zNO=gY9?>brHqImmwWwUa}m% z*ZW}Yk7;+*Ud^Z}4+H)XH3F6g~jncjAEqm2( z0WbFjl^RqQeBeA23J-4d z4Q*jTf&*LS2Rx-3dJ(nHz!q_}#%9jijY< z!5@G~CBF&870l}L_3OJ!wHV-)rS~%F!*=yH#`QGoHA^sH3SiX=csFd678|cb4Hq~Q z9fmj#4ZGW&k*!U{@DlGA1o0ypHULGpWOYZX282;AK20=Y=t0}6jO#an{et~lcjk`q z%?GD>{A{tM$#e!Bw<-zWQ(}P0EsJDt4LMtBqKB}D4Nif5FOO0}cX{2uo6pl@EWB6F zW}@fwMDJ}Z^{R2924*!Q^c`5;kC%qh+IGBU56Y-jVzg4}>G0#(zn`tp`lg_wQr3QS z{Q7>Nv*Q)z-TSwOf}f2hGxoD?&ze5WgS=WB1W+XNrhJdlT#hPH(coj(L7imfjww~> zpxDGStOGqYz0XGG@)*}K0#u+n*TeW8{Se?G0=u1RKx4D%GN!6EvT7-XRJBj} z`4s4^@3pH8d$vIYv`N%zu$rdYN4}Hs^WDYaHy*YrZ-`U8jWH|q`0X5{o#aL>Ro06e zf6yHvAY?U-j}Q(EtzJJ!0`<+1unb2sW&U0#!7vj+g-cAqW3Wd1;P2Y}1yH&jhg> z%2aL=;{4ZrA+P1A-s7&{gc4gdX0toInWS+K_3FZ+(Ny@r-&KA!_wX^#P{VpM!NFov z(Bfu>&@-FkP^}K<4M@rz2(hKu7pk)X3<4v|bentmRbzJkuYMYJl90C0LDrTqF7TFz z3UOaWd@BfCA>)%{q4{6zy=7FDZ{ICShe(&SG?LO?N=Uazi?m303#fDpNGsjljVwUA zySuylT+8Qq_WSNV&N*Z3G4}az#`u3>vF={iedYYk-<;Fq$kmt_O;@`0cC#jS)dlH& zB8%mI^Ip5@g@xjmRRF4fhhkb}>t4BS@Rjps(lEWyDI*4P6Nt#f52#J@a-zDc2t*od zGv;{6`WG~fo(}VTgQHrt8w^+Du=1D*9OKOq`_%RH&pXb=vot_P>%>tVjg&P1))w)5 zN&nTfhIYKz**^1m56=dx8!hH8bIzjP$7bf2!z^-a72GZ>KSGqL$}h3T;bSFodZS5u z;onS$vFmKy3!CxWRUG=?5QrLLV)TVlSi9;yPDwHCe+q16ujy&SIJp z?CMsP+XZ@em!|Vh%L0SlqY~BQR`KlN4krHFx-yx~1tsUAq7w`sAeaO+hw8vUPT+t@ z4y4cVDHm)FzW;(FI{?r`CBET6gt)8uHFzra48#} zF0J`~5o%j{E%j={ITS=e-Yo2Fvk{TB<&YOH*)ep!RLzt#1{1jtY?MvfOYvyzosRli zXCB{|02Ab_uv{Mv#wCG9`diX*O+S+Z5@rVtJ3AU&c6@4a1PY1}C8apWN06Bk7;94M zcMGJ@R3{n(m;CZgh?E*ndYGzdO>|1$Qyk1x0VV2%@~06m9UaOTS=hw~mI73dvCzi| zzIT8LSxWvFwWn4|_#dfhU}VUC5A%LC3c{gfP9kg-JZ$6yoo^n_&Il4wjxn5s4VcAm zoL~{v8`6aB1oUh;=-uw9T7U?8k|yhG)rygHY)a1%Gr3vF(Q#J1{;Q3oZp@&_lO9^q z*@2h68%ECJ_D$~RA4AHF;SdqrR=k;A6#et5=K1nrS2B`gP+f$i&jiRW=}bfV5;AT- zPM2pfGrXi=s2c=8sCC0Wk7Mc^yzhcrF084`uo3*~ifpO0SsU$&rTbm>csZ#&(&D#I z$T@%N?akHUvZy1vCxLEzr^9ZGBnv0K;}<-nrkoQ^3xTkggLhu;2cn^lg&thgxMv)d zEz$m$Adi0Oli{kwZkH$Y(rHW88D!V8ozDXK$sMTr_&Xr9Sf@HEo|*IA4lg798=Q6t zgl5XfIJ$9!f+(>lb@spo-S8u0 z=551LbTF-DIT=HBxrB}(Aj2P{?mr9p_YjzN86FV?&~e7=U}OC{{~^Y+6GCxz=vv-< zvr`a9U*9*ajdTNtgnZH$8GE#KfBaI6mu!z{)l`CQO8<8T;vfzLHjc7WV51M8JYj{R z-CC%OIp)3V+>V8rlT1VaKOwX6I|v!9k-I}BJ;2-RYD2%A)ql`>VmPf%Wkh{7=8u2B zr|#QLAcGO2%oef>{H{2zE34ajO+FN0|Xc&67=F4ag=Ext~@!`SbIQ5i*Yg#rjzPJ_6|Qg zLY8Lva}_X*;uwjz8U-TexPR?|zhuheH4&hw=fOP4267?phk$VO)He`fiXtA8-=OF8mvsk`lVi zjQhK-Um8(Edp(%8ghsYn1I|eX=nxPB1U(FEj)&b7vV{LYdtEQNbql(<&pcU^Okcli z#z}0qrX(iGouVH2Vc}LfMyVU~Sr5BpzV)cI$1c~u#@BM>4PSV@#u#r*B^gIfO^CHR zv}dG;wLf(mY_~1cRH!=|%Q@RSmwdzSGUVM}R{46zf;wd#e zKq4-Jhpjf$IXSY;Ki-R#b*uPA@0v7Cg5p%TGlB)(hFUk6>iO=?)+mjk%jr~~ogVzi zAY&;(#!P^4R=$)IWkb09SJf*(qtrl+FJtQVm-xdWT6Mi|mgYWjvDlCVUj&Sb4+UIZ zFT!jTU%V>Dd6}6c=u*r~8ySnZQByAYiq1mg=V?c)Ug2AzPf$K!!cP2)_$3*BA;$7K zY?fJUjji{Y8o*m6LF_e+6(NImb#bm7K?r{XlN4Dib0jU6ko9?G-A~L9kxBJ~<_S7a z8-M1!#-?q8MTVyfy~uO~RFN5=r$F<>#Q@NhroJ@yx}^NrW$ZWU(@H;mq9nV9Q)vAK z#?l$MUEttK$goYsuA^=YvOj#wDniCmbfX=#u?yG)0Kkt;Sw5BxJb&EPPbteFJ|0QZ zZ5pt*AJR6YyyG7zae($D`GcQ)XPPaf=1Sr#>NyHbj_KFrJmp_-RCFPZeHNZpqDGE^ zjFjIJ+-$R_BP-;yFS(1``n#$}1Pqfjt2JIZlCnhpvJb8_Lo%^QqKh*}&{Tx|8u&wu zVK|J7#LWbCE{hWc&#Lu++hA2?8NxQ?L;d@$PsLge$k8V5GA zaTK08xe${I!OAZPP`X@Z*HjU^Nha2+EO|nOy>0Otjz5T)N{ROr6$I+J(JDC0E#v1X ztQO$wsOZPGVwv4D;$j8^X+~*n4>QPee$*oPNiP5(hpXiE#*)#E9;o^Qp3y*yJ=RFvvs+?8Bb zb2+GuOL)hItlV8^{foSUW;B!I;&%p0#dP(q_wf=tx?<=d%SC9A2^_@!;VUBcZ7kEm z;37_e%%DV&6TK*Jzvz#00sd$DyH3&WUfEOHH|B$paqLNMSro}A1fzchDBa77>qOKL zKM74`F<{KbZYsJVo{F{5ii7pdPt&6hiVhFbhl!}j>UGRHx1Y)&P-(h)sjrL{7Jf;w zPo9-M8(n2WxB`LmKR5b$jBVZV8HOqdIN{Y{O*Es0HmvUwBjmEGI^^^dG+q$}jA_4Z ztF2LxTT+b0t;X#v;YeX(o&Lilx5S$A%idaqcpfn!Y1mKPd~3H{=-C^8Y@w4KpetxN zfbRi$kx(CCm0v5cn8Y}&I;i_B1(x+T9BrL^!|i1U+Ai!1LEIYVkNr4 z5j=p{Sg1#(nOuq(PKyhcT3lyeYkX`^O3(KRmkhT8r@_$TDSC_O`i!f?DuRX*5kZUG zromu-KDf0M{=jC(YZC;};;{$3hIt_<7c z3fTUxxlsou1#J}NsDSsFRqx3jWrB-dtoP)1p1uruPnu$PO-E?Z_b9wCCUt5TL;bQ3 zV@xQ(oT45Od5IpE32LK4YnU}8g?^BPG}4S#H*1wziDI?^j^30UmF^>&=;z9%08?YX=0O@WyvwQXOVXn@U_uhgKy;wKdQ zgn4%5YP*wxdydj4gr$Q>7fyq~j?J)7@$?b43%bX?KRgcVsMejrxaSMrMCc@Qd{iV0$X)}pd4gIAO`79J8V4(_`j zP*x`bs~h4aNcmV%`>>*3lKDhtohyco9kQ>iv!-bu2{bb@zsW5m9w<(A4&`Yj?Ak1A zwWz_T{ZNZeEG!8AbRUb7@twkbi}KPqzqKs^r&eq6lif#=gIJ#0=buh{@?@W<3M81G z0?Gm7%j|eYL!<+B{wPY@$yhBoOzx6T@Gd>Cb2e7T5PzLH!Sl|iVBn(S|LunkX3NWc z!Jr;sLWwEHOS{`@2c=G;O4PK0FzxmYwLt>O)^GNC2b5EbbHMmCJ$xrV?-}W7>_;=2 zN71X2?5<7tyHL~AEbx=WjDiIY(h-1EZCdV~*~GWYk4$K5`82d=#m+JmTHZ?@HaimU zOCTI_FRE&sS&v3t^SGvNp!wGm^<)$zfA;ipTdWmt$8%JYm*Om`@g4g0u@&d z30zbWwzv8>k-Y_ZryMU6etuL)6G@@JFi9dU(tK$N0G%+IC=~KmafCm-ky(BQsJbsB zKcZ?0`8C*|a3D5tmEdujdE0i8u}G>12M3=Z!it_)=$n@}`DMI1b|sly$*O#B_qs}! z$C5prX*}0q`zBEpl}8*B&rtFghd!ZD=4CD@WWS{!T~+6mkE93Qe@`7kddB6$Czz(2 zTssWHbdMs(pK#}8kNpP=s0=_uV(u40!z7}Gg2t$XTAhu+SE|>o-9Gr`I67LnNj8)} z*APbKSNB^t2JNz6#XeWRyE%4=jERQoPhNu70p9@O+1@l~t=6xZyR%WHot>Z0V@+ZG zk@f$QIKT7`!34WX>8Jd(CnpGVS=-Z>eDk&s<^3&w0ajhPEh6&25Oi?!6JdUO+hhTc zfr0C}gqZ&(6Bli)v-GaYPHt$|c7W{0^!_sbVd}D_s$rx^WW=RJFFzvY#_&G7T^u|P z%kISg0Ls5aV*R-wBFzB;JS$9^6kT!hq|K1=t_jSph%4oPE1iRK`+__O7`6Ws;q*V> zPK5uGApeKZTs<&Zd;2e`IRea+YByK4x>sO%N-M(n^!HPQgwKUy-<~6UiD{~oYo??V z;EHXRD9xl9KtVUme;H}JR&^Q;e-n0A7fA{E8VLr2_(-v%yx(F0LAK?E_9HZQYO@3R zpRwmW)z@aS(M*-1Z|~nJ;;MR~p{`Bg=fxdp{ATVC6q+eUIe^FKljSTsQ(VS`$1=Tw z$Dyay5ElOVSz1fKAcTvmlGiPsf)wX{-7vo2IN9G zet-mlsE$LwYCUj-00cmg9;yS>i8O{#twpZm?`HLIbtKeYk~9-gutf0aq_FxeH3N4k zskG0ge$BZcWs?!-Iq4UWwdxBdHF>%;X(GzWrQ@koh;aWV$||3^vMz1^d_q-cKzsIV zoI|9NML{R5du6egZ}hE&J!<27XrgX%I)M9Ky;m#1kO{&M4El|=_35p~PaehbO`rck zFh=B%FbjW@0$h}SRY*M-;IfmBh%m(MdsU``r4f4>SvC(MF;P!q^^U&3dJb^G;57$b zchs>+papL=T`p-tNJhsxWc)i1n9AjB;6_z%ljV3bKdK(>BwaFMM@c8iOCQeGlz?9l zR|4$NEZr*Gpf09>H;P7Rjs-Bzp44YMBZ%Vuwf`b`T3yRXbmH*K>W3RjNPT12eW8~9 z^Rx0zE@v+4^bZBQyh;=zSr>2`vnV#%-0BizyvNuZ>?rR(9xRJr3>=jvx@WtSN035jks1J5HofvQO&?mj zb~PYLq~JP}5M`&`X01rIE%;ky0=-A65@h6Q`92k|e(unB9Pnk;ZW=MQDxOL#vhpRgWo^Tee*&qp zJtS?E$R(`46qm`9v7I9-dM10b){K^MJUZ^sQu$%vhINoe*Pk&eMqv&x&H6nf5i^UgBYdq%qBouFj!O7R zZZvuELY4MYQiRp)7<)XP%(h%5g~uLytKyIh%wN}X$;*AyIiRA=LgRAX7?pb-2jkCFWPea>CC5nx3^Zft zG0BCl0Jy124otaF^UDhH+V`JNL4#9Y!{rF^3X9z-0eimb2s1kZNkb7Q zovpNhr-l2P4i`(q&wmZn9gaD)#ngvcJONM(yxQ64=@k;kfC}~tyY1J{opb#ps}aH{ z;0^XBs~wlh6)#o1bXFgSoes$F&PolvD12_Vy;Jhdnmwzn773-%_c(2ra5GZ98!gG& zv)CS->a}967A&Vm;ctJk`P?kW;p0(iB5xF;bxwn{COj84r4*3kKcU9HBJRU@%CkYN zayFoSjOcC)EZTq!TEjj7Mt*BPyMO;QGnp_gjn6I}3`R%H}SM|@2aMfKQ z${bGy_10odgfYBp0rwUa!R0B2M0~c~Qx&-^t!^HyOW3SBjz7t}L;YQaIMr{~CFWz= zNIz2V(0t6U$9WFyDIH7qH9pz(Fy;7(kwB7T#~eau=eW`4<=$9HY&W=8vncSTOAMLq z{MdSiq=_02W^O#Np0dI3Uw_bL7#0D}QGQ;>9fZRytzIA*U(s!SY%?H2&ISGDL6*1^^Er?@QLRDGER65GD9r~(KVtX3KA#vMP&v!-QN*%u`HhpnPCMVruvZaP#kq;pa zbIL*C{a*MEg4yCui%Q&`pRAs?gvPZ(;+gPs4K6meOughEt~0KG#^6n>>pUnnuvy)D z=8)s3`ltP21S-_{arCuT@R(KT>Cb^<-CB4qeJ%?M!x!zulft&wLhqhFLAr+@ zF^PKB#~m7-z_4pO5xk*L-r$#EziVC8dv~%~gz3aqLtJIt)5|6=lRsN@T9puPR^uh& zv;t{~_))$-b0C}~ZD60^=X1(4`N_*8=-h}-5$X>!hS?&R3G#ul1Q$vBP`4_U7>v|V z3S8|ih4BYrdL6KR(nq1PomMQkLbBKx&A+$kdqw1gR^d|gc)m$*(BRxC3(dZaXDI79 zf@@Eag>8gLAnh&-8682QW9v8iU{nL{zDvVBl@oe%wn{W8$)5WXF?h<9UnH`TgBRm@ zD-ht6wV--%T`@Jn=x^d;`Ll(tQUu_;y$C0EWfo5OX96L#-&D}ji$bT>X}V0l3VA;O z8_C|P1kGn1>FL^x6?1s)D7`1|;~Pg1RY3F)L<|O+o@3$4glFkb#{r^H)bbxLBG+GB z>~q5-uV1PP9A(5}S6G3nM6bN7d?{i68hfi7*F~9u)vlL(#MFxA`n~Q6=oTYY%eY>C z=v9>-ZTb=~1V(B*32#~Xp>W5i{sj_m`lU0}Xi{iiiJAW}i_!U0qz6tJbfLT(z=Cvi z$Sjyn7wV>p7{bk7%~+ObbgE+Dv2#5~$%f9;zc1H6fQg6pQ&Tzk{wRFZAD$Nkh6wV* zDr+NUY2-dN5a$dl@*p`WzCm6;R)78-tsGCufeRMGsEU;T?qQ33SSGkU(qtSxZxBR- zxM%-e)u=Rqrh`h|#k1G+k@(pBp-A_XQu*$>zjWo)XoQ4KTQ#@PmGAGC_Z8G&$#9#V z5Hk~FBZh}0-#d4dEeg$DkI=OVOltC1T1mPu-Aqkn{`kn7q|+0AZ+7|%XjkZy|Nhl3 z-OEcfwSVz#JcOP?5ahY`h;OEA_9TQH98E>)52}A$&ogT1tpUMi_u0%spSP)P?Sdrt z-uis{64a~kG96*O3k>k$Pi@zIgJF>?ciyCY&xS)}2P`EbmmbgfCuH#>p(t%Vh*Y7J z)CXvs@a-nute4a_E+G$u�|r zv-9WR+uk$XjffYua|wQYzOxL}bvuLxaLiSoO+O!{a>XJ(fp{c2br*oyEcL;+Tq_H| zWRU~$v>rDuH0#4IZoFIH$URaSD+*z{gFdR^^b$XMuOoouf>Q2xs|y~sl(7ZmG6~A zNvca~$E&NRFTMV+zh9!_(mltenuX_c;-(C9wlCJo6Jz<>5t0L+kH9*Fb<#^IlK$b1 zZ@tdO0s5Ta#(?+UeHI8z5_!zNzC1*B;DEq$kFn2hai|p>mZu#uNc15$MPIObh z)RiaPkw6%7aOq9r{X%u(rLeMaCPl}5B;VThuh*#u9-CD;aSEOfVYJA>lX9e2BSXc! z46lma&t&;~MGzC@qB;^jZ2rt(13r(zT+=a(@>&q*MbiW73Z@4+9fIRG{-&6DB;QOR zmxx=a#h*&-`+kj#nKy}jL)(cShmC>fX(w};^SzE-TQepkA+N%KH^=_amvLw%t!{6f zV8us%+GFzbn_C2!2Y1gkEVd`fCi}g@Is5k9=WUl`0+Q03oV0gXzZB?>{Ra0d5cwls zF#AX>o?-9sP4SexVnK}zBQ|{xI!`T~wF=XV8 z7?s^VmN$OIUmj4J4k)So0D)Qh$ERj79x5fk-J*5s>!xe*lgN*^b+>(f2U3EO25$l> zqPE7yzi3-H2O4%FjEy zA)am{E>f>Pp+IcC(yMPfw7G7k z8Mo$?AHX`ft!D7zE?OSWOPB+sweNm^|DGz@rcAO?WAd4bcl>sWo7F9=t>!2r{`s`^ z5QAEFs099HzrE}b&$l-m*#g3>HBqtS?gnLblvL_#n!rT)1i_ z>p2&z8@{S|uG|Q`(CjxlIp=wUr^Y&owqK^1L*iI&gY1cN8tr#Z^-%IS&ldF1+7Opd z&Z1D8UM^Cj+!v_gQvL@Ez{}=iTrf-X`WD4SmE44kEaV9izuaZ2)iiN2{@~)Jhdlfk z&DsuUe%o~lr$y<;@Rfmk@so(*1x^&zm_F6BoCn!*IHd~^^H*2I>g8ZK6nud8ys}CA z;(9O1F^OUmOW>uy_sKH(u5Ib;P{W-R0sCK8@?>IHo|&KKKB{K&T8v`~KcQfxWC6*> zUbvh^aJ`{*kD4zSI@EvD7gw;`1oQ-v$e_nZ86J^1oCq2=Nv==%ENIc?n0elJ7JBiX zp_6jl*v9r(Y##JDGHdUKi@+melFVOr>Q$H`@RTCxu0;+%;dLRo8Y}I4EhQNHNEe_) zK|^y015YB%QIGRfWT@t&CGM+jkR8~ecUZx#8PeAHC4<0gSae0H$$Hd_lsZRhyZxdc zLp$!V4Ljl^S?wp2c<@>kb>MuJ9GjnMBX+%vXOGxGiYuCNg&_qDh>Ka9OPudoQU{ov zoY!%FC}8GC_w9pgj%G>lJY4r^SCwbiy*)$`w7u*T1Q6)4bYZCa~8lh~0 zE(d$5EY<7~*A+0i_x+V+v?B78OAeWxYg4t6@Jl^cxVUuye>4^+-K-owGoqneM?{vd zAke`_q-4rpvnADiN+F`_^R+A+!B5HY^TDYkkOvfy6^#p%p^pcP;rPb#{Zs0%RxbN^ zuV?*Ay>7PBevYI93Gmqlo=9Vf!wDT5Ng?3>Hx%>pNBRAdm?>5Mn?k(Etb*=p75c9j z%AP0ga5;=o8Cfq#1o~dvX2pyhevU*x{Xix|{`(;+?RiXpB84g2@|WIsphoGxqQ~`J z(z%qiyj_Zni5|}~gMduMpVDt&>mV<$d{=Nzmx?>{M!s?7s$s*`K#5og7`XGEIY_D7 zuH|MnU1eyj5!LUL6C?N)Pe=4-d5)B4f2w1?r~)MHBqqK_&7eSl*^Ev!g;_6EX9Y?5 zn(t=l_p_q7r@2}Wr*{D2?jDDY8NrvQl{A=9`@oeqMiB`oTJrUaXIG4G8>QAAs%;*J zS5_`>{}&64e~Zoa%>KcGb$4#o|FVHC#Q4%GoL;(Z7ji1-+G@17dz@l+O%{q`Xz#k% zm8roviXBVTp2)oZxe*hop>zUj`twi?7wzyzF6#Xu{@8~nRT>*;PvqIe%VC)fS;k+y zI-&m$RyY^*Us&O9?KY63>_*WP7rTR0=hwQ{3JK|2l^oBiAx_d!H|FW={eb-Hw{*4+ zT6Mk3(R(&KZt4P~Tx%>SD5Uy6>eoW-yx{A=Pr={1VSU>(elZ-{sKqNDV4cCfN1U=A zE;v^BEd=jpjOo^5A)$ECxS}h3&M10;6GxVvNIK80{Ja3+iLeiu4e5)krRM~-l3#Vy z--JhA*5v*NT}$=TQU5n(77+KVUW2>-hXne+IA%e`;Qn(~a{y38`_H$(m>lJoJD-aK zr2705v8#KeM2y$WL1^M%0woajRgh$}UaEY@c4KlxRgBVl!!otoH8O;@oc~T#ThzLY zWry~qAL}sp@6Z>!RN+Gem3U}=*ukpL@Q7Q)5DFP4-;;c^)L)wK_HFO(MyB^f!MwhY z+jUIyx|rtQ9CBK^Haj$fhY>qM!1#>22P}Tq`8ShKfpbX&5vOVEXIP)x*~OLE<9SyT z;2Pz9ziS{31Jk;ULTXD&+nL)FYkfPsP8p|)*3#)+r_;&8lIga?&MaB&BFT4U~RCn4@{v*A|h8Cj(c2_AXkk8DO^XgIMjC) zgCY$8=kJa^et!#SM@-Dj@_U}0p+x8uFJ5}xoB>O(oF?dF^8j~X=wKH_C~7%TxTZ+% zb9W5s;e)-q>JqhHvZC{rXyjN>TA`NRyWS}%QT#+&5-}>aulcOYFM!-VcUkk9C~->& zghKpIc4dI%TD#|an!E{MRvz!1~ew%TE1 zc0jYfYZko)+1N^&tw8Y7_GUYWw={-#(eo73=c*l8h^Ox?ZgypyfkbOs%y+pq^v9+A z`>p{2z@GOjq5jpT&%@?e|BA59Or-_Tbn8y(VypE{nbTk?vlB93EH!L5bcy~|EB!q_ zzRQNjj+cCGa)IvLs*{phMQQ~Li#NX3B-4xT_=XR6%sXlEW}>FJ>0)L~^I3dgB{efS z&?vjogB;Q}llYuacpiysX=%0lUpSb?33|7#{0>W-Yc#UQnY-9z!KXbx^DdnSa})+H2rNjUn~sPJM9(&Hk2zr z2D@Fjj1apu7Ss`F37<|?ZYAhgaU~wi04S_VoTo$sjT&%aV1AY%U|i+X=6ng1J_%af zmP@yIMTmlC{E4-Ohy z)8@cS+{wr>!n7Z$Mj-p*ST1b$b-Na&H zkoI*QwBwRVJs57Cl_w=V9!-1T(t4e~!x}T?27uz2(};moVZpLfAnDjyQ&(398o6W4 zRVhJl?w8s~GfN{z`~r_72jrAA!8teJai|Cj%c{Vc)sB4-$dL`L8AOT|awG zo5W{ve+8{{yN9VnUcMmeM>3T)mK{;hWi{vrKrfc5kd%1AvnsvHhf^XWXiep`8AQ#! zGC2yeS`6-YG=uhV4k;B$01?-liam2+huG!IRYgB&nH_B2QLg^o-QpbA{%-{61Z8A( zUDv_dzJD#36x8M(1Pney9Qa#^F>nzE#&LC=;Cl?-nD(E={fg(TkRT6^R&={k z@TYc)NjxlNry*?3e9cL<%yM@SK5)Gy>KE*m+pjT&zq_u2iXBcOQS%Y~PCQeA!`)cW zLhSBL9^(uK<};n*(&tsGBFq9sE!}nGRE4KK8A=c^Q}PAR6h)aLzwaoF;{925J2I6H{G9g35A2Y8DwwA`d8Os)uwz3I8nM4WKPL3=FDROCdYxDz3urN#Cc|9)X4m~$d zAcxE#XJVl+4s`ieJFiA2sbCb}nwXe?jn2VOU|>k&)YM@VrGhveS(~p`z%aqeu7(N& zGXx`T3zHm*6aOa+6k{KsA3PX$P*PiA!3ToUQlPWC9CNLcN1=5K=mlKcfQSgR*M|D* zfPYNAJ-Bq~CQLqnqn98+wSSSk-{b>X+rLi+mw@r3w}pPR;qrmMpO;WURr)*nf{*8} zaLC{TOUUp7A6p*%13q!Z@PlnjYw@JNCwV)SMjbbolm(z$j2$2u=W0T>W7l<= z#h(`DxC)?`TgeI^!W2v{S>0B_Rel_1?$@pnVF9oYjAG>uwmbEJjLhhmk_tbN&!>W3 zL_#ifDB=n)wnS1v=EP{G#m8sG+S@w^1?=M+Ucq*^pIX@a*_XEP1y1^|j;3D9vDA^~ z!275T`R}v8s6hgPvY@911TDScC!dl2nnGJ+Ab{+ zKG3NV*$1kTe+ESb-G-#RNGPfulgoXni!5mlC$57am`(?t&UcFsc-;Xb1mK*{eOall z(YkL0QM0u4Mp894=QHVek)?%G(s!aDuV&($;;_r0D?Q?&)>vg6Gz)C%_7tw4G6>-k zndVo|!(E-ud2Vqj?DzLa!;yoa*LymasptOg93fR}W@x9bdw^dCcOjee;BT} z`xP4LiS+pr+$Cs9^;jmJt>UAJ{?xKB$W-*gGB&zja1Y4a!9Z8)q+tR|LU|RA5@DiI zD|ncsd1iT;{UkF-cBEB<#_VMb&_jGp&vlWqmitt0>(J>V)E-g7+j+v}Q=cXHLw{$u z_C0R+gq@=7h7`gx@Q~>l)i*5<* z{+yxWVVv?T8UQ1WzE&I*5xhle>L1f=qPGYw2<2toqy$kzt5*0|0qMo=-JG$SX+!RL ze!iW?SF$NNWnd3XmjpaM^*OK%1nC*n7Z%bEnO4y1PRewyH%+~t z8%F&Dy}|-9e5QY;G$vF^_HU6@377>0s?re^Re1d{uEelNd%rVZDc3o%AioMu{Y?FK zlUCN!V4>1^?9ZKYcs35-P60_3Ar=4M((=D4-iy*zG!3UVCsl9(B{DHg^x^MiG0~H4 zqP2OWS=vcSoeDVL0e`iti>6B+05j1yINw(_C;Y`*jGzu#{QQf2yM>&CqAd>P)??Fr z98f;&l6kE)gptv?M5{uCKIgoq<-VVDzewy`YksCoDMvA%vVrTa}Ui42>-T#=QIIFM5$#X5^T6=(3{_J zQ1tQ+tEpp1{rub4$|KDe!g0u4WZtg>}@LAmPMVz`? z_aKQqWFhg^`-_awda(nN4AdE&H6>Jf=bTw$EX!xmiN{!j-zwHUMB$G!ZOD^~(C>&I ziw56F=@5ztSX|7I#cJ)lM-V$KtVnN2Wn?QHTs=vMj_DGsz|jvVa4}&H_*RBXcJSb zp!dcep{qNqD=g-q&@=NYcAQr2ZM-^J%kX*+1>S=C5KoPz_~V{Znvb*7Sf1vioS=lt zdNjQpQ#z{=-J)ov!d;^t+5x%XZc4uJ*o^(8U-`UBlK5m8=}?j6n9opTkFb^&bX-hU zmFIAewivEnoa%N+O*%Q6&j3QQSo@wX!$!DtP2~*}&S~B!GI;c%3syKT4(^wG%7f$% z?gsXXl@7lhxww6?5-a=j`t+#i^K>j1`+D%h3s+&Z&JB&IrcO+Wq?wSwH+& zGfxiWlm_0ZvsdU%>I)A9_e!} zAS?^0q_MPQo1NucJ1i0ftpHu8lrM;gxr|KE+)92h^kD%*p&WDL-AOsf(~;Hr`*-VXEv^sO44y?LP1XH+E|TDewyHRM#Ad)lDr}~C{e=qe z2fOTPc1LsQ%Oz@9@OLn$82BW?=G}k6AIl1m)pjM1FxpTOlfJy zDFK(2EB;wap`6jcJhgA@8feOXNQ|v;{!G$jjH*Cy(DF$a#%`3y zR#T(M`;&}zfiX}2j$tz7RQ)o$V|`r`_3%29(y<9O7k9)1q}IfW$Bq$nsU7lszl?rWE!V(f)B)d z0`JEnq|R;9oZk266SZ$T%6n7NLkwmjBqY_O9djQhQtI!9s5L}Q`mDafpH_Ulixkd^ zks1u_e3)&DHzS+cTpJNsFdFCeNz>qNnRWR-!063-O~6`r{YV_+X{F)gQb_#re35Y>7E=E}rngLtl@z@SI?hOr2*92kqU|6x+nFsPCx^^u2&Des*b-8qx z!s3L-oUqcv>xRNBid_;PUdtYMp9agGAH^#0CsOjMyi{ei^`-;4+A-yZ>xmYUF%wSY z8eG?H)^)?FR+gqpUhjWb3#z^9%ihdpt92b23U|8yVTE?+V{5k%ao~26L{@Qmu%LZD z6Wn9%xijEbh_duU`*CC?cw+cuq(9?CP;=g9*z3rp{Lt0J$#5`nF*(V*#(ehk@7~pV z>{wymWyz#p;I|TF$O8uhWZ_^yZ@U zP{(Jncj5CD9-}8jmy6uzyA_99izh<_>mh{kCN($Zj!x_ANhKPHw|p-_K-PHb7mq z2+fMOwE6Z^mxX6dYx;Ty_UC-&z9T=_?Ng7+GGSUrPrhJGD7UrL8`OWCB^0ILXx^zZ zF*6}^wd&x#)ZqPWWTmw2C+bLcy2PE+a(8>~fmztw@=>{FGM;5o&8Yo6gi!O&NIZf- zL)sH>aIk56*hA`E_=?PF`-gN|KK&%Q@;Ud^;q9e7Q@w5fnVIH65OI-7!JT+U@yC{n zey2Q3USQT^v;;}-n2*-{A0tH|#a@;ytv_tdzybrejMIB|mR++RbKoOm5ub%e!03&~w`y zyRkCu!nhs|S8^t8oK0^(LZwc38{M>$SuDN8_hqAXDcP@qdDcK4tLcTU z&HbXe`r5Uu6F=`4oc@Id584Znk3=oGcYb~h>nPvbgCC##88}Q%s;-vost`PwIqv?2 z??&Aj9<0yo{p+}d0A^{-1S8zY^m=VqZ6jGOB|1Z+MLfRmU0H3{C32Qo2)Z&PE37R~q-&#pZt=ms} zF_@P)chJYfuOqq;HQiDgAvQb5na=BS5bT4dz55Gee<0sZ)Mg68UJw#&uywi>NWAO7 zMr^QtZf^j&*SExf{HoM`jO#iPsn>%+kV;icbm@~Kr1Sslac zmo&vGs=_tq>uXs_0X{9KZ4JZsY*x>lbS}*|EtwV%xvyHe#55LdN*>ooU4PwJr=`0+ zs^Cd7<>)>ZFsQk?5qZaF$#ZBoJ9o}=zO~NVb16NKW7BWkNb;v6zp5T2^3*7yXjIjn z=FQ0avDyMB^4Qoo&;oZNFrhnb_s1(kb5T3x7nsZ;gc~t5I4N4|Jz6gc)VS)0sHph} zyx;wvzC!<2)b1#lQA68wb0a(8TVvzhmJ)?^nESX>ob21T`_rr-#SKsLKK-dliih(+ zA!bb$a(I49{()aZT5NBj?6P^8Ewixi;r=Fy_dNFjqmPZ@PjidoJO@0ZLA`%Oqzg*AO*$GJ;}0Fx#|V353TpL=H~oVWRIW-0_(oj$Z5 zjj)+y-_>R9i0B202J?*8%Sr{ucgF^>_#wRU(({&{@*Xu_l`J{)302-Fk%Bf4qbw19 z`wlrlkc|A8;>ix^R_Aw#=qif`-O`Lb3-dF1avKiLYnK#}UX#CRGa7ORIO`v3TISu4(c`NM ztDG)Ar|T>}6E?AKX&SCWHjq&_`rTYu7>6z9<^Gg>nEGRK{aua@7wmJym^`7(8+$ zEAm7>xGeE;AH=?t$A?Jv7pI|dEseHrNw5*AnjWWb;X|youiIA)&K3CEuwZ`XaddAT zSGss~f4|mRr0`fe3)>UnU7WG(j~Og3G(XZ}K?}A%Jl`3l8+cb%_d)3{sc$~%ZNJyj zM7kD90r}qXyyeXOuPfg=lKhRU!nr0Rz3zLZ=24%upHlL&i9Y@P@ivM4);oSKB1Ll~ z8gD=8U-vb|=pQ<5*4AUD4K$}84K&thlGlH&|%s3>n;ZIsYl2Lu{q>as#=D zVBX_!w17vm>8o&B+`aqGenktZ(`DeDKurXvqe|C#mMIA$j4eV}Sqx9NIhaICKHk3> z?|#vaf&NfXoU5wMwVF3BOsB3i83p#|V5{Xk?Jbxow4L!f%@I963R7G0(J}jrGlXHz zIf|e2kOka%Y9I7H=D5x!=leLDRUO)!3}+@03(;i86)qTs8{G5lex}$!}-R8O}_&3Wf~uUqVTFFX4BOlLJd*T+eZD#1)maBzRyM*_lvAE zJU@>{&Q=n~Ykppy5n3v8*E?H2%8d-Tc9R^pR#wOcrzO5SiO-*l92cNJyfd8C)0h4t ze3q3m&UknyXZ^$3?D3+Tg4jn%Nmkz*sQDQATyFRLlF&4p zQm%zS2bhx&=wisCJYIj7dLZ*&)an0qt!Fx(_}`de(f`7i{(n!!(#J(71%|c-&Co^T z=NO3($qRdd-*y!kY`I1`!KUX72@&f`{XjeMoDqI0T4f6c>cxv=@o@|BBZyv8v@7%CMRgZmvSG?<4lWm(k`aW1fiJ1 z5+tZ=;}}JlJV%-+EhaiUFD>1EBf;!@Y!k)b3;*l+20rX!I|( z`NdV8JfeRU+kNMAQ`scywf2}XB&`>4T4Q>TtyT_1@7f=)N*-@c2U5~pcAXc9%qlI0 z)3?dTp(h(80A(4#XdfsqzXZ#Uh<;qA(R!(kuneu+3$lz>s9<-MCY_Gd2Yx#jAK?{g z9;=%zkV$g864J6iYc`+)F2Q#ItrPX<79ibA%KKsZ1+rCU2uA^V&K@>tUYBL&LeZ&O zAjQty_1;xW;`nOoYYQmsD7K-hBqYN+mMW1xP>DTG{AbcdUK$FD0->Q1avA1KD=jl3 zY(a43PgrzaRA{_mt^TRY$Y(liKAfoZWq-bv@$uO`CC@)qHA;fyG|(Tzp?td+?Ozkr zF}9#`xlEGqv|VYvRb}&-I6zR7_W1fhsp-txUki#D@HHkTP|JolSR#kd%ud$Da4D?g z#g6%NL{FzT57N>)kh)rbpasVby{j608}u3KoMNy8CTygY5)qwETG|soR_$Gi z!^cdM@Z4fd#S^gabB6ljpZaArmH!HBjEK$rS4g9synndW6y1Ep!8Ws4hPn0=Ac4Yo znsD$JQomMUx0N_IAkS*{|BL=)#LLw2mBV8snlACN*HfQ~AdY857_rG0B<#D<1)8ybDAyXZI_8gg{?&siCd7HyrTjTn^_c}2O zVS__~32Cb}W=WNfBW=&E4(9a3FHsebPp2D%Gfpp|M03q^Ik5ngw<)OnblLmW!3xMXe;xtpl?g#gYm;ER$nDpybfZt@trN9vtG1v4-3opO5Tqv) z@QS)D@8BjhXU+{}Pc8(mf83v$z4cR^7_XCU$DKR-HI237J=!592y&!$ZEewA915J@ zV2%mao|~D9ho%`QTYx*OekH%0zsES*b>n(pb$|VWB5lXHgBpdUv5oLCClMaCj`Kx4 zW#FVO<}uyyVo=iXwK=wE5nK*yt6m^EiN%2Et9_zl3bu;cnx>(=j!_aQ&#(i3Gvmh} zB%A{-6$79Id9MmJ-RJ^p!%P@f+*uxosIFCPJJZ@0Mz(hImi)sf7=5H4D=|_WdD9bP zxd6Mk zIh#7O-S-ciY>w%^k`l7X$gO7EY?Ax@ID6nnBcIi~B67SPUi{ILuvntAr(zjH-KIJo zom3J~yINUf!{#PvI7^EZ3+c|%({o%62<94%6#Mv00U9Tx(DV7W4MOFM=|hNpnHh)D zn72RjPKbW+Bn*CN`el`goY?D?3NwW@I(xd5C34Bsj^ptWm6p{Zo?4xB$Z8I+0M;1w z`0dr)1?$02b`|Zda7`wHKS8i zLh$-{VWa3QWiF+7b(kL=H1Tn3S!HhXQp)XH$wSY2&&Llyoyq#&j)9tCV}A-r5%g*2^w*?IsmVJx{TD}pd{{EH$+ zXFuquQtbhVEI#?3`^~X8R`XWd^4hMCXadXllAliD**Qz7v|V`Z$Kg-~v&`cWG}5u| zJmv-Gw>lAFN;)|y(vSge{>J;ppb_RD-1|KCVp09!au50AJu?5p3uA9;la{1nhjhYf zq_%&&ZX(w{8JYA-R#$lIU_bn@KHore2~9RyiWk!Q z9zbE9&k~9p%gLMGA9(`NFWWsp>*)!}U+!FRHb%uZ>~O_Q`P@lg%rI6CW=^Vu5cKD4R>?l7kkjw$@@0cgn1nJKOFGhZZw+nI z5#sOrqZa$k=?1{eI5w@%Y0ciNZiEMiJ1NlxEWWM&~foSicOJnKFl@FYgUJ1(8ed~ zmgly>8%y=cvvJYRSBkt~?1&(sJL2_zP{nBKQ2uW;)@oQ^Vby_#?Mvv#o9kwUNu8=i zo{JykdZ#}?c0Kv331bpY*vNgF<+7p}jF6A;A^h|8A8>G$?_l&+ zSWI`bnm^pX0gdu%haE%MK4=JIJfU!(UpQYI(h&vO)jH3w#5dH$X!dw8u5!3wcQ2KB z-YWkD_|ygG4vVgq_>rH~MW!UZQ?qUdcu;)jp)=f>JigO_UO8W~YNogGJd4o)cwmS2 z9?1xN=YXNM0136V=Udq|*#I&EcB^#1=KJ+Mg>Y||?(+%lL9HpjRM>CojR_*Wrj^(*a|Br#LVUZCn_5&kAWk6tLd%?F@8p4dS|j;S&|5JC7<~j4sK_H zM9-n$FmGhiYU~~bt+08L9%Hi38`mRhy5TtIoqVz&$G%E%*FaID~TVzjZb#zz`GFoqOPP>nmp4XBcw`t0p;!{B@K$i`Hw-?28_hpb~8;w+Mw zpePG)(lF){C7iyvmu!T;YY9)TcTAH_Td<->^6wuQI7o6<#r#73teX+^K^I>2%7pn8WCb92(x)c>xAJ zoi>pREqKGt9nMM_rVB%zn~!LoaQ%uyit*ZqR(mdyi>X6DONc=IB?G+7vb7EI!zf9f z?K)CDSC~c5t)ea2oow;r2Yt?4LV9S$HjSxObCcC3?$=_2@X_xuG{KK2VdFA3W?5UG z)?sdktoo|ZKZZxO&Yzum?+|%nxodAz&GgrmfWfYBcG?Av+pM~XWzx%|BO+|? zCXSCn{0&$?=eZ{DJ&x{w);04lx21pO;p4_yOj}%L$!FS|dOflSY!h91*tsO6yG*EO zP<>WoxwTEEm@?Bx{znmk^N#%e3Xm!>Y;Hm%X@lhOyh@2-Fz>NZDR N^zy&Z_}$gJ{|EF9>IDD* literal 0 HcmV?d00001 diff --git a/docs/implementation-plan.md b/docs/implementation-plan.md new file mode 100644 index 0000000..d4231f2 --- /dev/null +++ b/docs/implementation-plan.md @@ -0,0 +1,45 @@ +# XAS 测试控制台实施计划 + +> 历史计划：本文件只描述已完成的 Rundeck 阶段。当前实施入口是 [console-plan.md](console-plan.md)。 + +日期：2026-10-13。设计见 design.md。当前会话内执行，遵循用户不创建 Git 历史的规则。 + +## 验收要求 + +保留现有服务和其他工作区；不使用 GPU、不调用模型；代码和服务器运行数据分开；先实现轻量验收全流程。 + +## 任务 + +- [x] 1. 运行器与验收脚本：先写失败测试，覆盖成功、失败、报告异常、重复编号、输入拒绝、超时和 Linux 子进程取消，再实现最小功能。 + - 文件：scripts/run_smoke.py、scripts/smoke_task.py、tests/test_runner.py。 + - 接口：run_smoke.py --mode MODE --run-id ID --timeout SECONDS --results-root PATH。 + - 验证：python -m unittest discover -s tests -v；Linux 上进程测试不得跳过。 +- [x] 2. Rundeck 配置：固定版本、限制资源、回环绑定、专用数据目录；生成单一白名单任务定义与外部来源目录。 + - 文件：deploy/、catalog/、README.md。 + - 验证：服务运行身份、挂载和设备可见性；任务参数校验和非授权请求拒绝。 +- [x] 3. 服务器验证：复核资源后只部署本项目，验证 API 正常、失败、报告异常、超时、取消和运行记录。 + - 证据：脱敏汇总保存于 docs/acceptance-2026-10-13.md。 +- [x] 4. 浏览器与交付：核对登录、任务、参数、日志与历史页面；交代未验证范围、访问方式和恢复方式。 + +## 重点故障 + +- 运行编号复用、路径穿越和无效模式：在创建进程前拒绝。 +- 进程正常退出但报告无效：结果失败。 +- 取消、超时与正常结束：只清理本次进程组，并核验后代退出。 +- 管理页面与脚本输入：只有登记任务可执行，普通操作角色不能执行任意命令。 +- 新容器不能访问 GPU、其他维护者目录或 Docker socket。 + +## 执行记录 + +- 10:53 只读预检查：现有 DeepSeek 容器运行，GPU 0～7 占用显存；磁盘约 1.4 TiB 可用。现有 Docker 可通过正常 sudo 使用，未安装 Compose；直接使用项目部署脚本，不修改系统工具链。 +- Final: 独立审查的 runtime 父链接越界问题已修复；test_runtime_parent_link_cannot_escape_project 与相关测试 RED→GREEN，Linux 全套 10/10 通过。 +- UI/API: 实际执行 1～6 已核验；浏览器状态伪元素造成的自动定位问题仅重读已有执行，没有重跑业务任务。 +- 交付保留项：用户私密设置网页登录密码；公司远程 Git 仓库稍后接入；正式 GPU 脚本尚未开放。 + +## 后续内网免登录调整（用户最新要求） + +- [x] 固定访客角色与核对过的网段限制，移除密码设置工具。 +- [x] 通过共享网络命名空间和后端回环阻止宿主机直连伪造角色；回归先失败再通过。 +- [x] 保存旧容器、源码与停机数据快照；验证权限拒绝、浏览器执行 7、日志及全部历史。 +- [x] 最终 Linux 14/14，更新 README、ADR 和当前验收。 +- 原“用户设置密码”保留项被最新要求取消；Git 远程与正式 GPU 脚本仍待后续接入。 diff --git a/docs/legacy-smoke-plan.md b/docs/legacy-smoke-plan.md new file mode 100644 index 0000000..6de7eb3 --- /dev/null +++ b/docs/legacy-smoke-plan.md @@ -0,0 +1,35 @@ +# 单个旧脚本接入计划 + +> 已被新方案覆盖：没有实施本文的 Rundeck/UNIX socket 集成。当前采用专用控制台与私有执行器，见 [console-plan.md](console-plan.md)。原始副本仍保持不变。 + +日期：2026-10-13。用户已选择轻量功能检查，并明确只复制一份脚本，保留写死的 GPU、端口、路径，不修改其他维护者工作区；结果和日志需在控制台可见。 + +## 范围 + +只复制 20261010-dsv41-trial/scripts/smoke.sh，字节和 SHA-256 保持一致。它包含一次模型列表 GET 和三个顺序推理请求，每个请求原有 max_tokens=512。完整 functional_check.py 含长上下文，不纳入本次。 + +新增独立 CPU 执行容器，复用现有镜像的 Bash/curl/Python，不安装模型或开启 GPU 设备。容器内回环 18100 适配原脚本固定地址，转发到已有模型服务；代理只允许固定模型、固定路径及最多三个推理请求，不自动重试。原认证文件仅单文件只读挂载，在启动时读入内存后降为现有 UID 1000；不复制密钥、不写入环境或日志。 + +Rundeck 通过项目结果目录中的专用 UNIX socket 调用固定任务。任务定义由 Git 工作区中的客户端源文件生成后导入数据库，不从 Git 自动拉取。执行容器只运行原样副本，结果保存在本项目 runtime/results/legacy/<执行编号>，日志流和中文逐项汇总回传控制台。 + +## 行为约束 + +- 原脚本只复制一个；源工作区只读。 +- 不启动、停止、重启模型服务，不更改 GPU 分配。 +- 每次最多 1 个模型列表请求、3 个推理请求，顺序执行，无自动重试；总时限 180 秒。 +- 请求转发前持久化次数；同一执行编号不重复运行，服务重启不重置记录。 +- 同时只允许一个旧脚本任务，重复或并发请求拒绝。 +- 取消关闭本次客户端和进程组，阻止新请求；已提交的上游请求取消不能保证，记录结果未知。 +- 模型结果完整性和接口成功分别判断，不能把退出 0 或截断回答当作通过；不宣称完成标准模型质量评测。 +- 密钥和上游认证头不进入命令参数、文件、Git 或网页日志。 + +## 实施步骤 + +- [ ] 原样复制并核对哈希；备份本项目受影响配置。 +- [ ] 编写并验证请求预算、结果判定、日志脱敏和旧脚本进程生命周期。 +- [ ] 配置隔离执行容器和固定 UNIX socket 客户端，登记一个网页任务。 +- [ ] 在无网络隔离容器内用模拟上游验证原脚本、超时、取消、重复编号与恢复路径。 +- [ ] 真实调用只运行一轮：1 GET + 3 推理请求，不因模型失败自动重跑。 +- [ ] 浏览器核对日志与结果；记录请求次数、原脚本哈希、原模型容器状态；更新维护说明。 + +所有 Git 改动保持未暂存、未提交、未推送。测试结果真实失败时保留失败证据，不修改原脚本参数来制造通过。 diff --git a/docs/native-execution-plan.md b/docs/native-execution-plan.md new file mode 100644 index 0000000..e5bf003 --- /dev/null +++ b/docs/native-execution-plan.md @@ -0,0 +1,45 @@ +# 原环境执行设计与实施计划 + +日期：2026-10-13。用户已明确同意开放测试入口，并采用“普通接口直接触发；启停服务/占整机的测试显示影响并逐次确认”的方式。不修改原项目的脚本、配置和素材；运行本身仍按原逻辑产生输出及副作用。本轮验证不自动执行整机压测或启停现有模型。 + +## 业务与执行边界 + +已有项目新增 native 原环境方案：在服务器原工作目录，以已登记的解释器和固定原入口运行，复用原配置文件及现有 Docker 工具。上传脚本继续在隔离容器中运行，网页不能把任意上传代码切换为宿主执行，也不能填写任意宿主命令、账号、解释器或环境变量。 + +每个方案明确：原入口、目录、可选参数类型/范围、环境和凭据来源、输出位置、预计影响及是否需要确认。登记可读元数据在 catalog/native-profiles.json；秘密只在宿主执行时读取并保留内存，不能进 API 响应、命令行、数据库或日志。 + +Native 运行使用独立的 systemd transient service，按运行编号关联，使用原账号和目录。不套用通用容器的 1 CPU/512 MiB 限制；仅限制同一控制台单任务和总时限。默认允许最长 72 小时，超过原先两小时限制的长稳测试可按需设置。工作进程/模型的实际 CPU/GPU 仍按原项目配置。 + +运行前预检是只读的：检查入口摘要、所需文件/工具、参数和目标服务端口（TCP 连接，不发推理请求）。预检返回计划摘要，影响确认绑定源码、参数与方案版本，变化后须重新确认。开始运行保存计划与确认记录。 + +菜单型入口使用 PTY，控制台仅接受数字选项/数字列表或 y/n/q，留空发送回车。不接受 shell 命令、控制键、密码或令牌；输入不写数据库，PTY 关闭回显。需要自由文本的原工具高级维护操作继续使用原维护入口，不通过此测试控制台发送。执行器只能向已启动的本项目交互式任务传入输入。 + +取消只针对本次 transient service 的进程组/cgroup，先给原脚本收尾时间，再强制结束残留本机进程。原脚本通过 Docker daemon 创建的容器不属于本机 cgroup，控制台不擅自清理或宣称已恢复原模型。保存运行前后容器状态差异并提示核对。worker 重启后重新关联仍存活的 native service，不重跑命令、不重置尝试次数。 + +数据库沿用 schema v1，在 JSON 记录增加可选 native_options 与 execution 字段。历史记录、版本、源码文件和 ID 不改写。新原环境登记是配置更新，保留旧记录和备份；恢复旧应用前须无活动 native 任务，不能让旧执行器误处理新任务。 + +## 模块职责与实施顺序 + +- [x] 清点并登记各入口的原参数、依赖、配置、影响及缺失项；不猜测凭据/启动命令。 +- [x] 先写参数、命令注入防护、来源限制、确认失效与原文件不变等测试，再实现原环境计划生成。 +- [x] 实现独立 transient service、日志脱敏、取消/超时、输入通道及 worker 重关联；用本项目短样例验证，不运行整机任务。 +- [x] 实现只读方案展示、原参数表单、预检与逐次影响确认、交互输入和原环境运行信息。 +- [x] 集成审查、回归及真实浏览器验证，备份后更新网页/worker，核验原文件摘要和当前模型服务。 + +所有新手写源码文件不超过 500 行，无 Git 暂存、提交或推送。现有仓库没有提交，继续在当前已确认工作目录增量修改，不创建包含用户未提交内容的额外 Git 历史。 + +## 前后端接口契约 + +Script 增加 `execution`：`{mode:'native'|'container', profile_id?, interpreter?, user?, cwd?, description?, impact:{level:'standard'|'resource'|'service',title,details:[],requires_confirmation}, parameters:[{key,label,type:'integer'|'number'|'select'|'text',default,min?,max?,options?:[{value,label}],required?,help?}], interactive:boolean, max_timeout_seconds:number}`。 + +native 项目的 config 增加 `native_options:{key:value}`。旧 args/cwd/output_paths 为方案计算值，不允许网页自由改写；网页显示只读启动目录、环境说明与输出规则。可编辑参数和 timeout_seconds，以及现有名称/说明/启用状态。PATCH 仍是 `/api/scripts/{id}`，新字段位于 `config.native_options`。 + +POST `/api/scripts/{id}/preflight`，JSON `{}`，含 X-XAS-Console:1。返回 `{ready:boolean,plan_token:string,mode,command_preview:string,cwd:string,user:string,checks:[{name,ok,message}],impact:{...},interactive:boolean,output_paths:[],notes:[]}`。没有副作用，不执行原脚本。原输出中的 `{run_id}` 保持占位，队列分配编号后再解析。 + +POST `/api/scripts/{id}/runs` 扩展 `{request_id:UUID,plan_token?:string,impact_acknowledged?:boolean}`。native 必须先预检；有影响的方案必须显式确认，计划变更返回 409/400，重新预检。普通容器脚本原调用仍可用。 + +Run 增加 `execution`：`{mode,profile_id?,command_preview?,cwd?,user?,impact?,impact_acknowledged?,interactive?,unit?,verification?:...}`。默认字段缺失的历史记录按 container 展示。运行仍单并发。 + +POST `/api/runs/{id}/input`，JSON `{text:string}`；仅 native、interactive、running 状态接受，单次 <=1024 UTF-8 字节，禁止 NUL；末尾自动换行。返回 `{accepted:true}`。无需把输入保存到历史记录。拒绝任意路径、其他任务或已结束运行。用户应只输入原菜单需要的选项，不输入密码或令牌。 + +日志和结果 API 沿用现有接口。native 结果包含原命令/环境引用、源码摘要、退出状态、取消/清理说明和容器状态差异。对未完成真实 GPU/长稳业务验证的项目，页面说明“启动方案已接入，未完成本轮业务验收”。 diff --git a/legacy/dsv41-smoke/SOURCE.md b/legacy/dsv41-smoke/SOURCE.md new file mode 100644 index 0000000..981252c --- /dev/null +++ b/legacy/dsv41-smoke/SOURCE.md @@ -0,0 +1,14 @@ +# 原样脚本副本 + +复制日期：2026-10-13（北京时间）。用户明确授权复制一份脚本。 + +- 来源：/dengyuyun-joy-work-space/workpc-claude-code/20261010-dsv41-trial/scripts/smoke.sh +- 原作者标注：dengyuyun-joy，保留原注释。 +- SHA-256：be858e914d87454240791da773578cb3f80f380e740f919546db347b7715a13d +- 修改：无，按字节复制；固定端口、模型名、提示词和输出限制全部保留。 +- 依赖：Bash、curl、Python 标准库。 +- 外部调用：一次 GET /v1/models，三个顺序 POST /v1/chat/completions。 +- 脚本只输出标准输出；控制台包装层保存日志和结构化汇总，不向原工作区写入文件。 +- 原脚本不含认证参数；隔离执行环境的限定代理按需使用现有服务凭据，凭据不在此仓库。 + +此副本不自动跟随原文件变化。后续更新需重新审阅差异、记录新哈希并验证。 diff --git a/legacy/dsv41-smoke/smoke.sh b/legacy/dsv41-smoke/smoke.sh new file mode 100644 index 0000000..3f11b67 --- /dev/null +++ b/legacy/dsv41-smoke/smoke.sh @@ -0,0 +1,17 @@ +#!/bin/bash +# dengyuyun-joy: quick functional check against the trial API. +U=http://127.0.0.1:18100 +curl -s -m 10 $U/v1/models | python3 -c "import json,sys;d=json.load(sys.stdin);print('models:',[(m['id'],m.get('max_model_len')) for m in d['data']])" +for q in "用一句话介绍你自己。" "计算 123456 × 789，只给出结果。" "Write a Python function that returns the n-th Fibonacci number, then explain it in one sentence."; do +python3 - "$q" <<'PY' +import json,sys,time,urllib.request +q=sys.argv[1] +body={"model":"deepseek-v4.1-flash","messages":[{"role":"user","content":q}],"temperature":0,"max_tokens":512} +t=time.time() +r=urllib.request.urlopen(urllib.request.Request("http://127.0.0.1:18100/v1/chat/completions",json.dumps(body).encode(),{"Content-Type":"application/json"}),timeout=600) +d=json.load(r); dt=time.time()-t +m=d["choices"][0]["message"]; u=d.get("usage",{}) +print("Q:",q); print("A:",(m.get("content") or "").strip()[:600]); print("reasoning chars:",len(m.get("reasoning_content") or m.get("reasoning") or "")) +print(f"usage={u} wall={dt:.1f}s ~{u.get('completion_tokens',0)/dt:.1f} tok/s"); print("-"*60) +PY +done diff --git a/scripts/console_example.py b/scripts/console_example.py new file mode 100644 index 0000000..be8eb6e --- /dev/null +++ b/scripts/console_example.py @@ -0,0 +1,23 @@ +"""Fast deterministic example; no model service or GPU access.""" +import argparse +import json +import os +from pathlib import Path +import sys +import time + +parser = argparse.ArgumentParser() +parser.add_argument("--scenario", choices=["success", "failure", "wait"], default="success") +args = parser.parse_args() +root = Path(os.environ["XAS_RUN_DIR"]) +print("开始快速流程验收（模拟数据），不调用模型。", flush=True) +for index in range(3): + print(f"步骤 {index + 1}/3：日志输出正常", flush=True) + time.sleep(0.3) +if args.scenario == "wait": + print("等待取消或超时。", flush=True) + time.sleep(120) +report = {"synthetic": True, "scenario": args.scenario, "success": args.scenario == "success", "checks": 3} +(root / "result.json").write_text(json.dumps(report, ensure_ascii=False, indent=2), encoding="utf-8") +print("结果已写入 result.json", flush=True) +sys.exit(0 if args.scenario == "success" else 2) diff --git a/scripts/run_smoke.py b/scripts/run_smoke.py new file mode 100644 index 0000000..f10bd9d --- /dev/null +++ b/scripts/run_smoke.py @@ -0,0 +1,175 @@ +#!/usr/bin/env python3 +"""Run only the bundled synthetic acceptance task, with bounded lifetime.""" +import argparse +import ctypes +from datetime import datetime, timezone +import hashlib +import json +import math +import os +from pathlib import Path +import re +import signal +import subprocess +import sys +import time + +MODES = ("success", "failure", "invalid-report", "wait") + + +def now(): + return datetime.now(timezone.utc).isoformat() + + +def write_json(path, value): + temporary = path.with_suffix(".tmp") + with temporary.open("x", encoding="utf-8") as stream: + json.dump(value, stream, ensure_ascii=False, indent=2) + stream.write("\n") + stream.flush() + os.fsync(stream.fileno()) + temporary.replace(path) + + +def subreaper(): + # Adopt the fixture's child so cancellation can reap it even in containers. + if sys.platform == "linux": + libc = ctypes.CDLL(None, use_errno=True) + if libc.prctl(36, 1, 0, 0, 0) != 0: + raise OSError(ctypes.get_errno(), "cannot enable child subreaper") + + +def cleanup(proc): + if os.name == "posix": + for sig in (signal.SIGTERM, signal.SIGKILL): + try: + os.killpg(proc.pid, sig) + except ProcessLookupError: + break + if sig == signal.SIGTERM: + time.sleep(.15) + elif proc.poll() is None: + proc.terminate() + try: + proc.wait(timeout=2) + except subprocess.TimeoutExpired: + proc.kill() + proc.wait(timeout=2) + if sys.platform == "linux": + deadline = time.monotonic() + 2 + while True: + try: + pid, _ = os.waitpid(-1, os.WNOHANG) + except ChildProcessError: + break + if pid == 0: + if time.monotonic() >= deadline: + raise RuntimeError("child cleanup could not be confirmed") + time.sleep(.02) + + +def read_result(folder, run_id): + path = folder / "result.json" + if path.is_symlink() or path.stat().st_size > 65536: + raise ValueError("invalid result file") + result = json.loads(path.read_text(encoding="utf-8")) + if (not isinstance(result, dict) or result.get("run_id") != run_id + or result.get("synthetic") is not True + or type(result.get("checks_passed")) is not int + or result["checks_passed"] != 3): + raise ValueError("result does not satisfy the acceptance contract") + return result + + +def arguments(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--mode", choices=MODES, default=os.getenv("RD_OPTION_MODE", "success")) + parser.add_argument("--run-id", default=os.getenv("RD_JOB_EXECID")) + parser.add_argument("--timeout", type=float, default=os.getenv("RD_OPTION_TIMEOUT", "8")) + parser.add_argument("--results-root", type=Path, + default=Path(os.getenv("XAS_RESULTS_ROOT", "/home/rundeck/test-results"))) + args = parser.parse_args() + if args.mode not in MODES: + parser.error("unregistered mode") + if not args.run_id or not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9_-]{0,63}", args.run_id): + parser.error("run-id must be 1-64 letters, digits, underscores or hyphens") + if not math.isfinite(args.timeout) or not 2 <= args.timeout <= 30: + parser.error("timeout must be between 2 and 30 seconds") + if os.name != "posix" and args.mode == "wait": + parser.error("wait/cancellation acceptance requires Linux") + return args + + +def main(): + args = arguments() + os.umask(0o077) + args.results_root.mkdir(parents=True, exist_ok=True) + folder = args.results_root.resolve() / args.run_id + try: + folder.mkdir() + except FileExistsError: + print("Run ID already exists; history was preserved", file=sys.stderr) + return 2 + source = Path(__file__).resolve().parent + summary = {"schema_version": 1, "run_id": args.run_id, "synthetic": True, + "mode": args.mode, "timeout_seconds": args.timeout, + "started_at": now(), "status": "running", "exit_code": None, + "source_sha256": {name: hashlib.sha256((source / name).read_bytes()).hexdigest() + for name in ("run_smoke.py", "smoke_task.py")}} + write_json(folder / "request.json", summary) + cancelled = False + + def on_signal(signum, frame): + nonlocal cancelled + cancelled = True + + signal.signal(signal.SIGTERM, on_signal) + signal.signal(signal.SIGINT, on_signal) + proc = None + rc = 1 + try: + subreaper() + proc = subprocess.Popen([sys.executable, "-u", str(source / "smoke_task.py"), + args.mode, args.run_id, str(folder)], + start_new_session=(os.name == "posix")) + deadline = time.monotonic() + args.timeout + while proc.poll() is None and not cancelled and time.monotonic() < deadline: + time.sleep(.04) + summary["exit_code"] = proc.poll() + if cancelled: + summary["status"], rc = "cancelled", 130 + elif proc.poll() is None: + summary["status"], rc = "timed_out", 124 + elif proc.returncode != 0: + summary["status"] = "failed" + else: + try: + summary["result"] = read_result(folder, args.run_id) + summary["status"], rc = "succeeded", 0 + except (OSError, ValueError, TypeError): + summary["status"] = "invalid_result" + except (OSError, RuntimeError) as exc: + summary["status"] = "runner_error" + summary["error_type"] = type(exc).__name__ + finally: + if proc is not None: + try: + cleanup(proc) + summary["cleanup_confirmed"] = True + except (OSError, RuntimeError, subprocess.TimeoutExpired) as exc: + summary["status"], rc = "cleanup_failed", 1 + summary["cleanup_confirmed"] = False + summary["error_type"] = type(exc).__name__ + summary["worker_pid"] = proc.pid + summary["final_exit_code"] = proc.returncode + child_file = folder / "child.pid" + if child_file.exists(): + summary["child_pid"] = int(child_file.read_text(encoding="utf-8")) + summary["finished_at"] = now() + write_json(folder / "summary.json", summary) + print("XAS_ACCEPTANCE_RESULT " + json.dumps(summary, ensure_ascii=False), flush=True) + return rc + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/smoke_task.py b/scripts/smoke_task.py new file mode 100644 index 0000000..6bad935 --- /dev/null +++ b/scripts/smoke_task.py @@ -0,0 +1,38 @@ +#!/usr/bin/env python3 +"""Synthetic fixture. No GPU, network, model calls or existing data access.""" +import json +from pathlib import Path +import subprocess +import sys +import time + + +def main(): + mode, run_id, destination = sys.argv[1:] + folder = Path(destination) + print("SYNTHETIC FLOW ACCEPTANCE: not a model benchmark", flush=True) + if mode == "wait": + child = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(60)"]) + (folder / "child.pid").write_text(str(child.pid), encoding="utf-8") + print(f"waiting; controlled_child_pid={child.pid}", flush=True) + child.wait(timeout=65) + return 0 + if mode == "failure": + print("Expected fixture failure", flush=True) + return 23 + if mode == "invalid-report": + (folder / "result.json").write_text('{"incomplete":true}', encoding="utf-8") + return 0 + if mode != "success": + return 2 + for step in range(1, 4): + print(f"progress={step}/3", flush=True) + time.sleep(.2) + (folder / "result.json").write_text(json.dumps({ + "run_id": run_id, "synthetic": True, "checks_passed": 3, + "description": "Synthetic flow acceptance only"}), encoding="utf-8") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/tests/test_console.py b/tests/test_console.py new file mode 100644 index 0000000..44615e1 --- /dev/null +++ b/tests/test_console.py @@ -0,0 +1,157 @@ +"""Console contracts: immutable uploads, isolation and durable queue semantics.""" +import json +from pathlib import Path +import tempfile +import unittest +from fastapi.testclient import TestClient +from console.app import create_app +from console.settings import Settings +from console.store import Store + + +class ConsoleTests(unittest.TestCase): + def setUp(self): + self.temp = tempfile.TemporaryDirectory() + self.root = Path(self.temp.name) + self.source = self.root / "original" / "scripts" + self.source.mkdir(parents=True) + self.settings = Settings(self.root / "runtime", [ + {"id": "trial", "path": str(self.source)}], allowed_hosts=["testserver"], + allowed_networks=["127.0.0.0/8"], test_mode=True) + self.settings.test_definitions = [{"key": name, "source_group": "trial", "entry": name, + "name": name, "kind": "test"} for name in ("sample.py", "test.py", "stop.sh")] + self.app = create_app(self.settings) + self.client = TestClient(self.app, client=("127.0.0.1", 5555)) + self.headers = {"X-XAS-Console": "1"} + + def tearDown(self): + self.client.close() + self.temp.cleanup() + + def upload(self, content=b"print('hello')\n", name="test.py"): + r = self.client.post("/api/scripts/upload", files={"file": (name, content)}, + data={"name": "Sample"}, headers=self.headers) + self.assertEqual(r.status_code, 200, r.text) + return r.json() + + def queue(self, script, key="9ad0745c-0d5e-4d1e-88e8-000000000001"): + return self.client.post(f"/api/scripts/{script['id']}/runs", + json={"request_id": key}, headers=self.headers) + + def test_upload_versions_are_immutable_and_runs_pin_version(self): + script = self.upload() + run = self.queue(script).json() + new = self.client.post(f"/api/scripts/{script['id']}/versions", + files={"file": ("test.py", b"print('v2')\n")}, headers=self.headers) + self.assertEqual(new.status_code, 200, new.text) + old = self.client.get(f"/api/scripts/{script['id']}/code?version=1").json() + self.assertEqual(old["code"], "print('hello')\n") + self.assertEqual(self.client.get(f"/api/runs/{run['id']}").json()["version"], 1) + self.assertEqual(new.json()["version"], 2) + + def test_code_cannot_be_patched_and_path_cannot_be_replaced(self): + s = self.upload() + for patch in ({"code": "bad"}, {"source_path": "/etc/passwd"}, + {"config": {"profile": "legacy_smoke"}}): + r = self.client.patch(f"/api/scripts/{s['id']}", json=patch, headers=self.headers) + self.assertEqual(r.status_code, 422, r.text) + + def test_upload_rejects_traversal_secrets_and_oversize(self): + for name, content in [("../x.py", b"pass"), ("x.env", b"pass"), + ("x.py", b"API_KEY = 'abc-secret-key-value-01234'"), + ("x.py", b"x" * (1024 * 1024 + 1))]: + r = self.client.post("/api/scripts/upload", files={"file": (name, content)}, + headers=self.headers) + self.assertIn(r.status_code, (400, 413, 422), r.text) + + def test_cross_site_mutations_and_host_spoofing_rejected(self): + r = self.client.post("/api/discover", headers={**self.headers, "Origin": "https://evil.test"}) + self.assertEqual(r.status_code, 403) + self.assertEqual(self.client.post("/api/discover").status_code, 403) + self.assertEqual(self.client.get("/api/summary", headers={"Host": "evil.test"}).status_code, 403) + + def test_duplicate_submission_and_single_claim(self): + s = self.upload() + a, b = self.queue(s), self.queue(s) + self.assertEqual(a.json()["id"], b.json()["id"]) + store = Store(self.settings) + self.assertEqual(store.claim()["id"], a.json()["id"]) + self.assertIsNone(store.claim()) + self.queue(s, "9ad0745c-0d5e-4d1e-88e8-000000000002") + self.assertIsNone(store.claim()) + + def test_pending_cancellation_does_not_execute(self): + run = self.queue(self.upload()).json() + r = self.client.post(f"/api/runs/{run['id']}/cancel", headers=self.headers) + self.assertEqual(r.json()["state"], "cancelled") + self.assertIsNone(Store(self.settings).claim()) + + def test_external_inventory_readonly_and_missing_detection(self): + p = self.source / "sample.py" + p.write_text("print('original')", encoding="utf-8") + self.client.post("/api/discover", headers=self.headers) + s = self.client.get("/api/scripts").json()["items"][0] + self.assertEqual(s["kind"], "external") + self.assertFalse(s["enabled"]) + self.assertEqual(p.read_text(), "print('original')") + p.unlink() + self.client.post("/api/discover", headers=self.headers) + self.assertEqual(self.client.get(f"/api/scripts/{s['id']}").json()["status"], "missing") + + def test_service_management_script_cannot_be_enabled(self): + (self.source / "stop.sh").write_text("docker stop other-service\n") + self.client.post("/api/discover", headers=self.headers) + s = self.client.get("/api/scripts").json()["items"][0] + r = self.client.patch(f"/api/scripts/{s['id']}", json={"enabled": True}, headers=self.headers) + self.assertEqual(r.status_code, 400, r.text) + + def test_external_output_path_cannot_escape_source_family(self): + (self.source / "test.py").write_text("print(1)\n") + self.client.post("/api/discover", headers=self.headers) + s = self.client.get("/api/scripts").json()["items"][0] + for path in ["/etc", str(self.source), str(self.source.parent / "configs")]: + r = self.client.patch(f"/api/scripts/{s['id']}", + json={"config": {"output_paths": [path]}}, headers=self.headers) + self.assertEqual(r.status_code, 400, r.text) + + def test_log_offset_unicode_and_artifact_path_boundary(self): + run = self.queue(self.upload()).json() + d = self.settings.runs / run["id"] + d.mkdir(exist_ok=True) + (d / "console.log").write_bytes("你好\n".encode("utf-8")) + a = self.client.get(f"/api/runs/{run['id']}/log?offset=0").json() + self.assertEqual(a["text"], "你好\n") + b = self.client.get(f"/api/runs/{run['id']}/log?offset={a['next_offset']}").json() + self.assertEqual(b["text"], "") + self.assertEqual(self.client.get(f"/api/runs/{run['id']}/artifacts/nope").status_code, 404) + + def test_finished_log_utf8_character_across_chunk_boundary(self): + run = self.queue(self.upload()).json() + directory = self.settings.runs / run["id"] + directory.mkdir() + content = "x" * 65535 + "你" + "tail" + (directory / "console.log").write_bytes(content.encode("utf-8")) + Store(self.settings).finish(run["id"], "succeeded") + first = self.client.get(f"/api/runs/{run['id']}/log").json() + second = self.client.get(f"/api/runs/{run['id']}/log?offset={first['next_offset']}").json() + self.assertEqual(first["text"] + second["text"], content) + + def test_runtime_parent_link_rejected_before_writes(self): + from deploy.dedicated import validate_runtime + outside = self.root / "outside" + outside.mkdir() + project = self.root / "project" + project.mkdir() + try: + (project / "runtime").symlink_to(outside, target_is_directory=True) + except OSError: + self.skipTest("OS account cannot create directory symlinks") + with self.assertRaises(ValueError): + validate_runtime(project) + with self.assertRaises(ValueError): + Settings(project / "runtime", []).prepare() + self.assertEqual(list(outside.iterdir()), []) + + +if __name__ == "__main__": + unittest.main() diff --git a/tests/test_console_outputs.py b/tests/test_console_outputs.py new file mode 100644 index 0000000..aa8925a --- /dev/null +++ b/tests/test_console_outputs.py @@ -0,0 +1,126 @@ +from http.server import BaseHTTPRequestHandler, HTTPServer +import json +from pathlib import Path +import tempfile +import threading +import unittest +import urllib.error +import urllib.request +from console.artifacts import Collector +from console.job_main import BudgetRelay +from console.settings import Settings + + +class OutputTests(unittest.TestCase): + def test_final_file_log_drain_includes_fast_script_tail_larger_than_one_chunk(self): + with tempfile.TemporaryDirectory() as temp: + root = Path(temp) + logs, run = root / "logs", root / "run" + logs.mkdir() + run.mkdir() + collector = Collector(Settings(root, []), run, [str(logs)]) + payload = b"file log\n" * 10000 + (logs / "new.log").write_bytes(payload) + parts = [] + collector.finish_follow(parts.append) + self.assertEqual(b"".join(parts), "\n[文件日志 new.log]\n".encode() + payload) + self.assertEqual(collector.follow(parts.append), 0) + + def test_proxy_does_not_redirect_credentials_or_add_requests(self): + seen = [] + class Redirect(BaseHTTPRequestHandler): + def log_message(self, *args): + pass + def do_GET(self): + seen.append(self.path) + self.send_response(302) + self.send_header("Location", "/unexpected") + self.end_headers() + upstream = HTTPServer(("127.0.0.1", 0), Redirect) + relay = BudgetRelay(("127.0.0.1", 0), f"http://127.0.0.1:{upstream.server_port}", "test-only-credential") + threads = [threading.Thread(target=s.serve_forever, daemon=True) for s in (upstream, relay)] + for thread in threads: + thread.start() + try: + with self.assertRaises(urllib.error.HTTPError) as rejected: + urllib.request.urlopen(f"http://127.0.0.1:{relay.server_port}/v1/models", timeout=5) + self.assertEqual(rejected.exception.code, 302) + self.assertEqual(seen, ["/v1/models"]) + self.assertEqual(relay.gets, 1) + finally: + for server in (relay, upstream): + server.shutdown() + server.server_close() + for thread in threads: + thread.join() + + def test_only_changed_external_outputs_are_archived_and_originals_preserved(self): + with tempfile.TemporaryDirectory() as temp: + root = Path(temp) + output, run = root / "original_logs", root / "run" + output.mkdir() + run.mkdir() + (run / "work").mkdir() + old = output / "old.json" + old.write_text('{"old":true}') + log = output / "current.log" + log.write_bytes(b"previous\n") + collector = Collector(Settings(root, []), run, [str(output)]) + with log.open("ab") as handle: + handle.write("新日志\n".encode()) + messages = [] + collector.follow(messages.append) + collector.follow(messages.append) + self.assertEqual(len(messages), 1) + self.assertIn("新日志", messages[0].decode()) + self.assertNotIn("previous", messages[0].decode()) + (run / "work/result.json").write_text('{"ok":true}') + items = collector.collect() + self.assertEqual({i["name"] for i in items}, {"current.log", "result.json"}) + self.assertEqual(old.read_text(), '{"old":true}') + self.assertTrue(log.exists()) + log.write_text("overwritten later") + archived = next(i for i in items if i["name"] == "current.log") + self.assertIn("新日志", (run / "artifacts" / archived["id"]).read_text(encoding="utf-8")) + + def test_model_proxy_budget_and_auth_are_per_run_without_retry(self): + requests = [] + class Upstream(BaseHTTPRequestHandler): + def log_message(self, *args): + pass + def do_GET(self): + requests.append((self.path, self.headers.get("Authorization"))) + self.send_response(200) + self.end_headers() + self.wfile.write(b'{"data":[]}') + def do_POST(self): + self.rfile.read(int(self.headers["Content-Length"])) + requests.append((self.path, self.headers.get("Authorization"))) + self.send_response(503) + self.end_headers() + upstream = HTTPServer(("127.0.0.1", 0), Upstream) + relay = BudgetRelay(("127.0.0.1", 0), f"http://127.0.0.1:{upstream.server_port}", "test-only-credential") + threads = [threading.Thread(target=s.serve_forever, daemon=True) for s in (upstream, relay)] + for t in threads: + t.start() + url = f"http://127.0.0.1:{relay.server_port}" + try: + with urllib.request.urlopen(url + "/v1/models", timeout=5) as response: + self.assertEqual(response.status, 200) + with self.assertRaises(urllib.error.HTTPError) as rejected: + urllib.request.urlopen(url + "/v1/models", timeout=5) + self.assertEqual(rejected.exception.code, 403) + data = json.dumps({"model": "deepseek-v4.1-flash", "max_tokens": 512}).encode() + for i in range(4): + with self.assertRaises(urllib.error.HTTPError) as rejected: + urllib.request.urlopen(url + "/v1/chat/completions", data, timeout=5) + self.assertEqual(rejected.exception.code, 503 if i < 3 else 403) + self.assertEqual(len(requests), 4) + self.assertTrue(all(auth == "Bearer test-only-credential" for _, auth in requests)) + self.assertNotIn("test-only-credential", json.dumps(relay.records)) + finally: + for server in (relay, upstream): + server.shutdown() + server.server_close() + for thread in threads: + thread.join() diff --git a/tests/test_console_worker.py b/tests/test_console_worker.py new file mode 100644 index 0000000..bdf52dd --- /dev/null +++ b/tests/test_console_worker.py @@ -0,0 +1,48 @@ +import json +from pathlib import Path +import subprocess +import sys +import tempfile +import unittest +from unittest.mock import patch +from console.catalog import upload +from console.settings import Settings +from console.store import Store + + +@unittest.skipUnless(sys.platform == "linux", "worker dispatcher runs on Linux") +class WorkerFinalizationTests(unittest.TestCase): + def test_unmount_failure_changes_both_record_and_archived_summary(self): + from console.worker import Worker + with tempfile.TemporaryDirectory() as temp: + settings = Settings(Path(temp), []) + store = Store(settings) + script = upload(store, b"print('test')\n", "test.py") + run = store.queue(script, "test-request", "127.0.0.1") + store.claim() + worker = Worker(settings, {}) + directory = settings.runs / run["id"] + real_popen = subprocess.Popen + def command(value, target): + (target / "work").mkdir() + (target / "work/result.txt").write_text("test output") + return ["create"], {} + def fake_docker(*args, **kwargs): + if args[0] == "inspect": + return json.dumps([{"Config": {"Labels": {"xas.console": "dedicated"}}, + "State": {"ExitCode": 0, "Running": False}}]) + return "owned-test-container" + def process(*args, **kwargs): + return real_popen([sys.executable, "-c", "import sys;sys.stdin.readline();print('output')"], **kwargs) + with patch.object(worker, "command", command), patch("console.worker.docker", fake_docker), \ + patch("console.worker.subprocess.Popen", process), \ + patch("console.worker.workspace.mounts", return_value=[directory / "work"]), \ + patch("console.worker.workspace.remove", side_effect=OSError("simulated unmount failure")): + worker.execute(run) + result = store.run(run["id"]) + self.assertEqual(result["state"], "interrupted") + summary = next(a for a in result["artifacts"] if a["name"] == "summary.json") + archived = json.loads((directory / "artifacts" / summary["id"]).read_text()) + self.assertEqual(archived["state"], result["state"]) + self.assertEqual(archived["message"], result["message"]) + self.assertTrue(worker.stopping) diff --git a/tests/test_deployment.py b/tests/test_deployment.py new file mode 100644 index 0000000..29a7f60 --- /dev/null +++ b/tests/test_deployment.py @@ -0,0 +1,82 @@ +import importlib.util +from pathlib import Path +import tempfile +import unittest +from unittest import mock +import contextlib +import io +import json +import sys +from types import SimpleNamespace + +MODULE = Path(__file__).resolve().parents[1] / "deploy/start.py" +spec = importlib.util.spec_from_file_location("start_console", MODULE) +start = importlib.util.module_from_spec(spec) +spec.loader.exec_module(start) + + +class DeploymentPathsTests(unittest.TestCase): + def setUp(self): + self.temp = tempfile.TemporaryDirectory() + self.addCleanup(self.temp.cleanup) + self.base = Path(self.temp.name) + self.project = self.base / "project" + self.project.mkdir() + self.outside = self.base / "other-owner" + self.outside.mkdir() + + def validator(self): + self.assertTrue(hasattr(start, "validate_runtime"), "runtime boundary validation is missing") + return start.validate_runtime + + def link(self, target, destination): + try: + destination.symlink_to(target, target_is_directory=True) + except OSError: + self.skipTest("OS account cannot create a directory symlink") + + def test_runtime_parent_link_cannot_escape_project(self): + validate = self.validator() + self.link(self.outside, self.project / "runtime") + before = self.outside.stat().st_mode + with self.assertRaises(ValueError): + validate(self.project) + self.assertEqual(self.outside.stat().st_mode, before) + self.assertEqual(list(self.outside.iterdir()), []) + + def test_runtime_child_link_cannot_escape_project(self): + validate = self.validator() + (self.project / "runtime").mkdir() + self.link(self.outside, self.project / "runtime/data") + with self.assertRaises(ValueError): + validate(self.project) + self.assertEqual(list(self.outside.iterdir()), []) + + def test_normal_runtime_is_resolved_without_writing(self): + validate = self.validator() + self.assertEqual(validate(self.project), self.project.resolve() / "runtime") + self.assertEqual(list(self.project.iterdir()), []) + + def test_backend_is_only_on_proxy_loopback_namespace(self): + # Regress the reviewed direct-container-IP role-header bypass at the Docker boundary. + deploy = self.project / 'deploy' + deploy.mkdir() + (deploy/'lan-settings.json').write_text(json.dumps({ + 'address':'10.88.118.188','allowed_cidrs':['10.88.0.0/17','10.20.0.0/21'],'port':14440})) + calls = [] + def docker(args, **kwargs): + calls.append(args) + absent = args[:3] in (['docker','container','inspect'], ['docker','network','inspect']) + return SimpleNamespace(returncode=1 if absent else 0, stdout='') + with mock.patch.object(sys, 'argv', ['start.py','--project-root',str(self.project)]), \ + mock.patch.object(sys, 'path', [str(MODULE.parent)] + sys.path), \ + mock.patch.object(start.subprocess, 'run', side_effect=docker), \ + mock.patch.object(start.os, 'chown', create=True), \ + mock.patch.object(start.socket, 'socket'), contextlib.redirect_stdout(io.StringIO()): + start.main() + backend = next(c for c in calls if '--name' in c and c[c.index('--name')+1]=='adamwen-test-console') + proxy = next(c for c in calls if '--name' in c and c[c.index('--name')+1]=='adamwen-test-console-proxy') + self.assertIn('RUNDECK_SERVER_ADDRESS=127.0.0.1', backend) + self.assertEqual(backend[backend.index('--network')+1], 'container:adamwen-test-console-proxy') + self.assertNotIn('--publish', backend) + self.assertLess(calls.index(proxy), calls.index(backend)) diff --git a/tests/test_lan_config.py b/tests/test_lan_config.py new file mode 100644 index 0000000..f5eedad --- /dev/null +++ b/tests/test_lan_config.py @@ -0,0 +1,36 @@ +import importlib.util +from pathlib import Path +import unittest + +MODULE = Path(__file__).resolve().parents[1] / 'deploy/lan_config.py' + + +class LanConfigurationTests(unittest.TestCase): + def validator(self): + self.assertTrue(MODULE.is_file(), 'LAN boundary configuration is not implemented') + spec = importlib.util.spec_from_file_location('lan_config', MODULE) + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + return module.validate_settings + + def test_explicit_private_interface_and_matching_subnet_are_accepted(self): + result = self.validator()({'address':'10.88.118.188','allowed_cidrs':['10.88.0.0/17','10.20.0.0/21'],'port':14440}) + self.assertEqual(result['address'], '10.88.118.188') + self.assertEqual(result['allowed_cidrs'], ['10.88.0.0/17','10.20.0.0/21']) + + def test_wildcard_public_loopback_and_nonmatching_network_are_rejected(self): + validate = self.validator() + for address, cidr in [('0.0.0.0','0.0.0.0/0'), ('8.8.8.8','8.8.8.0/24'), + ('127.0.0.1','127.0.0.0/8'), ('10.88.118.188','10.89.0.0/17'), + ('10.88.118.188','0.0.0.0/0'), ('10.88.118.188; admin','10.88.0.0/17')]: + with self.subTest(address=address,cidr=cidr), self.assertRaises(ValueError): + validate({'address':address,'allowed_cidrs':[cidr],'port':14440}) + + def test_invalid_port_and_extra_fields_are_rejected(self): + validate = self.validator() + base = {'address':'10.88.118.188','allowed_cidrs':['10.88.0.0/17','10.20.0.0/21'],'port':14440} + for port in (0, 80, 65536, True, '14440'): + with self.subTest(port=port), self.assertRaises(ValueError): + validate(dict(base, port=port)) + with self.assertRaises(ValueError): + validate(dict(base, public=True)) diff --git a/tests/test_native_lifecycle.py b/tests/test_native_lifecycle.py new file mode 100644 index 0000000..0236b57 --- /dev/null +++ b/tests/test_native_lifecycle.py @@ -0,0 +1,89 @@ +import json +from pathlib import Path +from types import SimpleNamespace +import tempfile +import os +import unittest +from unittest.mock import patch +from console.native_executor import inspect, NativeExecutor +from console.native_io import SecretFilter +from console.artifacts import Collector +from console.settings import Settings +from console.store import Store + + +class LifecycleTests(unittest.TestCase): + def test_many_old_outputs_do_not_hide_new_native_log(self): + with tempfile.TemporaryDirectory() as temp: + root=Path(temp);logs=root/'logs';run=root/'run' + logs.mkdir();run.mkdir();(run/'work').mkdir() + for number in range(300):(logs/f'{number:04}.log').write_text('old history') + collector=Collector(Settings(root,[]),run,lambda:sorted(logs.iterdir()),file_limit=4096) + (logs/'new.log').write_text('current progress') + chunks=[];collector.finish_follow(chunks.append) + self.assertIn(b'current progress',b''.join(chunks)) + self.assertNotIn(b'old history',b''.join(chunks)) + self.assertEqual([a['name'] for a in collector.collect()],['new.log']) + + @unittest.skipIf(os.name == "nt", "Linux controlling terminal") + def test_menu_has_controlling_terminal(self): + import pty + import subprocess + import sys + from console.native_job import acquire_terminal + master, slave = pty.openpty() + try: + result = subprocess.run([sys.executable, "-c", "import os; t=os.open('/dev/tty',os.O_RDWR); os.close(t)"], + stdin=slave, stdout=slave, stderr=slave, start_new_session=True, preexec_fn=acquire_terminal, timeout=5) + self.assertEqual(result.returncode, 0) + finally: + os.close(master);os.close(slave) + + def test_systemd_probe_error_is_not_missing_unit(self): + result = SimpleNamespace(returncode=1, stdout="", stderr="D-Bus unavailable") + with patch("console.native_executor.subprocess.run", return_value=result): + with self.assertRaises(OSError):inspect("a" * 32) + result.stdout = "LoadState=not-found\n" + with patch("console.native_executor.subprocess.run", return_value=result): + self.assertIsNone(inspect("a" * 32)) + + def test_file_log_secret_split_at_chunk_boundary_is_filtered(self): + with tempfile.TemporaryDirectory() as temp: + root = Path(temp) + logs, run = root / "logs", root / "run" + logs.mkdir();run.mkdir();(run / "work").mkdir() + secret = "dummy-fixture-credential-123456" + collector = Collector(Settings(root, []), run, [logs], stream_filter_factory=lambda: SecretFilter([secret])) + (logs / "x.log").write_bytes(b"x" * 32760 + secret.encode() + b"\n") + chunks=[];collector.finish_follow(chunks.append) + result=b"".join(chunks) + self.assertNotIn(secret.encode(),result) + self.assertIn(b"[REDACTED]",result) + + def test_terminal_state_waits_for_confirmed_cleanup(self): + with tempfile.TemporaryDirectory() as temp: + settings=Settings(Path(temp),[]);store=Store(settings) + script={"id":"b"*32,"name":"fixture","version":1,"sha256":"x","config":{},"source_path":"fixture.py", + "kind":"external","source_group":"fixture","language":"python"} + run=store.queue(script,"fixture-request","127.0.0.1",execution={"mode":"native"}) + store.claim() + directory=settings.runs/run['id'];directory.mkdir() + (directory/'native-result.json').write_text(json.dumps({'exit_code':0,'artifacts':[]})) + executor=NativeExecutor(SimpleNamespace(settings=settings,store=store,stopping=False)) + with patch.object(executor,'wait_stopped',return_value=False): + executor.finish(run,{'Result':'success'}) + self.assertEqual(store.run(run['id'])['state'],'running') + self.assertIsNone(store.claim()) + + def test_cancelled_before_dispatch_does_not_create_unit(self): + with tempfile.TemporaryDirectory() as temp: + settings=Settings(Path(temp),[]);store=Store(settings) + script={"id":"b"*32,"name":"fixture","version":1,"sha256":"x","config":{},"source_path":"fixture.py", + "kind":"external","source_group":"fixture","language":"python"} + run=store.queue(script,"fixture-request","127.0.0.1",execution={"mode":"native"}) + store.claim();store.cancel(run['id']) + executor=NativeExecutor(SimpleNamespace(settings=settings,store=store,stopping=False)) + with patch('console.native_executor.subprocess.run') as launch: + executor.execute(run) + launch.assert_not_called() + self.assertEqual(store.run(run['id'])['state'],'cancelled') diff --git a/tests/test_native_plans.py b/tests/test_native_plans.py new file mode 100644 index 0000000..df7e74b --- /dev/null +++ b/tests/test_native_plans.py @@ -0,0 +1,89 @@ +import hashlib +import json +from pathlib import Path +import sys +import tempfile +import unittest +from console.settings import Settings +from console.native_plans import build_plan, profile_for, validate_options, public_execution +from console.native_io import SecretFilter + + +class NativePlanTests(unittest.TestCase): + def setUp(self): + self.temp = tempfile.TemporaryDirectory() + self.root = Path(self.temp.name) + source = self.root / "original" + source.mkdir() + (source / "logs").mkdir() + self.entry = source / "test.py" + self.entry.write_text("print('original')\n") + self.settings = Settings(self.root / "runtime", [{"id": "original", "path": str(source)}]) + self.profile = {"id": "test", "source_group": "original", "entry": "test.py", "cwd": str(source), + "interpreter": sys.executable, "user": "root", "arguments": ["{concurrency}", "{output_file}"], + "parameters": [{"key": "concurrency", "label": "并发", "type": "integer", "default": 2, "min": 1, "max": 8}, + {"key": "configuration", "type": "select", "default": "known", "options": [{"value": "known", "label": "已登记配置"}]}], + "impact": {"level": "service", "title": "切换服务", "details": ["可能停止旧服务"], "requires_confirmation": True}, + "environment": {}, "credential_files": [], "interactive": False, "output_paths": [str(source / "logs" / "console-{run_id}*")]} + self.settings.native_catalog = {"profiles": [self.profile], "targets": []} + self.script = {"id": "a" * 32, "kind": "external", "source_group": "original", "source_path": str(self.entry), + "sha256": hashlib.sha256(self.entry.read_bytes()).hexdigest(), "config": {"native_options": {}, "timeout_seconds": 300}, "language": "python"} + + def tearDown(self): + self.temp.cleanup() + + def test_plan_uses_original_file_and_typed_argv_without_shell_join(self): + before = self.entry.read_bytes() + plan = build_plan(self.settings, self.script, run_id="b" * 32, check_host=False) + self.assertEqual(plan["argv"][:2], [sys.executable, str(self.entry)]) + self.assertEqual(plan["argv"][2], "2") + self.assertIn("console-" + "b" * 32, plan["argv"][3]) + self.assertEqual(plan["cwd"], str(self.entry.parent)) + self.assertEqual(self.entry.read_bytes(), before) + + def test_unregistered_uploaded_and_replaced_entries_cannot_run_natively(self): + for change in ({"kind": "managed"}, {"source_path": str(self.root / "unknown.py")}, {"source_group": "other"}): + self.assertIsNone(profile_for(self.settings, {**self.script, **change})) + + def test_parameters_reject_injection_unknown_keys_bool_and_out_of_range(self): + for value in ({"configuration": "../../etc/profile"}, {"configuration": "known;id"}, + {"concurrency": True}, {"concurrency": 9}, {"command": "id"}): + with self.assertRaises(ValueError): + validate_options(self.profile, value) + + def test_confirmation_changes_with_options_source_or_recipe(self): + first = build_plan(self.settings, self.script, check_host=False)["plan_token"] + self.script["config"]["native_options"] = {"concurrency": 3} + second = build_plan(self.settings, self.script, check_host=False)["plan_token"] + self.assertNotEqual(first, second) + self.profile["impact"]["details"].append("使用全部 GPU") + self.assertNotEqual(second, build_plan(self.settings, self.script, check_host=False)["plan_token"]) + self.entry.write_text("print('changed')\n") + with self.assertRaises(ValueError): + build_plan(self.settings, self.script, check_host=False) + + def test_credentials_not_in_public_execution(self): + self.profile["credential_files"] = [str(self.root / "private.env")] + visible = public_execution(self.settings, self.script) + self.assertEqual(visible["mode"], "native") + self.assertNotIn("credential_files", visible) + self.assertNotIn("private.env", json.dumps(visible)) + + def test_stream_filter_redacts_secret_split_across_reads(self): + secret = "dummy-credential-abcdefghijk" + filt = SecretFilter([secret]) + output = filt.feed(b"hello\nkey=dummy-cred") + output += filt.feed(b"ential-abcdefghijk\nworld\n") + output += filt.finish() + self.assertNotIn(secret, output.decode()) + self.assertIn("[REDACTED]", output.decode()) + self.assertIn("world", output.decode()) + + def test_ansi_split_inside_secret_cannot_reconstruct_plaintext(self): + secret = "dummy-credential-abcdefghijk" + filt = SecretFilter([secret]) + result = filt.feed(b"dummy-cred\x1b[") + result += filt.feed(b"31mential-abcdefghijk\x1b[0m\n") + result += filt.finish() + self.assertNotIn(secret.encode(), result) + self.assertIn(b"[REDACTED]", result) diff --git a/tests/test_native_rpc.py b/tests/test_native_rpc.py new file mode 100644 index 0000000..5f507de --- /dev/null +++ b/tests/test_native_rpc.py @@ -0,0 +1,68 @@ +import hashlib +from pathlib import Path +import tempfile +import unittest +from unittest.mock import patch +from console.settings import Settings +from console.store import Store +from console.native_plans import build_plan +from console.native_rpc import handle + + +class NativeRPCTests(unittest.TestCase): + def setUp(self): + self.temp = tempfile.TemporaryDirectory() + root = Path(self.temp.name) + source = root / "source" + source.mkdir() + entry = source / "test.py" + entry.write_text("print(1)\n") + self.settings = Settings(root / "runtime", [{"id": "original", "path": str(source)}]) + self.settings.test_definitions = [{"key": "native", "source_group": "original", "entry": "test.py", "name": "原环境样例"}] + self.settings.native_catalog = {"targets": [], "profiles": [{"id": "native", "source_group": "original", "entry": "test.py", + "cwd": str(source), "user": "root", "interpreter": "/usr/bin/python3", "parameters": [], "arguments": [], + "impact": {"level": "service", "title": "服务切换", "details": ["会停止指定服务"], "requires_confirmation": True}}]} + self.script = {"id": "a" * 32, "name": "test.py", "description": "", "kind": "external", "source_group": "original", + "source_path": str(entry), "sha256": hashlib.sha256(entry.read_bytes()).hexdigest(), "language": "python", "version": 1, + "enabled": True, "status": "ready", "config": {"native_options": {}, "timeout_seconds": 300}} + self.store = Store(self.settings) + self.store.save_script(self.script) + self.plan = build_plan(self.settings, self.script, check_host=False) + self.request = {"op": "queue", "script_id": self.script["id"], "request_id": "5b0202b7-851d-48ad-a7b9-dce22f000001", + "plan_token": self.plan["plan_token"], "source_ip": "127.0.0.1"} + + def tearDown(self): + self.temp.cleanup() + + def test_server_requires_explicit_current_confirmation(self): + with patch("console.native_rpc.native_plans.build_plan", return_value=self.plan): + with self.assertRaises(ValueError):handle(self.settings, self.store, self.request) + with self.assertRaises(ValueError):handle(self.settings, self.store, {**self.request, "impact_acknowledged": True, "plan_token": "old"}) + self.assertEqual(self.store.runs(), []) + run = handle(self.settings, self.store, {**self.request, "impact_acknowledged": True}) + self.assertTrue(run["execution"]["impact_acknowledged"]) + self.assertEqual(run["execution"]["mode"], "native") + + def test_retry_returns_original_even_if_plan_later_changed(self): + with patch("console.native_rpc.native_plans.build_plan", return_value=self.plan): + first = handle(self.settings, self.store, {**self.request, "impact_acknowledged": True}) + with patch("console.native_rpc.native_plans.build_plan", side_effect=ValueError("changed")): + again = handle(self.settings, self.store, self.request) + self.assertEqual(first["id"], again["id"]) + self.assertEqual(len(self.store.runs()), 1) + + def test_failed_preflight_and_unknown_operation_never_queue(self): + with patch("console.native_rpc.native_plans.build_plan", return_value={**self.plan, "ready": False}): + with self.assertRaises(ValueError):handle(self.settings, self.store, {**self.request, "impact_acknowledged": True}) + with self.assertRaises(ValueError):handle(self.settings, self.store, {"op": "exec", "command": "id"}) + self.assertEqual(self.store.runs(), []) + + def test_input_rejected_for_queued_or_noninteractive_run(self): + run = self.store.queue(self.script, "sample", "127.0.0.1", execution={"mode": "native", "interactive": True}) + with self.assertRaises(ValueError):handle(self.settings, self.store, {"op": "input", "run_id": run["id"], "text": "1"}) + with self.assertRaises(ValueError):handle(self.settings, self.store, {"op": "input", "run_id": "../../bad", "text": "1"}) + + def test_input_channel_rejects_tmux_keys_and_shell_commands(self): + for text in ("\x02c", "\x1b", "bash", "1\nid", "echo test", ":new-window"): + with self.assertRaisesRegex(ValueError, "控制键"): + handle(self.settings, self.store, {"op": "input", "run_id": "a"*32, "text": text}) diff --git a/tests/test_runner.py b/tests/test_runner.py new file mode 100644 index 0000000..a896556 --- /dev/null +++ b/tests/test_runner.py @@ -0,0 +1,102 @@ +"""Behavioral acceptance; Linux process tests also run on the target host.""" +import json +import os +from pathlib import Path +import signal +import subprocess +import sys +import tempfile +import time +import unittest + +ROOT = Path(__file__).resolve().parents[1] +RUNNER = ROOT / "scripts" / "run_smoke.py" + + +class RunnerTests(unittest.TestCase): + def setUp(self): + self.temp = tempfile.TemporaryDirectory() + self.addCleanup(self.temp.cleanup) + self.results = Path(self.temp.name) + + def command(self, mode="success", run_id="test-1", timeout="3"): + self.assertTrue(RUNNER.is_file(), "run_smoke.py is not implemented") + return [sys.executable, "-u", str(RUNNER), "--mode", mode, + "--run-id", run_id, "--timeout", timeout, + "--results-root", str(self.results)] + + def run_task(self, **kwargs): + return subprocess.run(self.command(**kwargs), capture_output=True, + text=True, timeout=12) + + def summary(self, run_id="test-1"): + return json.loads((self.results / run_id / "summary.json").read_text()) + + def test_success_streams_progress_and_records_synthetic_result(self): + result = self.run_task() + self.assertEqual(result.returncode, 0, result.stdout + result.stderr) + summary = self.summary() + self.assertEqual(summary["status"], "succeeded") + self.assertEqual(summary["run_id"], "test-1") + self.assertTrue(summary["synthetic"]) + self.assertEqual(summary["result"]["checks_passed"], 3) + self.assertIn("progress=1/3", result.stdout) + self.assertIn("progress=3/3", result.stdout) + self.assertEqual(len(summary["source_sha256"]["smoke_task.py"]), 64) + + def test_nonzero_exit_is_recorded_as_failure(self): + result = self.run_task(mode="failure") + self.assertNotEqual(result.returncode, 0) + self.assertEqual(self.summary()["status"], "failed") + self.assertEqual(self.summary()["exit_code"], 23) + + def test_zero_exit_with_invalid_report_is_failure(self): + result = self.run_task(mode="invalid-report") + self.assertNotEqual(result.returncode, 0) + self.assertEqual(self.summary()["status"], "invalid_result") + + def test_reused_run_id_preserves_previous_result(self): + self.assertEqual(self.run_task().returncode, 0) + before = (self.results / "test-1" / "summary.json").read_bytes() + self.assertNotEqual(self.run_task(mode="failure").returncode, 0) + self.assertEqual((self.results / "test-1" / "summary.json").read_bytes(), before) + + def test_invalid_inputs_do_not_create_run_directory(self): + for kwargs in ({"run_id": "../escape"}, {"mode": "arbitrary"}, + {"timeout": "0"}, {"timeout": "31"}, {"timeout": "nan"}): + with self.subTest(kwargs=kwargs): + self.assertNotEqual(self.run_task(**kwargs).returncode, 0) + self.assertEqual(list(self.results.iterdir()), []) + + @unittest.skipUnless(sys.platform == "linux", "requires Linux process groups") + def test_timeout_terminates_child_and_records_timeout(self): + result = self.run_task(mode="wait", timeout="2") + self.assertEqual(result.returncode, 124, result.stdout + result.stderr) + summary = self.summary() + self.assertEqual(summary["status"], "timed_out") + self.assertFalse(Path(f'/proc/{summary["child_pid"]}').exists()) + + @unittest.skipUnless(sys.platform == "linux", "requires Linux process groups") + def test_cancel_terminates_parent_and_child(self): + proc = subprocess.Popen(self.command(mode="wait", timeout="15"), + stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True) + try: + deadline = time.monotonic() + 4 + child_file = self.results / "test-1" / "child.pid" + while not child_file.exists() and time.monotonic() < deadline: + time.sleep(.05) + self.assertTrue(child_file.exists(), "worker did not start") + child_pid = int(child_file.read_text()) + os.kill(proc.pid, signal.SIGTERM) + out, err = proc.communicate(timeout=4) + self.assertEqual(proc.returncode, 130, out + err) + self.assertEqual(self.summary()["status"], "cancelled") + self.assertFalse(Path(f"/proc/{child_pid}").exists()) + finally: + if proc.poll() is None: + proc.kill() + proc.communicate() + + +if __name__ == "__main__": + unittest.main() diff --git a/tests/test_test_catalog.py b/tests/test_test_catalog.py new file mode 100644 index 0000000..4dcf940 --- /dev/null +++ b/tests/test_test_catalog.py @@ -0,0 +1,103 @@ +"""A test entry represents behavior, not every source file under a directory.""" +from pathlib import Path +import tempfile +import unittest +from fastapi.testclient import TestClient +from console.app import create_app +from console.settings import Settings +from console.store import Store + + +class TestCatalogTests(unittest.TestCase): + def setUp(self): + self.temp = tempfile.TemporaryDirectory() + root = Path(self.temp.name) + self.source = root / "scripts" + self.source.mkdir() + (self.source / "run-suite.sh").write_text("python3 helper.py\n") + (self.source / "helper.py").write_text("print('helper')\n") + (self.source / "tests").mkdir() + (self.source / "tests/test_internal.py").write_text("assert True\n") + self.settings = Settings(root / "runtime", [{"id": "suite", "path": str(self.source)}], + allowed_hosts=["testserver"], allowed_networks=["127.0.0.0/8"]) + self.settings.test_definitions = [{"key": "suite", "source_group": "suite", "entry": "run-suite.sh", + "name": "模型综合测试", "description": "一轮完整验证", "kind": "suite", + "members": [{"source_group": "suite", "pattern": "**/*"}]}] + self.client = TestClient(create_app(self.settings), client=("127.0.0.1", 5555)) + self.headers = {"X-XAS-Console": "1"} + self.client.post("/api/discover", headers=self.headers) + self.store = Store(self.settings) + + def tearDown(self): + self.client.close() + self.temp.cleanup() + + def test_suite_is_one_item_with_readonly_members_not_three_cards(self): + items = self.client.get("/api/scripts").json()["items"] + self.assertEqual(len(items), 1) + self.assertEqual(items[0]["name"], "模型综合测试") + self.assertEqual(items[0]["test_kind"], "suite") + self.assertEqual(items[0]["file_count"], 3) + files = self.client.get(f"/api/scripts/{items[0]['id']}/files").json()["items"] + self.assertEqual(len(files), 3) + self.assertEqual(sum(f["role"] == "entry" for f in files), 1) + summary = self.client.get("/api/summary").json() + self.assertEqual(summary["scripts"], 1) + self.assertEqual(summary["source_files"], 3) + + def test_refresh_does_not_promote_new_support_file_or_clear_configuration(self): + entry = next(s for s in self.store.scripts() if s["source_path"].endswith("run-suite.sh")) + self.client.patch(f"/api/scripts/{entry['id']}", json={"name": "我的综合测试"}, headers=self.headers) + (self.source / "new_module.py").write_text("pass\n") + self.client.post("/api/discover", headers=self.headers) + items = self.client.get("/api/scripts").json()["items"] + self.assertEqual(len(items), 1) + self.assertEqual(items[0]["name"], "我的综合测试") + self.assertEqual(items[0]["file_count"], 4) + + def test_member_cannot_be_enabled_or_run_by_direct_api(self): + helper = next(s for s in self.store.scripts() if s["source_path"].endswith("helper.py")) + self.assertFalse(self.client.get(f"/api/scripts/{helper['id']}").json()["is_test"]) + enabled = self.client.patch(f"/api/scripts/{helper['id']}", json={"enabled": True}, headers=self.headers) + self.assertEqual(enabled.status_code, 400) + # Even a pre-existing enabled inventory record cannot bypass the entry boundary. + helper.update(enabled=True, status="ready") + self.store.save_script(helper) + run = self.client.post(f"/api/scripts/{helper['id']}/runs", + json={"request_id": "caa3943d-6872-472c-86c2-500000000001"}, headers=self.headers) + self.assertEqual(run.status_code, 400) + self.assertEqual(self.store.runs(), []) + + def test_upload_remains_one_test_and_examples_are_opt_in(self): + uploaded = self.client.post("/api/scripts/upload", headers=self.headers, + files={"file": ("test.py", b"print('custom')\n")}, data={"name": "用户测试"}).json() + example = self.client.post("/api/scripts/upload", headers=self.headers, + files={"file": ("demo.py", b"print('demo')\n")}, data={"name": "演示"}).json() + item = self.store.script(example["id"]) + item["synthetic"] = True + self.store.save_script(item) + regular = self.client.get("/api/scripts").json()["items"] + self.assertEqual({s["name"] for s in regular}, {"模型综合测试", "用户测试"}) + all_items = self.client.get("/api/scripts?include_examples=true").json()["items"] + self.assertEqual(len(all_items), 3) + self.assertTrue(next(s for s in all_items if s["id"] == uploaded["id"])["is_test"]) + + def test_historical_runs_keep_ids_and_source_contents_unchanged(self): + entry = next(s for s in self.store.scripts() if s["source_path"].endswith("run-suite.sh")) + historical = self.store.queue(entry, "past-request", "127.0.0.1") + before = (self.source / "run-suite.sh").read_bytes() + self.client.get("/api/scripts") + self.client.post("/api/discover", headers=self.headers) + self.assertEqual(self.store.run(historical["id"])["script_name"], "run-suite.sh") + self.assertEqual(self.store.run(historical["id"])["script_id"], entry["id"]) + self.assertEqual(before, (self.source / "run-suite.sh").read_bytes()) + + def test_new_run_uses_one_entry_and_the_test_name(self): + entry = self.client.get("/api/scripts").json()["items"][0] + response = self.client.patch(f"/api/scripts/{entry['id']}", json={"enabled": True}, headers=self.headers) + self.assertEqual(response.status_code, 200) + run = self.client.post(f"/api/scripts/{entry['id']}/runs", headers=self.headers, + json={"request_id": "caa3943d-6872-472c-86c2-500000000002"}).json() + self.assertEqual(run["script_name"], "模型综合测试") + self.assertEqual(run["source_path"], str(self.source / "run-suite.sh")) + self.assertEqual(len(self.store.runs()), 1)