#!/usr/bin/env bash

FIX7 P0 Codex Review Evidence Bundle - fresh-from-KB reconstruct + re-verify.

Authority: EVIDENCE_BUNDLE_NON_AUTHORITY. Read-only against KB. Mutates no production.

Prereq: fetch each external HASH_MANIFEST.txt (full bytes) from the Incomex KB into ./_external/:

_external/dryrun_HASH_MANIFEST.txt <- .../fix7-p0-dryrun-and-execution-readiness-packet-2026-06-11/HASH_MANIFEST.txt

_external/planning_HASH_MANIFEST.txt <- .../fix7-p0-implementation-planning-packet-2026-06-11/HASH_MANIFEST.txt

_external/seal_HASH_MANIFEST.txt <- .../codex-fix7-n7-n8-p7-authority-seal-reauthor-with-valid-a5-2026-06-11/HASH_MANIFEST.txt

set -u cd "$(dirname "$0")" || exit 99 rc=0

verify() { # name expected local k="$1" want="$2" f="_external/$1_HASH_MANIFEST.txt" if [ ! -f "$f" ]; then echo "SKIP $k (fetch $f from KB first)"; return; fi local got; got=$(shasum -a 256 "$f" | awk '{print $1}') if [ "$got" = "$want" ]; then echo "PASS $k tree $got"; else echo "FAIL $k tree got=$got want=$want"; rc=1; fi }

echo "== Fresh-from-KB external tree re-verify ==" verify dryrun 02b200e5a3c7a21c2e620b293fbf28ccc81731a983430c3e5a202798c05e94e6 verify planning f470d0d019f9af63794ce943a64ea08ff31a17906a7857f4124d0b1e14a0fe8f verify seal 3890cd3467720b3f2c105625e2e1dc627fd2e7fdfb74d9059bad95bece12a234

echo "== Bundle self-check ==" bash commands.sh || rc=1

if [ "$rc" -eq 0 ]; then echo "RERUN_RESULT: PASS"; else echo "RERUN_RESULT: FAIL"; fi exit $rc