#!/usr/bin/env bash

FIX7 P0 - shaped-clone + CI-gate packet :: run all local/static harnesses fresh.

No clone, no production, no CI trigger, no secrets. Pure local verification.

set -u cd "$(dirname "$0")"

echo "== 1/3 hardened validator (selftest; rehearsal leg N/A - no clone) ==" python3 run_hardened_validator.py RC_VALIDATOR=$?

echo "== 2/3 bad-input probes (10 classes, must all fail closed) ==" python3 bad_input_probes.py RC_PROBES=$?

echo "== 3/3 CI seal-vs-bytes gate selftest (must fail closed on all drift) ==" python3 ci_seal_vs_bytes_gate.py --selftest RC_CIGATE=$?

Deterministic exit-code record.

python3 - "$RC_VALIDATOR" "$RC_PROBES" "$RC_CIGATE" <<'PY' import json, sys rc = [int(x) for x in sys.argv[1:4]] obj = { "doc": "fix7-p0-shaped-clone-ci-gate-exit-codes", "date": "2026-06-12", "run_hardened_validator.py": rc[0], "bad_input_probes.py": rc[1], "ci_seal_vs_bytes_gate.py --selftest": rc[2], "all_zero": all(c == 0 for c in rc), } with open("exit_codes.json", "w", encoding="utf-8") as fh: json.dump(obj, fh, indent=2, sort_keys=True, ensure_ascii=True) fh.write("\n") PY

if [ "$RC_VALIDATOR" -eq 0 ] && [ "$RC_PROBES" -eq 0 ] && [ "$RC_CIGATE" -eq 0 ]; then echo "OVERALL PASS" exit 0 else echo "OVERALL FAIL (validator=$RC_VALIDATOR probes=$RC_PROBES cigate=$RC_CIGATE)" exit 1 fi