#!/usr/bin/env bash

Reconstruct + re-verify the FIX7 P0 rollback-validator hardening packet.

1. re-run the gate runner (regenerates hardening_probe_results.json deterministically)

2. verify per-file hashes against HASH_MANIFEST.txt

3. verify packet_tree.sha256 == sha256(HASH_MANIFEST.txt)

Staging/paper-only. No production mutation.

set -u cd "$(dirname "$0")" echo "== FIX7 P0 ROLLBACK-VALIDATOR HARDENING -- RERUN.sh =="

RC=0

regenerate evidence first so the manifest check reflects a fresh run

bash commands.sh CMD_RC=$? [ "${CMD_RC}" -ne 0 ] && RC=1

if [ -f HASH_MANIFEST.txt ]; then if shasum -a 256 -c HASH_MANIFEST.txt >/tmp/_fix7p0hard_shasum.out 2>&1; then echo "HASH_MANIFEST: all OK" else echo "HASH_MANIFEST: MISMATCH"; cat /tmp/_fix7p0hard_shasum.out; RC=1 fi TREE=$(shasum -a 256 HASH_MANIFEST.txt | awk '{print $1}') PIN=$(awk '{print $1}' packet_tree.sha256) if [ "${TREE}" = "${PIN}" ]; then echo "packet_tree: OK (${TREE})" else echo "packet_tree: MISMATCH (got ${TREE} pin ${PIN})"; RC=1 fi fi

if [ "${RC}" -eq 0 ]; then echo "RERUN_RESULT: PASS" else echo "RERUN_RESULT: FAIL" fi exit ${RC}