#!/usr/bin/env bash

============================================================================

FIX7 REAL-N6 provenance packet -- STRICT reproducible rerun from KB.

set -euo pipefail + ERR trap: any nonzero exit / diff / hash mismatch aborts

before the final PASS line. "RERUN_RESULT: PASS" is printed ONLY after every

gate below ran and succeeded in THIS invocation (no pinned log is trusted).

Gates:

0 fresh-reconstruct governed evidence from KB (recheck-9 tree + 10 corpus

docs + governed authority encoder), bidirectional HASH_MANIFEST verify

1 this packet's HASH_MANIFEST cross-tool re-hash (shasum -c)

2 packet_tree.sha256 == sha256(HASH_MANIFEST.txt)

3 canonical command sequence (commands.sh) over the reconstructed tree

4 regenerated certificate == pinned certificate (byte-identical)

SAFE/OFFLINE except gate 0 (READ-ONLY KB fetch). No DB/production mutation.

============================================================================

set -euo pipefail trap 'echo "RERUN_RESULT: FAIL (line $LINENO)"; exit 1' ERR cd "$(dirname "$0")" export PYTHONDONTWRITEBYTECODE=1 rm -rf rerun-recon cmd-out && mkdir -p rerun-recon

echo "### 0. fresh-reconstruct governed evidence from KB" python3 kb_fetch_reconstruct.py rerun-recon

echo "### 1. HASH_MANIFEST cross-tool re-hash (shasum -c)" shasum -a 256 -c HASH_MANIFEST.txt > rerun-recon/hashcheck.log echo "shasum -c: $(wc -l < rerun-recon/hashcheck.log | tr -d ' ') entries OK"

echo "### 2. packet_tree.sha256 == sha256(HASH_MANIFEST.txt)" T=$(shasum -a 256 HASH_MANIFEST.txt | awk '{print $1}') P=$(awk '{print $1}' packet_tree.sha256) [ "$T" = "$P" ] && echo "packet_tree OK ($T)" || { echo "packet_tree MISMATCH $T != $P"; exit 1; }

echo "### 3. canonical command sequence over reconstructed tree" RECON=rerun-recon bash commands.sh

echo "### 4. regenerated certificate == pinned certificate" diff cmd-out/regenerated-cert.json real-n6-provenance-certificate.json echo "certificate byte-identical to pinned"

echo "RERUN_RESULT: PASS (reconstructed from KB; all gates enforced this run)"