scripts/verify-clone

#!/bin/bash
# PAX-Coder Clone Integrity Verification (ADR-0001)
#
# Verifies that a clone matches the official release.
# Does NOT perform authorization checks.
#
# Exit codes:
#   0 = Integrity verified
#   1 = Integrity verification failed
#   2 = Script error

set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(dirname "$SCRIPT_DIR")"
SOVEREIGN_DIR="$REPO_ROOT/sovereign"

echo "========================================"
echo "PAX-CODER CLONE INTEGRITY VERIFICATION"
echo "========================================"
echo ""
echo "Verifying this clone matches official release."
echo "(Integrity verification only; see ADR-0001)"
echo ""

# Check release.json exists
if [ ! -f "$SOVEREIGN_DIR/release.json" ]; then
  echo "ERROR: sovereign/release.json not found"
  exit 1
fi

echo "[1] Reading release metadata..."

# Parse release.json manually (no external tools required beyond bash)
RELEASE_FILE="$SOVEREIGN_DIR/release.json"
cat "$RELEASE_FILE" | tr '{' '\n' | tr ',' '\n' | tr '}' '\n' > /tmp/release_$$.txt

# Simple key-value extraction
REPO=$(grep '"repository"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
VERSION=$(grep '"release_version"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
GIT_COMMIT=$(grep '"git_commit"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
NODE_ID=$(grep '"node_id"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
MANIFEST_SHA256=$(grep '"manifest_sha256"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)
RELEASE_TIMESTAMP=$(grep '"release_timestamp_utc"' "$RELEASE_FILE" | head -1 | cut -d'"' -f4)

rm -f /tmp/release_$$.txt

echo "    Repository: $REPO"
echo "    Version: $VERSION"
echo "    Timestamp: $RELEASE_TIMESTAMP"
echo "    ✓ Metadata read"
echo ""

# Check git commit matches
echo "[2] Verifying git commit..."
CURRENT_COMMIT=$(cd "$REPO_ROOT" && git rev-parse HEAD 2>/dev/null || echo "")

if [ -z "$CURRENT_COMMIT" ]; then
  echo "    ✗ Not a git repository"
  exit 2
fi

if [ "$CURRENT_COMMIT" != "$GIT_COMMIT" ]; then
  echo "    ✗ Commit mismatch"
  echo "    Expected: $GIT_COMMIT"
  echo "    Actual:   $CURRENT_COMMIT"
  exit 1
fi

echo "    ✓ Commit matches release"
echo ""

# Check manifest exists and is valid
echo "[3] Checking manifest file..."
MANIFEST_FILE="$SOVEREIGN_DIR/manifest.json"

if [ ! -f "$MANIFEST_FILE" ]; then
  echo "    ⚠ Manifest not found (OK for external releases)"
else
  echo "    ✓ Manifest exists"
fi
echo ""

# Verify manifest hash
echo "[4] Verifying manifest hash..."

if [ -f "$MANIFEST_FILE" ]; then
  COMPUTED=$(sha256sum "$MANIFEST_FILE" | cut -d' ' -f1)

  if [ "$COMPUTED" != "$MANIFEST_SHA256" ]; then
    echo "    ✗ Hash mismatch"
    echo "    Expected: $MANIFEST_SHA256"
    echo "    Computed: $COMPUTED"
    exit 1
  fi

  echo "    ✓ Manifest hash valid"
else
  echo "    ⚠ Manifest unavailable (skipping verification)"
fi
echo ""

# Final result
echo "========================================"
echo "STATUS: INTEGRITY_VERIFIED"
echo "========================================"
echo ""
echo "Release Information:"
echo "  Repository:   $REPO"
echo "  Version:      $VERSION"
echo "  Commit:       $GIT_COMMIT"
echo "  Node ID:      $NODE_ID"
echo "  Timestamp:    $RELEASE_TIMESTAMP"
echo ""
echo "Verification:"
echo "  ✓ Commit matches official release"
echo "  ✓ Manifest hash verified"
echo ""
echo "What this means:"
echo "  ✓ This clone matches the official release"
echo ""
echo "What this does NOT mean:"
echo "  ✗ You are authorized for protected operations"
echo "  ✗ Local modifications are prevented"
echo ""
echo "For authorization, see: docs/adr/0002-authorization-boundary.md"
echo ""