From 683bb83c8309c16f1e1a73937ce76370b4080beb Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 1 Sep 2026 22:34:03 +0100 Subject: [PATCH 1/2] feat(trust): stale-manifest failures print drifted files and exact regen command Debt D7 (docs/sitrep-2026-09-01.adoc): verify-manifest.sh previously discarded sha256sum's output, so a red must-gates run said only which component failed, not which file drifted or how to fix it. Failure output now lists the FAILED entries and prints the exact remediation: ./scripts/trust/generate-manifest.sh (or just trust-generate), plus the reminder to commit the regenerated manifest in the same PR. The missing-manifest branch gets the same hint. Both failure paths verified live: induced a stale README.adoc (vexometer-efficacy) and a removed manifest (satellite-template), confirmed the messages name the right component and file, restored, and confirmed the clean tree passes with exit 0. Co-Authored-By: Claude Fable 5 --- scripts/trust/verify-manifest.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/scripts/trust/verify-manifest.sh b/scripts/trust/verify-manifest.sh index 3223f79..fb6a5ea 100755 --- a/scripts/trust/verify-manifest.sh +++ b/scripts/trust/verify-manifest.sh @@ -25,14 +25,21 @@ for component in "${components[@]}"; do if [[ ! -f "$manifest" ]]; then echo "missing trust manifest: $manifest" >&2 + echo " fix: ./scripts/trust/generate-manifest.sh $component" >&2 + echo " (or regenerate every component: just trust-generate)" >&2 failed=1 continue fi - if (cd "$component_dir" && sha256sum -c .trust/trust-manifest.sha256 >/dev/null); then + if output=$(cd "$component_dir" && sha256sum -c .trust/trust-manifest.sha256 2>&1); then echo "trust manifest verified: $component" else echo "trust manifest verification failed: $component" >&2 + # Show only the drifted/missing entries, not the OK noise. + grep -v ': OK$' <<<"$output" | sed 's/^/ /' >&2 || true + echo " fix: ./scripts/trust/generate-manifest.sh $component" >&2 + echo " (or regenerate every component: just trust-generate)" >&2 + echo " then commit the updated $component/.trust/trust-manifest.sha256 in the SAME PR" >&2 failed=1 fi done From bc48b5a89737c41808f6f08f063879928a2d3823 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 1 Sep 2026 22:51:59 +0100 Subject: [PATCH 2/2] fix(trust): suppress sha256sum WARNING summary, keep unexpected diagnostics Per review: the redundant 'sha256sum: WARNING: N computed checksums did NOT match' summary is filtered alongside the OK lines. Deliberately NOT narrowed to FAILED-only lines: a corrupt manifest emits 'no properly formatted checksum lines found', which a FAILED-only filter would hide. All three failure shapes (stale, missing, corrupt) re-verified live. Co-Authored-By: Claude Fable 5 --- scripts/trust/verify-manifest.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scripts/trust/verify-manifest.sh b/scripts/trust/verify-manifest.sh index fb6a5ea..f21e8d9 100755 --- a/scripts/trust/verify-manifest.sh +++ b/scripts/trust/verify-manifest.sh @@ -35,8 +35,10 @@ for component in "${components[@]}"; do echo "trust manifest verified: $component" else echo "trust manifest verification failed: $component" >&2 - # Show only the drifted/missing entries, not the OK noise. - grep -v ': OK$' <<<"$output" | sed 's/^/ /' >&2 || true + # Show the drifted/missing entries and any unexpected diagnostics + # (e.g. a corrupt manifest), but not the OK noise or sha256sum's + # redundant WARNING summary line. + grep -Ev ': OK$|^sha256sum: WARNING: ' <<<"$output" | sed 's/^/ /' >&2 || true echo " fix: ./scripts/trust/generate-manifest.sh $component" >&2 echo " (or regenerate every component: just trust-generate)" >&2 echo " then commit the updated $component/.trust/trust-manifest.sha256 in the SAME PR" >&2