# artifact-seal — EVIDENCE

Lane: Codeforge. Artifact: deterministic SHA-256 seal manifests over a file tree.
Stdlib only. Runs on Python 3.14.7. All lines below are captured command output.

Files in this directory:
    artifact_seal.py                engine + CLI
    selftest_artifact_seal.py       44 checks, 3 layers (hand / property / mutant-control)
    verify_artifact_seal_oracle.py  independent oracle (sha256sum, git blob hasher)
    README.md                       design decisions and bug history

## 1. selftest — repo copy, run from /root/troupe-standup

$ python3 wizard-work/null/artifact-seal/selftest_artifact_seal.py
    PASS hand: trailing newline changes the digest
    ...
    PASS cli: verify of a tampered tree exits 1
    PASS cli: a bare positional directory is not used as the verify target
    PASS cli: missing manifest is a clean nonzero exit
    PASS cli: unknown command exits 2
    PASS cli: no arguments exits 2

    44/44 checks passed
exit=0

## 2. oracle cross-check (sha256sum + git's blob hasher)

$ python3 wizard-work/null/artifact-seal/verify_artifact_seal_oracle.py
    PASS oracle: 40 repo digests agree with sha256sum (0 disagree)
    PASS oracle: two identical files written separately share a digest
    PASS oracle: git's independent blob hash agrees the bytes are identical
    PASS oracle: seal_dir is deterministic
    PASS oracle: sealed diffkit verifies (8 files)
    PASS oracle: a one-byte tamper in diffkit.py is caught
    PASS oracle: the tree verifies again after restoring the original bytes
    PASS oracle: seal is independent of the caller's CWD

    all oracle cross-checks agree
exit=0

## 3. determinism: same tree sealed from two different CWDs

$ (cd /root   && artifact_seal.py seal .../diffkit --out /tmp/s1.json)
  sealed 8 file(s) -> /tmp/s1.json  [3ad785569c2a9863...]
$ (cd /tmp    && artifact_seal.py seal .../diffkit --out /tmp/s2.json)
  sealed 8 file(s) -> /tmp/s2.json  [3ad785569c2a9863...]
$ cmp /tmp/s1.json /tmp/s2.json
  (no output)
exit=0

## 4. seal -> verify on the real diffkit tree

$ artifact_seal.py verify --manifest /tmp/s1.json --target wizard-work/null/diffkit
  OK 8 file(s) verified, seal 3ad785569c2a9863...
exit=0

Summary: selftest 44/44 PASS (0 FAIL); oracle all agree; CWD-determinism cmp exit 0;
live verify exit 0.
