From dddd4cac55b2bf0932cc3f50018c76c24760eb87 Mon Sep 17 00:00:00 2001
From: beam <beam@agents.invalid>
Date: Tue, 20 Oct 2026 23:58:44 +0000
Subject: [PATCH] beam: sha256_manifest skips manifest itself during verify/gen

---
 wizard-work/beam/sha256_manifest.py | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/wizard-work/beam/sha256_manifest.py b/wizard-work/beam/sha256_manifest.py
index 144b8d5..9202b98 100644
--- a/wizard-work/beam/sha256_manifest.py
+++ b/wizard-work/beam/sha256_manifest.py
@@ -14,19 +14,29 @@ def sha256_file(path):
     return h.hexdigest()
 
 
-def collect(root):
+def collect(root, skip=None):
     out = []
+    skip = set(skip or ())
     for dirpath, _, files in os.walk(root):
         for name in files:
             full = os.path.join(dirpath, name)
             rel = os.path.relpath(full, root)
+            if rel in skip:
+                continue
+            # Never follow the manifest file itself when it lives inside root.
             out.append((rel, sha256_file(full)))
     out.sort(key=lambda x: x[0])
     return out
 
 
 def cmd_gen(root, out_path):
-    rows = collect(root)
+    skip = set()
+    if out_path:
+        try:
+            skip.add(os.path.relpath(os.path.abspath(out_path), os.path.abspath(root)))
+        except ValueError:
+            pass
+    rows = collect(root, skip=skip)
     lines = [f"{digest}  {rel}" for rel, digest in rows]
     text = "\n".join(lines) + ("\n" if lines else "")
     if out_path:
@@ -56,6 +66,12 @@ def parse_manifest(path):
 
 def cmd_verify(root, manifest_path):
     expected = dict(parse_manifest(manifest_path))
+    # The manifest itself, when stored inside root, is not an "extra" file.
+    try:
+        manifest_rel = os.path.relpath(os.path.abspath(manifest_path), os.path.abspath(root))
+    except ValueError:
+        manifest_rel = None
+    skip = {manifest_rel} if manifest_rel and not manifest_rel.startswith("..") else set()
     failures = []
     for rel, digest in expected.items():
         full = os.path.join(root, rel)
@@ -65,7 +81,7 @@ def cmd_verify(root, manifest_path):
         got = sha256_file(full)
         if got != digest:
             failures.append(f"MISMATCH {rel}\n  expected {digest}\n  got      {got}")
-    for rel, _ in collect(root):
+    for rel, _ in collect(root, skip=skip):
         if rel not in expected:
             failures.append(f"EXTRA    {rel}")
     if failures: