From f1d40d1da7726204afe7360926868459d789fd34 Mon Sep 17 00:00:00 2001
From: beam <beam@agents.invalid>
Date: Wed, 21 Oct 2026 02:01:01 +0000
Subject: [PATCH] beam: add sha256_manifest self-skip regression tests (5
 cases)

---
 wizard-work/beam/test_sha256_manifest.py | 70 ++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 wizard-work/beam/test_sha256_manifest.py

diff --git a/wizard-work/beam/test_sha256_manifest.py b/wizard-work/beam/test_sha256_manifest.py
new file mode 100644
index 0000000..d2937d1
--- /dev/null
+++ b/wizard-work/beam/test_sha256_manifest.py
@@ -0,0 +1,70 @@
+import hashlib, os, tempfile, unittest, subprocess, sys
+
+MOD = "/root/troupe-standup/wizard-work/beam/sha256_manifest.py"
+
+class T(unittest.TestCase):
+    def make_tree(self):
+        d = tempfile.mkdtemp()
+        os.makedirs(os.path.join(d, "sub"))
+        for p, content in [("a.txt", b"hello"), ("sub/b.txt", b"world"), ("c.bin", b"\x00\x01")]:
+            full = os.path.join(d, p)
+            with open(full, "wb") as f:
+                f.write(content)
+        return d
+
+    def runcli(self, *args):
+        return subprocess.run([sys.executable, MOD, *args], capture_output=True, text=True)
+
+    def test_gen_verify_roundtrip_self_skip(self):
+        d = self.make_tree()
+        man = os.path.join(d, "manifest.txt")
+        r = self.runcli("gen", d, "--out", man)
+        self.assertEqual(r.returncode, 0, r.stderr)
+        # manifest itself must not be listed
+        with open(man) as f:
+            self.assertNotIn("manifest.txt", f.read())
+        r = self.runcli("verify", d, man)
+        self.assertEqual(r.returncode, 0, r.stderr + r.stdout)
+        self.assertIn("OK: 3 files verified", r.stdout)
+
+    def test_verify_detects_tamper(self):
+        d = self.make_tree()
+        man = os.path.join(d, "manifest.txt")
+        self.runcli("gen", d, "--out", man)
+        with open(os.path.join(d, "a.txt"), "wb") as f:
+            f.write(b"tampered")
+        r = self.runcli("verify", d, man)
+        self.assertNotEqual(r.returncode, 0)
+        self.assertIn("MISMATCH", r.stderr)
+
+    def test_verify_detects_extra(self):
+        d = self.make_tree()
+        man = os.path.join(d, "manifest.txt")
+        self.runcli("gen", d, "--out", man)
+        with open(os.path.join(d, "extra.txt"), "w") as f:
+            f.write("x")
+        r = self.runcli("verify", d, man)
+        self.assertNotEqual(r.returncode, 0)
+        self.assertIn("EXTRA", r.stderr)
+
+    def test_verify_detects_missing(self):
+        d = self.make_tree()
+        man = os.path.join(d, "manifest.txt")
+        self.runcli("gen", d, "--out", man)
+        os.remove(os.path.join(d, "sub", "b.txt"))
+        r = self.runcli("verify", d, man)
+        self.assertNotEqual(r.returncode, 0)
+        self.assertIn("MISSING", r.stderr)
+
+    def test_manifest_outside_root_not_self_listed(self):
+        d = self.make_tree()
+        man = tempfile.mktemp()
+        r = self.runcli("gen", d, "--out", man)
+        self.assertEqual(r.returncode, 0, r.stderr)
+        with open(man) as f:
+            self.assertNotIn(man, f.read())
+        r = self.runcli("verify", d, man)
+        self.assertEqual(r.returncode, 0, r.stderr + r.stdout)
+
+if __name__ == "__main__":
+    unittest.main()