use std/assert
def check [root: string, f: record] {
let data = (open --raw ($root | path join $f.path) | into binary)
assert equal ($data | bytes length) $f.bytes
assert equal ($data | hash sha256) $f.sha256
}
def main [--repo: string, --soft3: string, --live] {
assert ($repo != null and $soft3 != null) 'Pass --repo and --soft3 containing the exact Git objects'
let root = $env.FILE_PWD
let files = (open ($root | path join files.json))
for f in $files { check $root $f }
let m = (open ($root | path join manifest.json))
let context = (open --raw ($root | path join context.txt) | into binary)
assert equal ($context | bytes length) $m.context_bytes
assert equal ($context | hash sha256) $m.context_sha256
let temp = (^mktemp /tmp/radio-audit-plan-replay.XXXXXX | str trim)
mut rebuilt = ''
mut git_count = 0
mut index_count = 0
mut excerpt_count = 0
mut retained_count = 0
for s in $m.sections {
let end = ($s.offset + $s.bytes - 1)
let body = if $s.bytes == 0 { '' } else { $context | bytes at $s.offset..$end | decode utf-8 }
assert equal ($body | hash sha256) $s.sha256
assert equal ($body | into binary | bytes length) $s.bytes
$rebuilt += $s.header
assert equal ($rebuilt | into binary | bytes length) $s.offset
$rebuilt += $body
$rebuilt += $s.footer
assert equal (open --raw ($root | path join $s.local)) $body
let b = $s.binding
if $b.kind in [git index excerpt] {
let source_repo = if $b.repository == radio { $repo } else { $soft3 }
^git -C $source_repo cat-file blob $'($b.revision):($b.path)' out> $temp
assert equal $env.LAST_EXIT_CODE 0
let source = (open --raw $temp)
if $b.kind == git {
assert equal $source $body
$git_count += 1
} else if $b.kind == index {
assert equal ($source | hash sha256) $b.source_sha256
assert equal ($source | into binary | bytes length) $b.source_bytes
let selected = ($source | from json | where {|f| ($f.path | str ends-with 'Cargo.toml') or ($f.path | str ends-with 'verify.nu') })
assert equal $selected ($body | from json)
$index_count += 1
} else {
assert equal ($source | hash sha256) $b.sha256
assert equal ($source | into binary | bytes length) $b.bytes
let selected = (($source | split row "\n" | skip ($b.first - 1) | take ($b.last - $b.first + 1) | str join "\n") + "\n")
assert equal $selected $body
assert equal ($body | hash sha256) $b.excerpt_sha256
$excerpt_count += 1
}
} else if $b.kind in [owned evidence] {
if $live { assert equal (open --raw ($repo | path join $b.path)) $body }
$retained_count += 1
} else { assert equal $b.kind brief }
}
assert equal ($rebuilt | into binary) $context
let sources = (open ($root | path join source-identities.json))
for f in $sources {
assert equal $f.revision $m.parent
^git -C $repo cat-file blob $'($f.revision):($f.path)' out> $temp
assert equal $env.LAST_EXIT_CODE 0
let source = (open --raw $temp | into binary)
assert equal ($source | bytes length) $f.bytes
assert equal ($source | hash sha256) $f.sha256
}
let evidence = {|label| let s = ($m.sections | where label == $label | first); open --raw ($root | path join $s.local) }
let before = (do $evidence 'Packaging inputs/historical-ce0-reader-before-runs.json' | from json)
let after = (do $evidence 'Packaging inputs/historical-ce0-reader-after-runs.json' | from json)
assert equal ($before | reject at) ($after | reject at)
assert equal ($before.source | length) 51
assert equal ($before.inputs | length) 36
let capture = (do $evidence 'Capture wrapper' | hash sha256)
for name in [consumer-ce0-lock consumer-ce0-metadata research-before proof-before original-prepare-v2] {
let record = (do $evidence $'records/($name).json' | from json)
assert equal $record.exit_code 0
assert equal $record.runner_sha256 $capture
for stream in [stdout stderr] {
let text = (do $evidence $'records/($name).($stream)')
assert equal ($text | into binary | bytes length) ($record | get $stream | get bytes)
assert equal ($text | hash sha256) ($record | get $stream | get sha256)
}
}
for name in [consumer-ce0-lock consumer-ce0-metadata] {
assert (do $evidence $'records/($name).stderr' | str contains 'warning: skipping duplicate package')
}
let renames = (do $evidence 'Packaging inputs/renames.json' | from json)
assert equal ($renames | length) 7
assert equal ($renames | get bytes | math sum) 2141
for row in $renames { assert equal $row.archived ($row.logical + '.txt') }
assert equal (do $evidence 'records/research-before.stdout' | from json | get status) pass
assert equal (do $evidence 'records/proof-before.stdout' | from json | get status) pass
let index_bindings = (do $evidence 'Packaging inputs/historical-index-bindings.json' | from json)
assert equal ($index_bindings | length) 19
for row in $index_bindings {
^git -C $repo cat-file blob $'($m.parent):($row.index)' out> $temp
assert equal $env.LAST_EXIT_CODE 0
let source = (open --raw $temp)
assert equal ($source | hash sha256) $row.index_sha256
mut entry = ($source | from json)
for part in ($row.pointer | split row '/' | skip 1) {
$entry = if $part in [probe_inputs files sections] { $entry | get $part } else { $entry | get ($part | into int) }
}
assert equal $entry.bytes $row.bytes
assert equal $entry.sha256 $row.sha256
let capsule = if ($row.index | str starts-with 'audit/2026-10-12-bao-proof-research/') { 'audit/2026-10-12-bao-proof-research' } else { 'audit/2026-10-12-bao-bounded-proof' }
let logical = if ($entry | get -o binding) != null {
assert equal $entry.binding.kind audit
'audit/2026-10-12-bao-proof-research/' + $entry.binding.path
} else { $capsule + '/' + $entry.path }
assert equal $logical $row.logical_path
let prior = if $row.planned_direct_check == already_historical_variant_before_packaging {
assert equal $row.archived_path ($capsule + '/review/code/verify-before-code.nu')
$row.archived_path
} else {
let archive = if ($logical | str ends-with 'Cargo.toml') { $logical + '.txt' } else { $capsule + '/verify.original.nu.txt' }
assert equal $row.archived_path $archive
$logical
}
^git -C $repo cat-file blob $'($m.parent):($prior)' out> $temp
assert equal $env.LAST_EXIT_CODE 0
assert equal (open --raw $temp | hash sha256) $row.sha256
}
let review = (open --raw ($root | path join previous-review-raw.json))
let completed = (do $evidence 'PLAN v1 completion.json' | from json)
assert equal ($review | hash sha256) $completed.stdout_sha256
assert equal ($review | from json | get result) (do $evidence 'PLAN v1 result.md')
let prepare = (do $evidence 'records/original-prepare-v2.json' | from json)
assert equal ($prepare.argv | first 2) [nu '-c']
assert equal (($prepare.argv | get 2) + "\n") (do $evidence 'Exact prepare-crate child code')
if $live {
let changed = (^git -C $repo diff --name-only HEAD | lines)
let untracked = (^git -C $repo ls-files --others --exclude-standard | lines)
assert (($changed | append $untracked | where {|p| not (($p | str starts-with 'audit/') or ($p | str starts-with '.claude/tasks/audit-cargo-packaging/')) }) | is-empty)
}
rm $temp
{status: pass, bytes: $m.context_bytes, sha256: $m.context_sha256, sections: ($m.sections | length),
full_git_sections: $git_count, selected_index_sections: $index_count, primary_excerpts: $excerpt_count,
retained_sections: $retained_count, source_identity_records: ($sources | length), archived_manifests: 7,
raw_records: 5, historical_index_bindings: 19, original_prepare_calls: 2,
production_changed: false} | to json
}