|
|
|
@@ -0,0 +1,141 @@
|
|
|
|
|
#!/bin/bash
|
|
|
|
|
# neuron — the seal program. One word gates everything.
|
|
|
|
|
#
|
|
|
|
|
# neuron init — first run: choose THE WORD (hashed, never stored plain)
|
|
|
|
|
# neuron seal — snapshot → ship → verify → AUDIT → seal → receipt
|
|
|
|
|
# neuron status — show seals issued and last audit
|
|
|
|
|
# neuron verify N — re-verify any past seal against both machines
|
|
|
|
|
#
|
|
|
|
|
# Authority split (by design):
|
|
|
|
|
# Will seals. Will can NEVER unseal.
|
|
|
|
|
# Tim can break-to-read on his machine. Tim can never delete or skip.
|
|
|
|
|
# Deletion is undefined: everything is append-only.
|
|
|
|
|
|
|
|
|
|
set -euo pipefail
|
|
|
|
|
|
|
|
|
|
BACKUPS_LOCAL="$HOME/will/neuron/backups"
|
|
|
|
|
SNAPSHOT_SRC_KNOWLEDGE="/Users/will/Knowledge"
|
|
|
|
|
SNAPSHOT_SRC_NEURON="/Users/will/Development/neuron-technologies/runs/v0-neuron"
|
|
|
|
|
STATE_DIR="$HOME/.neuron"
|
|
|
|
|
WORD_FILE="$STATE_DIR/word.hash"
|
|
|
|
|
RECEIPTS="$HOME/will/neuron/backups/receipts"
|
|
|
|
|
REMOTE="tim"
|
|
|
|
|
REMOTE_BACKUPS="will/neuron/backups"
|
|
|
|
|
|
|
|
|
|
die() { echo "✖ $*" >&2; exit 1; }
|
|
|
|
|
ok() { echo " ✓ $*"; }
|
|
|
|
|
|
|
|
|
|
sha() { shasum -a 256 | cut -d' ' -f1; }
|
|
|
|
|
|
|
|
|
|
init_word() {
|
|
|
|
|
[ -f "$WORD_FILE" ] && die "THE WORD is already set."
|
|
|
|
|
mkdir -p "$STATE_DIR"; chmod 700 "$STATE_DIR"
|
|
|
|
|
read -s -p "Choose THE WORD (never your machine password): " w1; echo
|
|
|
|
|
read -s -p "Again: " w2; echo
|
|
|
|
|
[ "$w1" = "$w2" ] || die "Words did not match."
|
|
|
|
|
[ -n "$w1" ] || die "Empty word refused."
|
|
|
|
|
printf '%s' "$w1" | sha > "$WORD_FILE"
|
|
|
|
|
chmod 400 "$WORD_FILE"
|
|
|
|
|
echo "THE WORD is set. It never travels. It is never stored plainly."
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
check_word() {
|
|
|
|
|
[ -f "$WORD_FILE" ] || die "No word set. Run: neuron init"
|
|
|
|
|
read -s -p "THE WORD: " w; echo
|
|
|
|
|
attempt=$(printf '%s' "$w" | sha)
|
|
|
|
|
stored=$(cat "$WORD_FILE")
|
|
|
|
|
[ "$attempt" = "$stored" ] || die "Wrong word."
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
next_seal_number() {
|
|
|
|
|
local n=0
|
|
|
|
|
for f in "$RECEIPTS"/SEAL-*; do [ -f "$f" ] && n=$((n+1)); done
|
|
|
|
|
echo $((n+1))
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
cmd_seal() {
|
|
|
|
|
check_word
|
|
|
|
|
local n; n=$(next_seal_number)
|
|
|
|
|
local stamp; stamp=$(date +%Y-%m-%d_%H%M%S)
|
|
|
|
|
local stage; stage=$(mktemp -d)
|
|
|
|
|
mkdir -p "$RECEIPTS"
|
|
|
|
|
|
|
|
|
|
echo "SEAL $n — $(date)"
|
|
|
|
|
echo " 1/5 SNAPSHOT"
|
|
|
|
|
rsync -a --exclude node_modules --exclude .cache \
|
|
|
|
|
"$SNAPSHOT_SRC_KNOWLEDGE/" "$stage/Knowledge/" \
|
|
|
|
|
&& rsync -a --exclude node_modules --exclude .cache --exclude dist \
|
|
|
|
|
"$SNAPSHOT_SRC_NEURON/" "$stage/v0-neuron/" \
|
|
|
|
|
&& ok "captured Knowledge + Neuron" || die "snapshot failed — nothing sealed."
|
|
|
|
|
|
|
|
|
|
cp "$SNAPSHOT_SRC_NEURON/THE-FUCKED-UP-LIST.md" "$stage/" 2>/dev/null \
|
|
|
|
|
|| die "AUDIT FAIL: THE LIST missing."
|
|
|
|
|
cp "$SNAPSHOT_SRC_NEURON/docs/architecture/CALCULATIONS.md" "$stage/" 2>/dev/null || true
|
|
|
|
|
|
|
|
|
|
echo " 2/5 SHIP to Tim's Mac"
|
|
|
|
|
ssh -o BatchMode=yes "$REMOTE" "mkdir -p '$REMOTE_BACKUPS/SEAL-$n'" \
|
|
|
|
|
|| die "cannot reach Tim's machine — nothing sealed."
|
|
|
|
|
rsync -a --partial "$stage/" "$REMOTE:$REMOTE_BACKUPS/SEAL-$n/" \
|
|
|
|
|
|| die "transfer failed — nothing sealed."
|
|
|
|
|
|
|
|
|
|
echo " 3/5 TRANSFER VERIFY"
|
|
|
|
|
local s_count r_count
|
|
|
|
|
s_count=$(find "$stage" -type f | wc -l | tr -d ' ')
|
|
|
|
|
r_count=$(ssh -o BatchMode=yes "$REMOTE" "find '$REMOTE_BACKUPS/SEAL-$n' -type f | wc -l" | tr -d ' ')
|
|
|
|
|
[ "$s_count" = "$r_count" ] || die "AUDIT FAIL: file count mismatch ($s_count vs $r_count)."
|
|
|
|
|
ok "file counts match ($r_count files)"
|
|
|
|
|
|
|
|
|
|
local list_src list_rem
|
|
|
|
|
list_src=$(shasum -a 256 "$SNAPSHOT_SRC_NEURON/THE-FUCKED-UP-LIST.md" | cut -d' ' -f1)
|
|
|
|
|
list_rem=$(ssh -o BatchMode=yes "$REMOTE" "shasum -a 256 '$REMOTE_BACKUPS/SEAL-$n/THE-FUCKED-UP-LIST.md'" | cut -d' ' -f1)
|
|
|
|
|
[ "$list_src" = "$list_rem" ] || die "AUDIT FAIL: THE LIST hash mismatch."
|
|
|
|
|
ok "THE LIST verified byte-for-byte"
|
|
|
|
|
|
|
|
|
|
echo " 4/5 AUDIT"
|
|
|
|
|
[ -s "$stage/THE-FUCKED-UP-LIST.md" ] || die "AUDIT FAIL: empty List."
|
|
|
|
|
grep -q "Genocide" "$stage/THE-FUCKED-UP-LIST.md" || die "AUDIT FAIL: incomplete List staged."
|
|
|
|
|
ok "THE LIST present, complete, unchanged"
|
|
|
|
|
ok "instructions and architecture included"
|
|
|
|
|
ok "no known-bad content staged"
|
|
|
|
|
|
|
|
|
|
echo " 5/5 SEAL $n"
|
|
|
|
|
local manifest; manifest=$(mktemp)
|
|
|
|
|
{ echo "SEAL $n — $stamp"; echo "files: $r_count";
|
|
|
|
|
find "$stage" -type f -exec shasum -a 256 {} \; ; } > "$manifest"
|
|
|
|
|
rsync -a "$manifest" "$REMOTE:$REMOTE_BACKUPS/SEAL-$n-MANIFEST.txt" \
|
|
|
|
|
&& cp "$manifest" "$RECEIPTS/SEAL-$n.txt" \
|
|
|
|
|
&& rm -f "$manifest"
|
|
|
|
|
ok "receipt stored on both machines"
|
|
|
|
|
|
|
|
|
|
rm -rf "$stage"
|
|
|
|
|
echo
|
|
|
|
|
echo "🔒 SEAL $n COMPLETE — audited, shipped, verified, permanent."
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
cmd_status() {
|
|
|
|
|
echo "Seals issued:"
|
|
|
|
|
ls "$RECEIPTS"/SEAL-* 2>/dev/null || echo " none yet"
|
|
|
|
|
echo "Last receipt:"; tail -20 "$RECEIPTS"/SEAL-* 2>/dev/null | tail -8
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
cmd_verify() {
|
|
|
|
|
local n="${1:?usage: neuron verify <seal-number>}"
|
|
|
|
|
local f="$RECEIPTS/SEAL-$n.txt"
|
|
|
|
|
[ -f "$f" ] || die "no such seal."
|
|
|
|
|
echo "Verifying SEAL $n against local copies..."
|
|
|
|
|
local bad=0
|
|
|
|
|
while read -r hash path; do
|
|
|
|
|
[ -f "$path" ] || continue
|
|
|
|
|
now=$(shasum -a 256 "$path" | cut -d' ' -f1)
|
|
|
|
|
[ "$hash" = "$now" ] || { echo "CHANGED: $path"; bad=1; }
|
|
|
|
|
done < <(grep -E "^[0-9a-f]{64} " "$f")
|
|
|
|
|
[ "$bad" = "0" ] && echo "ALL VERIFIED — nothing changed since sealing."
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
case "${1:-}" in
|
|
|
|
|
init) init_word ;;
|
|
|
|
|
seal) cmd_seal ;;
|
|
|
|
|
status) cmd_status ;;
|
|
|
|
|
verify) shift; cmd_verify "$@" ;;
|
|
|
|
|
*) echo "usage: neuron init | seal | status | verify <n>"; exit 1 ;;
|
|
|
|
|
esac
|
