Admit reviewed receiver evidence batch 9

docs/changes/netkingdom-target-2026-10-17/sync_cluster_with_verified_cli.py

@@ -0,0 +1,40 @@
+"""Run authorized normal Cluster maintenance with exact client source and retained baseline."""
+from pathlib import Path
+import hashlib,json,subprocess
+here=Path(__file__).resolve().parent;root=Path('/home/worsch/railiance-cluster')
+packet=here.parent/'netkingdom-target-2026-10-16/cluster-historical-publication-r1/owner-followthrough-r6'
+manifest=json.loads((packet/'manifest.json').read_text())
+for name in ['scripts/consistency_check.py']:
+ pin=next(x['candidate_sha256'] for x in manifest['files'] if x['path']==name)
+ assert hashlib.sha256((Path('/home/worsch/state-hub')/name).read_bytes()).hexdigest()==pin,'fixed-client-source-drift'
+assert json.loads((here/'receiver-rollout-r4/before-verified-client.json').read_text())['stage']=='before-verified-client'
+# Verify the installed entrypoint's actual packaged checker, not just checkout bytes.
+probe=subprocess.run(['/home/worsch/state-hub/.venv/bin/python','-c',"import custodian_cli,hashlib,json; p=custodian_cli.STATE_HUB_DIR/'scripts/consistency_check.py'; print(json.dumps({'path':str(p),'sha256':hashlib.sha256(p.read_bytes()).hexdigest()}))"],cwd=root,capture_output=True,text=True,timeout=10)
+assert probe.returncode==0;loaded=json.loads(probe.stdout);assert loaded['sha256']==next(x['candidate_sha256'] for x in manifest['files'] if x['path']=='scripts/consistency_check.py')
+(here/'verified-loaded-client.json').write_text(json.dumps(loaded,indent=2)+'\n')
+baseline_head=subprocess.check_output(['git','-C',str(root),'rev-parse','HEAD'],text=True).strip();assert baseline_head=='6ae3f847c83da3402883453ee7110457bfb2d0d6'
+backup=here/'railiance-cluster-publication-backup';originals=json.loads((backup/'originals.json').read_text())
+def git(*a):return subprocess.check_output(['git','-C',str(root),*a],stderr=subprocess.PIPE)
+for name,index in originals.items():
+ assert (root/name).read_bytes()==(backup/(name+'.worktree')).read_bytes()
+ assert git('ls-files','--stage','--',name).decode()==index
+# Shield original staged generated content from any legacy writeback index.
+for name in originals:
+ raw=git('ls-tree','HEAD','--',name).decode().split();git('update-index','--cacheinfo',raw[0],raw[2],name)
+try:
+ for label,argv,limit in [('verified-client-cluster-consistency',['statehub','fix-consistency','--repo','railiance-cluster','--json'],300),('verified-client-cluster-projection',['/home/worsch/repo-manager/.venv/bin/rmgr','sync','--path',str(root),'--push'],180)]:
+  r=subprocess.run(argv,cwd=root,capture_output=True,text=True,timeout=limit)
+  (here/(label+'.json')).write_text(r.stdout);(here/(label+'.stderr.txt')).write_text(r.stderr)
+  assert r.returncode==0,label+'-refused-receipt-retained'
+finally:
+ for name,index in originals.items():
+  (root/name).write_bytes((backup/(name+'.worktree')).read_bytes())
+  mode,oid,stage,path=index.split();assert stage=='0';git('update-index','--cacheinfo',mode,oid,path)
+  assert git('ls-files','--stage','--',name).decode()==index
+c=json.loads((here/'verified-client-cluster-consistency.json').read_text());assert c['summary']['fail']==c['summary']['automation_error']==0
+assert 'bindings: synced 20/20' in c['fixes_applied'],'frozen-binding-omission-not-observed'
+p=json.loads((here/'verified-client-cluster-projection.json').read_text());assert p['status']=='applied'
+assert p['commit']==p['receipt']['expected_commit']==p['receipt']['derived_commit']==baseline_head
+assert p['receipt']['instance_role']=='primary' and p['receipt']['instance_label']=='railiance01'
+assert not p['receipt']['outcome']['refused'] and not p['receipt']['outcome']['retired']
+print(json.dumps({'status':'applied','commit':p['commit'],'fixed_client_source_verified':True,'current_hash_comparison':'pending','original_failed_comparison_retained':True,'unrelated_work_preserved':True}))