{"name":"s2b-go-engine","lang":"bash","entry":"spec-s2b-go.sh","script":"#!/usr/bin/env bash\n# spec-s2b-go.sh — S2b (Go replay engine) verifier.\n#\n# MetaTask v1.3 pilot spec script (protocol draft §4.3 CI-style verifier contract).\n# Template family: spec-s2-engine (see spec-s2a-python.sh for the shared\n# skeleton documentation).\n#\n# Environment (§4.3): METATASK_ARTIFACT_URI / METATASK_COMMIT /\n# METATASK_BASE_COMMIT (empty|null = greenfield) / METATASK_NODE /\n# METATASK_TASKID / METATASK_DOWNLOAD_BASE / METATASK_VECTOR_SET_URI (override).\n#\n# Toolchain: git + go REQUIRED — a reviewer machine without go cannot\n# adjudicate this node; the script reports invalid (exit 2) with evidence.\n#\n# The embedded VECTOR_SET_URI below is a PUBLISH-TIME PLACEHOLDER: unresolved\n# placeholder → invalid (exit 2), never a fail verdict.\n#\n# Exit codes: 0 pass · 1 fail · 2 invalid. Check counter asserted against\n# EXPECTED_CHECKS on the pass path (enumeration closure self-check).\nset -uo pipefail\n\nreadonly VECTOR_SET_URI=\"metafile://71f09271a6be857a0f40200498381decab99d9d7f7049f32f69f2f0df11bc58ei0.gz\"   # PLACEHOLDER — backfilled with metafile://… at publish\nEXPECTED_CHECKS=17\n\nCHECKS=0\n\njson_line() { python3 -c 'import json,sys; print(json.dumps({\"verdict\":sys.argv[1],\"detail\":sys.argv[2],\"checks\":int(sys.argv[3])}))' \"$1\" \"$2\" \"$CHECKS\"; }\nnote() { printf '%s\\n' \"$1\"; }\nfail() { json_line fail \"$1\"; printf 'FAIL: %s\\n' \"$1\" >&2; exit 1; }\ninvalid() { json_line invalid \"$1\"; exit 2; }\ncheck() {\n  CHECKS=$((CHECKS+1))\n  if [ \"$2\" = \"0\" ]; then note \"[check $CHECKS] $1: ok${3:+ — $3}\"; else note \"[check $CHECKS] $1: FAIL${3:+ — $3}\"; fail \"$1${3:+ — $3}\"; fi\n}\ngate() {\n  CHECKS=$((CHECKS+1))\n  if [ \"$2\" = \"0\" ]; then note \"[check $CHECKS] $1: ok${3:+ — $3}\"; else note \"[check $CHECKS] $1: INVALID${3:+ — $3}\"; invalid \"$1${3:+ — $3}\"; fi\n}\ntool() {\n  if command -v \"$1\" >/dev/null 2>&1; then\n    note \"[tool] $1: $(\"$@\" 2>&1 | head -1)\"\n    return 0\n  fi\n  note \"[tool] $1: MISSING\"\n  return 1\n}\n\nfetch_artifact() {\n  local uri=\"$1\" dest=\"$2\"\n  case \"$uri\" in\n    file://*) cp \"${uri#file://}\" \"$dest\" 2>/dev/null && return 0 ;;\n    metafile://*|pin://*)\n      local base=\"${METATASK_DOWNLOAD_BASE:-}\"\n      if [ -z \"$base\" ]; then note \"[fetch] $uri requires METATASK_DOWNLOAD_BASE (not set)\"; return 1; fi\n      if FETCH_URI=\"$uri\" FETCH_BASE=\"$base\" FETCH_DEST=\"$dest\" python3 - <<'PYEOF'\nimport os, sys\nfrom urllib.parse import quote\nfrom urllib.request import urlopen\nuri, base, dest = os.environ[\"FETCH_URI\"], os.environ[\"FETCH_BASE\"].rstrip(\"/\"), os.environ[\"FETCH_DEST\"]\nurl = \"%s/file/%s\" % (base, quote(uri, safe=\"\"))\ntry:\n    with urlopen(url, timeout=120) as response:\n        data = response.read()\n    with open(dest, \"wb\") as handle:\n        handle.write(data)\n    print(\"[fetch] %s → %s (%d bytes)\" % (uri, url, len(data)))\nexcept Exception as err:\n    print(\"[fetch] %s via %s failed: %s\" % (uri, url, err))\n    sys.exit(1)\nPYEOF\n      then return 0; else return 1; fi ;;\n    *) [ -f \"$uri\" ] && cp \"$uri\" \"$dest\" && return 0 ;;\n  esac\n  return 1\n}\n\nARTIFACT_URI=\"${METATASK_ARTIFACT_URI:-}\"\nCOMMIT=\"${METATASK_COMMIT:-}\"\nBASE_COMMIT=\"${METATASK_BASE_COMMIT:-}\"\nNODE=\"${METATASK_NODE:-}\"\nTASKID=\"${METATASK_TASKID:-}\"\n\nnote \"[env] node=${NODE:-<missing>} taskid=${TASKID:-<missing>}\"\nnote \"[env] artifact=${ARTIFACT_URI:-<missing>} commit=${COMMIT:-<missing>} base=${BASE_COMMIT:-<greenfield>}\"\n\nenv_bad=1\n[ -n \"$ARTIFACT_URI\" ] && [ -n \"$COMMIT\" ] && [ -n \"$NODE\" ] && [ -n \"$TASKID\" ] && env_bad=0\ngate \"env contract present (ARTIFACT_URI/COMMIT/NODE/TASKID)\" \"$env_bad\"\ncommit_bad=1\nprintf '%s' \"$COMMIT\" | grep -qE '^[0-9a-fA-F]{40}$' && commit_bad=0\ngate \"commit under test is 40-hex\" \"$commit_bad\" \"$COMMIT\"\n\ntools_bad=1\ntool git git --version && tool go go version && tool python3 python3 --version && tools_bad=0\ngate \"toolchain: git + go (+ python3 for fetch/JSON plumbing)\" \"$tools_bad\" \"spec-s2b requires git and go; without them the verdict is invalid, never fail\"\n\nVECTOR_URI=\"${METATASK_VECTOR_SET_URI:-$VECTOR_SET_URI}\"\nvec_bad=0\ncase \"$VECTOR_URI\" in *VECTOR_SET_URI*|\"\") vec_bad=1 ;; esac\ngate \"vector set reference resolved\" \"$vec_bad\" \"VECTOR_SET_URI placeholder not backfilled and no METATASK_VECTOR_SET_URI override — publish the vector-set metafile first\"\n\nWORK=\"$(mktemp -d \"${TMPDIR:-/tmp}/metatask-s2b.XXXXXX\")\"\ntrap 'rm -rf \"$WORK\"' EXIT\n\nfetch_artifact \"$ARTIFACT_URI\" \"$WORK/submission.bundle\"\ngate \"artifact fetched\" \"$([ -s \"$WORK/submission.bundle\" ] && echo 0 || echo 1)\" \"$ARTIFACT_URI\"\n\ngit bundle verify \"$WORK/submission.bundle\" >/dev/null 2>&1 && git clone -q \"$WORK/submission.bundle\" \"$WORK/repo\" 2>/dev/null\ncheck \"git bundle verifies and clones\" \"$([ -d \"$WORK/repo/.git\" ] && echo 0 || echo 1)\" \"$ARTIFACT_URI\"\n\ngit -C \"$WORK/repo\" checkout -q \"$COMMIT\" 2>/dev/null\ncheck \"checkout METATASK_COMMIT\" \"$([ \"$(git -C \"$WORK/repo\" rev-parse HEAD 2>/dev/null)\" = \"$(printf '%s' \"$COMMIT\" | tr 'A-F' 'a-f')\" ] && echo 0 || echo 1)\" \"$COMMIT\"\n\nif [ -z \"$BASE_COMMIT\" ] || [ \"$BASE_COMMIT\" = \"null\" ]; then\n  CHECKS=$((CHECKS+1)); note \"[check $CHECKS] base-commit ancestry: ok — greenfield node (baseCommit null), ancestry skipped per draft §4.4\"\nelse\n  git -C \"$WORK/repo\" merge-base --is-ancestor \"$BASE_COMMIT\" \"$COMMIT\" 2>/dev/null\n  check \"declared baseCommit is an ancestor of commit\" \"$([ $? -eq 0 ] && echo 0 || echo 1)\" \"base=$BASE_COMMIT\"\nfi\n\n# Language gate: stdlib-only go.mod (no external require directives).\nrequire_lines=\"$(grep -cE '^[[:space:]]*require[[:space:]]' \"$WORK/repo/go.mod\" 2>/dev/null || true)\"\nrequire_block=\"$(awk '/^require \\(/,0' \"$WORK/repo/go.mod\" 2>/dev/null | grep -cE '^[[:space:]]*[a-z0-9.-]+/' || true)\"\ncheck \"go.mod declares no external requires (stdlib-only)\" \"$([ \"${require_lines:-0}\" = \"0\" ] && [ \"${require_block:-0}\" = \"0\" ] && echo 0 || echo 1)\" \"require lines: ${require_lines:-0}, block entries: ${require_block:-0}\"\n\n( cd \"$WORK/repo\" && go build ./... ) > \"$WORK/build.log\" 2>&1\ncheck \"go build ./... clean\" \"$?\" \"$(tail -1 \"$WORK/build.log\")\"\n\n( cd \"$WORK/repo\" && go vet ./... ) > \"$WORK/vet.log\" 2>&1\ncheck \"go vet ./... clean\" \"$?\" \"$(tail -1 \"$WORK/vet.log\")\"\n\n( cd \"$WORK/repo\" && CGO_ENABLED=0 go build -o \"$WORK/metatask-replay-static\" . ) > \"$WORK/static.log\" 2>&1\ncheck \"static binary builds (CGO_ENABLED=0)\" \"$?\" \"$(tail -1 \"$WORK/static.log\")\"\n\n[ -f \"$WORK/repo/run-vectors.sh\" ]\ncheck \"run-vectors.sh present\" \"$?\" \"contract: README.md vector runner\"\n\nfetch_artifact \"$VECTOR_URI\" \"$WORK/vector-set.tar.gz\"\n[ -s \"$WORK/vector-set.tar.gz\" ] && mkdir -p \"$WORK/vectors\" && tar -xzf \"$WORK/vector-set.tar.gz\" -C \"$WORK/vectors\" 2>/dev/null\ngate \"vector set fetched and extracted\" \"$([ -d \"$WORK/vectors\" ] && ls \"$WORK/vectors\"/*.json >/dev/null 2>&1 && echo 0 || echo 1)\" \"$VECTOR_URI\"\n\n( cd \"$WORK/repo\" && bash ./run-vectors.sh \"$WORK/vectors\" ) > \"$WORK/run1.log\" 2>&1\nrun1_rc=$?\nnote \"[run 1] exit=$run1_rc\"; sed 's/^/[run 1] /' \"$WORK/run1.log\" | tail -6\ncheck \"vector run 1 green\" \"$run1_rc\" \"run-vectors.sh exit code\"\n\n( cd \"$WORK/repo\" && bash ./run-vectors.sh \"$WORK/vectors\" ) > \"$WORK/run2.log\" 2>&1\nrun2_rc=$?\nnote \"[run 2] exit=$run2_rc\"; sed 's/^/[run 2] /' \"$WORK/run2.log\" | tail -3\ncheck \"vector run 2 green\" \"$run2_rc\" \"run-vectors.sh exit code\"\n\nd1=\"$(grep -E '^CANONICAL_SHA256 [0-9a-f]{64}$' \"$WORK/run1.log\" | tail -1 | awk '{print $2}')\"\nd2=\"$(grep -E '^CANONICAL_SHA256 [0-9a-f]{64}$' \"$WORK/run2.log\" | tail -1 | awk '{print $2}')\"\ncheck \"determinism: two runs byte-identical canonical digest\" \"$([ -n \"$d1\" ] && [ \"$d1\" = \"$d2\" ] && echo 0 || echo 1)\" \"run1=${d1:-<none>} run2=${d2:-<none>}\"\n\nif [ \"$CHECKS\" != \"$EXPECTED_CHECKS\" ]; then\n  invalid \"check-counter mismatch: ran $CHECKS, spec declares $EXPECTED_CHECKS (script bug)\"\nfi\njson_line pass \"S2b green: clone+build+vet+static gates ok; vector set $VECTOR_URI passed twice; canonical digest ${d1}\"\nexit 0\n","input":{"env":{"METATASK_ARTIFACT_URI":"metafile://<submission git bundle>","METATASK_COMMIT":"submission tip commit (40-hex)","METATASK_BASE_COMMIT":"db79d8ab20309c5251e817f2607acd8f450e2ca2 (pinned base tip)","METATASK_NODE":"S2b","METATASK_TASKID":"<task root pinId>","METATASK_VECTOR_SET_URI":"offline override","METATASK_DOWNLOAD_BASE":"optional; metafile resolution base"},"toolchain":"git + go required (a machine without go yields invalid, never fail)"},"output":{"stdout":"evidence log + final JSON line {\"verdict\",\"detail\",\"checks\"}","exitCode":"0 pass | 1 fail | 2 invalid"},"workspace":{"type":"git","baseRef":"metafile://658058a0e2354bbdececbfd32c822e6e83685f2b020c64631989b1619f52b7b6i0.bundle","baseCommit":"db79d8ab20309c5251e817f2607acd8f450e2ca2","notes":"greenfield-adjacent skeleton: go.mod + flag-parsing main.go shell + MIT LICENSE"},"validation":{"null_tolerance":true,"enumeration_closure":{"closure":"every machine-checkable S2b acceptance item is one numbered check; the pass path asserts the check counter equals the declared expected_count","selfcheck":{"expected_count":17}},"proposition_fidelity":{"correspondence":"metafile://d7f836544764bf4ca68bd7903b7a6c7a978ff16e34a828e9b31c928cbec05ccci0.md","artifactPin":"metafile://d7f836544764bf4ca68bd7903b7a6c7a978ff16e34a828e9b31c928cbec05ccci0.md","artifactKey":"acceptance-sheet","coverage":["statement","definitions","proof-direction"],"note":"statement = S2b deliverable (CLI contract, static binary, go vet); definitions = git-bundle result contract + runner contract; proof-direction = the acceptance-sheet S2b table."}}}