`verification/TK-11415/verify.mjs`

56 lines
import fs from 'node:fs';
import crypto from 'node:crypto';
import { execFileSync } from 'node:child_process';
const root = '/Users/macstudio3/Projects';
const project = `${root}/dw-unbuyable-recovery-pilot`;
const git = (dir, ...args) => execFileSync('git', ['-C', dir, ...args], {encoding:'utf8'}).trim();
const source = fs.readFileSync(`${root}/hollywood-import/momentum-feed/refresh.mjs`, 'utf8');
const key = source.match(/\b[a-f0-9]{64}\b/g)?.find(k => crypto.createHash('sha256').update(k).digest('hex').startsWith('66fd704dc09f'));
if (!key) throw new Error('Expected public key fingerprint absent');
const host = 'https://ms-e886719d86e7-4256.sfo.meilisearch.io';
const assertions = [];
function check(name, ok, evidence) {
  assertions.push({name, verdict:ok ? 'PASS' : 'FAIL', evidence});
}
const url = 'https://momentumco.com/build/assets/app-DOnLSWOi.js';
const bundleResponse = await fetch(url, {signal:AbortSignal.timeout(30000)});
const bundle = await bundleResponse.text();
check('Anonymous vendor bundle publishes identical key', bundleResponse.ok && bundle.includes(key) && bundle.includes(host.slice(8)), {url,http:bundleResponse.status,sha256:crypto.createHash('sha256').update(bundle).digest('hex')});
for (const [name, path, bearer, method] of [
 ['public-key search', '/indexes/redesign-colors/search', key, 'POST'],
 ['invalid-key search', '/indexes/redesign-colors/search', 'invalid-tk11415-negative-control', 'POST'],
 ['key-management denial', '/keys', key, 'GET']
]) {
 const response = await fetch(host + path, {method,headers:{Authorization:`Bearer ${bearer}`,'Content-Type':'application/json'},...(method==='POST' ? {body:JSON.stringify({q:'',limit:1})} : {}),signal:AbortSignal.timeout(30000)});
 const body = await response.json();
 const ok = name==='public-key search' ? response.ok && Array.isArray(body.hits) && body.hits.length===1 : [401,403].includes(response.status);
 check(name, ok, {http:response.status,...(name==='public-key search' ? {hits:body.hits?.length} : {code:body.code})});
}
const queue = '/Users/macstudio3/.claude/yolo-queue/pending-approval';
const memo = '2026-09-02-TK11133-meilisearch-key-rotation-routing.md';
const decisions = fs.readFileSync(`${queue}/_decisions.jsonl`,'utf8').trim().split('\n').map(x=>JSON.parse(x));
const decision = decisions.filter(x=>x.memo===memo).at(-1);
check('Memo resolved with canonical decision provenance', decision?.decision==='FILE' && decision?.dest==='_resolved' && fs.existsSync(`${queue}/_resolved/${memo}`) && !fs.existsSync(`${queue}/${memo}`), decision);
const commits = {'tk-11331-exec':'497b463','hollywood-import':'8d08f31','hollywood-price-2026':'bc898f7'};
for (const [repo, commit] of Object.entries(commits)) {
 const dir = `${root}/${repo}`;
 check(`${repo} has no configured remotes`,git(dir,'remote')==='',{head:git(dir,'rev-parse','HEAD')});
 const files=git(dir,'show','--pretty=format:','--name-only',commit).split('\n').filter(Boolean);
 check(`${repo} annotation commit exists`,files.length===2,{commit,files});
 for (const file of files) {
  const content=fs.readFileSync(`${dir}/${file}`,'utf8');
  check(`${repo}/${file} public classification`,content.includes('vendor-owned PUBLIC search key'),{file});
  if (file.endsWith('.mjs')) execFileSync('node',['--check',`${dir}/${file}`]);
  else execFileSync('python3',['-c','import sys; p=sys.argv[1]; compile(open(p).read(), p, "exec")',`${dir}/${file}`]);
  check(`${repo}/${file} syntax`,true,{compiler:file.endsWith('.mjs')?'node --check':'Python in-memory compile'});
 }
}
const snapDir=`${root}/hollywood-import`;
check('Authenticated snapshot remains contained',git(snapDir,'ls-files','--','products-authed.html')==='' && git(snapDir,'log','--all','--format=%h','--','products-authed.html')==='' && !!git(snapDir,'check-ignore','products-authed.html'),{tracked:false,pathHistory:false,ignored:true,contentsRead:false,credentialsExercised:false});
const test=execFileSync('node',['--test','--test-reporter=tap',`${project}/tk11040-momentum-reconcile/meilisearch-client.test.mjs`],{encoding:'utf8'});
check('Existing client happy/auth/schema suite',test.includes('# pass 3') && test.includes('# fail 0'),{pass:3,fail:0});
const proof={ticket:'TK-11415-tk-11133-residual-meilisearch-credential',timestamp:new Date().toISOString(),intent:'Verify public vendor configuration classification, existing containment and resolved approval; reconcile stale ticket blocker',risk_tier:'R3 read-only external verification; R0 evidence artifact',environment:'macstudio3; public Momentum bundle and vendor search API',build_identity:git(project,'rev-parse','HEAD'),key_digest:{last4:key.slice(-4),sha256_prefix:crypto.createHash('sha256').update(key).digest('hex').slice(0,12)},commands:['node /tmp/tk11415-verify.mjs','git show / remote / ls-files / check-ignore / log','node --check (3 files)','Python in-memory compile (3 files)','node --test meilisearch-client.test.mjs'],assertions,limitations:['GET /keys denial does not prove absence of every write permission; no write probes were attempted.','No configured remotes establishes current configuration, not historical absence of pushes.','Snapshot containment is checked by file tracking, ignore, and path history; no new whole-disk scan was run.'],cleanup:'No vendor state changes, credential rotation, deletion, routing, publish, or push. Only redacted local evidence retained.',rollback:'Evidence is additive; no operational rollback required.',verdict:assertions.every(x=>x.verdict==='PASS')?'PASS':'FAIL'};
fs.writeFileSync('/tmp/tk11415-e2e-proof.json',JSON.stringify(proof,null,2)+'\n');
console.log(JSON.stringify(proof,null,2));
process.exitCode=proof.verdict==='PASS'?0:1;