feat: ship hitridge-business-o1 v0.1.0 — signed depo package + toolchain

- package: manifest v1.0 (schema, package_id, layers: odoo_modules/agents/docs/config/brain) - agents: 4 neutral cards + prompts (sellers-recruiter, test-operator, closer, compliance) no script.run in v0.1.0; odoo.* + file.* primitives only - modules: aura_business_core + hitridge_venture_o1 stubs (menus, ACLs, models) - docs: playbook, test-checklist, price-guide-starter, agreement-template.odt - config: channels (olx-bg/forums-local), pricing-rules (BGN, A/B/C/reject, drop ladder) - brain: empty-seed capability contract + seeds README (memories never ship) - toolchain: depo-sign.sh (ed25519, PEM+raw), validate-depo.sh (schema/files/cards/tools/ secrets/sig gates -> writes VALIDATE), tool-registry.json - install.sh: target-side verify (hash + ed25519 + layer files); install is phase 2 - public-keys/depo-signing.pub committed (private key stays out of repo) - VALIDATE: PASS (signed + verified, tamper-rejection tested)
2026-08-03 21:00:07 +03:00
parent e2f76e4027
commit cb5e5dacef
32 changed files with 918 additions and 0 deletions
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# O1 target-side verifier + installer (pull model, per manifest-spec v1.0).
+# Runs ON THE TARGET. Nothing is deployed unless signature + verify pass.
+#
+# Usage:
+#   install.sh --check            # verify signature + hash + package integrity only
+#   install.sh --install          # full install (phase 2: enabled on Aura tower)
+set -euo pipefail
+
+PKG_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+MANIFEST="$PKG_ROOT/manifest.json"
+PUBKEY="${DEPO_PUBKEY:-/etc/depo/depo-signing.pub}"
+
+say()  { printf '\033[1;32m[install]\033[0m %s\n' "$*"; }
+die()  { printf '\033[1;31m[install FAIL]\033[0m %s\n' "$*" >&2; exit 1; }
+
+[ -f "$MANIFEST" ] || die "manifest.json missing at $PKG_ROOT"
+
+verify_signature() {
+    [ -f "$PUBKEY" ] || die "signing pubkey not found at $PUBKEY (set DEPO_PUBKEY)"
+    [ -f "$MANIFEST.sig" ] || die "no signature (.sig) — refusal per spec: No signature = refuse"
+    [ -f "$MANIFEST.sha256" ] || die "no manifest.sha256 — refusal per spec"
+    local got want
+    got="$(sha256sum "$MANIFEST" | cut -d' ' -f1)"
+    want="$(cat "$MANIFEST.sha256")"
+    [ "$got" = "$want" ] || die "hash mismatch: manifest was modified after signing"
+    python3 - "$PUBKEY" "$MANIFEST.sig" "$MANIFEST" <<'PY' || die "ed25519 signature verification failed"
+import base64, hashlib, sys
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+pub_path, sig_path, manifest_path = sys.argv[1], sys.argv[2], sys.argv[3]
+pub = Ed25519PublicKey.from_public_bytes(open(pub_path, "rb").read())
+sig = base64.b64decode(open(sig_path, "rb").read())
+data = open(manifest_path, "rb").read()
+pub.verify(sig, data)
+print("ed25519 OK")
+PY
+    say "signature verified"
+}
+
+run_verify() {
+    verify_signature
+    python3 - "$MANIFEST" <<'PY' || die "install.verify checklist failed"
+import json, os, sys
+m = json.load(open(sys.argv[1]))
+root = os.path.dirname(os.path.abspath(sys.argv[1]))
+missing = []
+for layer, files in m["layers"].items():
+    for f in files:
+        if layer == "odoo_modules":
+            p = os.path.join(root, "modules", f, "__manifest__.py")
+        elif layer == "agents":
+            p = os.path.join(root, "agents", f + ".json")
+        else:
+            p = os.path.join(root, f)
+        if not os.path.exists(p):
+            missing.append(f)
+if missing:
+    print("MISSING LAYER FILES:", missing)
+    sys.exit(1)
+print("all layer files present:", sum(len(v) for v in m["layers"].values()))
+PY
+    say "verify checklist passed"
+}
+
+case "${1:---check}" in
+    --check)
+        run_verify
+        ;;
+    --install)
+        run_verify
+        die "install is phase 2 (target: Aura tower Odoo). Nothing was deployed."
+        ;;
+    *)
+        die "usage: $0 [--check|--install]"
+        ;;
+esac