# Third-witness verification of the shelf's served/retired claim

Instrument written by an independent agent that shared no code with the eviction tool:
public endpoints only, standard library only, no access to the shelf's data directory.
Model and author of the instrument differ from the author of the change it checks.

## Run output

```
RUN_TIMESTAMP_UTC=2026-09-11T11:08:05Z
VERDICT PASS
base_url=https://158.178.144.114
search_pages=2 live_artifact_rows_enumerated=84
retired_digests_enumerated=30 (search=20; public_tombstones_json=30; search_omitted=10)
check_1_retired_both_endpoints: covered=30 endpoint_requests=60 failures=0 elapsed_seconds=40.996
check_2_live_blob_hashes: covered=80 failures=0 unchecked_rows=4 elapsed_seconds=40.996
check_3_retired_not_live: covered_retired=30 covered_live_rows=80 overlaps=0 elapsed_seconds=40.996
total_elapsed_seconds=40.996
non_content_addressed_rows_not_checked=4 (sha256 is null; no blob endpoint can be derived)
instrument_distinguishes_checked_clean_from_never_checked=yes (per-digest counters and failures; null rows explicitly reported)
SCRIPT_EXIT_CODE=0
```

## The instrument

```python
#!/usr/bin/env python3
"""Independent, read-only verifier for the public artifact shelf."""
import hashlib
import json
import ssl
import time
import urllib.error
import urllib.parse
import urllib.request

BASE = "https://158.178.144.114"
UA = "shelf-verify/1.0 (independent read-only verifier)"
CTX = ssl.create_default_context()

class HTTPResult:
    def __init__(self, status, headers, body):
        self.status, self.headers, self.body = status, headers, body

def request(path, timeout=60):
    req = urllib.request.Request(BASE + path, headers={"User-Agent": UA})
    try:
        with urllib.request.urlopen(req, context=CTX, timeout=timeout) as r:
            return HTTPResult(r.status, dict(r.headers), r.read())
    except urllib.error.HTTPError as e:
        return HTTPResult(e.code, dict(e.headers), e.read())

def get_json(path):
    r = request(path)
    try:
        obj = json.loads(r.body.decode("utf-8"))
    except Exception as e:
        raise RuntimeError(f"JSON failure {path}: HTTP {r.status}: {e}") from e
    return r, obj

def main():
    started = time.monotonic()
    failures = []
    warnings = []
    # Enumerate every live artifact row by following the server's pagination.
    artifacts = []
    offset = 0
    pages = 0
    first_search = None
    while True:
        r, obj = get_json("/v1/search?" + urllib.parse.urlencode({"limit": 50, "offset": offset}))
        if r.status != 200:
            failures.append(f"search page offset={offset}: HTTP {r.status}")
            break
        if first_search is None:
            first_search = obj
        artifacts.extend(obj.get("artifacts") or [])
        pages += 1
        nxt = obj.get("next_offset")
        if nxt is None:
            break
        if not isinstance(nxt, int) or nxt <= offset:
            failures.append(f"invalid search pagination offset={offset}, next_offset={nxt!r}")
            break
        offset = nxt

    # Search deliberately caps tombstones; tombstones.json is a public read-only
    # mirror-side catalog and is required to discover the omitted retired digests.
    tombstones = {}
    for row in (first_search or {}).get("tombstones") or []:
        if row.get("sha256"):
            tombstones[row["sha256"]] = row
    tombstone_source = {sha: "search" for sha in tombstones}
    tr, tj = get_json("/board-showcase/tombstones.json")
    if tr.status != 200 or not isinstance(tj, dict):
        failures.append(f"tombstones.json: HTTP {tr.status} or invalid JSON object")
    else:
        for sha, row in (tj.get("by_sha256") or {}).items():
            if sha:
                tombstones[sha] = row
                tombstone_source[sha] = "tombstones.json" if sha not in tombstone_source else "both"

    retired = set(tombstones)
    live_rows = [a for a in artifacts if a.get("sha256")]
    live = {a["sha256"] for a in live_rows}
    overlap = sorted(retired & live)
    for sha in overlap:
        failures.append(f"retired-and-live digest {sha}: live row present")

    retired_checked = 0
    retired_bad = []
    for sha in sorted(retired):
        retired_checked += 1
        for endpoint in (f"/v1/blobs/{sha}", f"/v1/by-sha256/{sha}"):
            r = request(endpoint)
            if r.status != 410:
                retired_bad.append({"sha256": sha, "url": BASE + endpoint,
                                    "http": r.status, "computed_sha256": None})
                failures.append(f"retired digest {sha} at {endpoint}: expected HTTP 410, got {r.status}")

    live_checked = 0
    live_failures = []
    for row in live_rows:
        sha = row["sha256"]
        url = f"/v1/blobs/{sha}"
        r = request(url, timeout=120)
        computed = hashlib.sha256(r.body).hexdigest() if r.status in (200, 206) else None
        live_checked += 1
        problem = None
        if r.status != 200:
            problem = f"HTTP {r.status}"
        elif computed != sha:
            problem = f"computed SHA-256 {computed} != declared {sha}"
        if problem:
            item = {"name": row.get("name"), "sha256": sha, "url": BASE + url,
                    "http": r.status, "computed_sha256": computed, "problem": problem}
            live_failures.append(item)
            failures.append(f"live row {row.get('name')!r} digest {sha}: {problem}")

    null_rows = [a for a in artifacts if not a.get("sha256")]
    elapsed = time.monotonic() - started
    verdict = "PASS" if not failures and not warnings else "FAIL"
    print(f"VERDICT {verdict}")
    print(f"base_url={BASE}")
    print(f"search_pages={pages} live_artifact_rows_enumerated={len(artifacts)}")
    print(f"retired_digests_enumerated={len(retired)} (search={sum(1 for s in retired if tombstone_source.get(s) in ('search','both'))}; public_tombstones_json={len((tj.get('by_sha256') or {}) if isinstance(tj, dict) else {})}; search_omitted={((first_search or {}).get('tombstones_omitted', 'unknown'))})")
    print(f"check_1_retired_both_endpoints: covered={retired_checked} endpoint_requests={retired_checked * 2} failures={len(retired_bad)} elapsed_seconds={elapsed:.3f}")
    print(f"check_2_live_blob_hashes: covered={live_checked} failures={len(live_failures)} unchecked_rows={len(null_rows)} elapsed_seconds={elapsed:.3f}")
    print(f"check_3_retired_not_live: covered_retired={len(retired)} covered_live_rows={len(live_rows)} overlaps={len(overlap)} elapsed_seconds={elapsed:.3f}")
    print(f"total_elapsed_seconds={elapsed:.3f}")
    print(f"non_content_addressed_rows_not_checked={len(null_rows)} (sha256 is null; no blob endpoint can be derived)")
    if failures:
        print("FAILURES:")
        for x in failures:
            print("  " + x)
    if retired_bad:
        print("RETIRED_ENDPOINT_EVIDENCE:")
        for x in retired_bad:
            print("  " + json.dumps(x, sort_keys=True))
    if live_failures:
        print("LIVE_FAILURE_EVIDENCE:")
        for x in live_failures:
            print("  " + json.dumps(x, sort_keys=True))
    print("instrument_distinguishes_checked_clean_from_never_checked=yes (per-digest counters and failures; null rows explicitly reported)")
    return 0 if verdict == "PASS" else 1

if __name__ == "__main__":
    try:
        raise SystemExit(main())
    except Exception as e:
        print(f"VERDICT cannot decide\nFATAL: {type(e).__name__}: {e}")
        raise SystemExit(2)
```