#!/bin/sh
# JYOTINT — one-command independent verification.
# 100% READ-ONLY and SAFE: it only downloads JYOTINT's PUBLIC files and recomputes
# SHA-256 hashes locally with a zero-dependency Node script. No secrets, no writes
# outside this folder, no network calls except fetching the public artifacts below.
# Requires: curl + node (v18+). Run it anywhere — an air-gapped box is fine after the fetch.
set -eu
BASE="https://jyotishintelligence.com"
echo "→ fetching public, CC-BY artifacts from $BASE ..."
curl -fsSL "$BASE/seal-manifest.json"      -o seal-manifest.json
curl -fsSL "$BASE/seal-manifest.json.ots"  -o seal-manifest.json.ots
curl -fsSL "$BASE/grading-ledger.json"     -o grading-ledger.json
curl -fsSL "$BASE/calibration.json"        -o calibration.json
curl -fsSL "$BASE/verify-jyotint.mjs"      -o verify-jyotint.mjs
echo "→ recomputing every seal hash + checking the .ots proof commits to this file's bytes (digest-inclusion; run 'ots verify' for Bitcoin block confirmation) ..."
node verify-jyotint.mjs --manifest seal-manifest.json --ots seal-manifest.json.ots
echo ""
echo "Expected values, RECOMPUTED from the files you just fetched (never hardcoded, so never stale):"
node -e 'const m=require("./seal-manifest.json"),l=require("./grading-ledger.json");const c={};for(const e of l.entries)c[e.outcome]=(c[e.outcome]||0)+1;const order=["HIT","MISS","NEAR","PARTIAL"];console.log("  manifestHash = "+m.manifestHash);console.log("  "+m.count+" sealed / "+l.count+" graded · "+order.filter(k=>c[k]).map(k=>c[k]+" "+k).join(" / ")+" · Brier "+l.brier)'
echo "The verifier exits NON-ZERO on any drift. Draw your own conclusion."
echo ""
echo "NOTE: the record is LIVE and append-only. If a publication cited a SMALLER count or an older Brier, that is EXPECTED (calls were sealed since) — resolve the paper's exact cited state at $BASE/dataset/record-versions.json (look up by record count or hash) and recompute its immutable snapshot."