From 9d2bfe3ae402910812468cdc9971a955152bcfb5 Mon Sep 17 00:00:00 2001
From: root <root@srv1522135.hstgr.cloud>
Date: Sat, 29 Aug 2026 19:08:42 +0000
Subject: [PATCH] =?UTF-8?q?CP2A2:=20verify-recovery-gold-image=20PATH-NORM?=
 =?UTF-8?q?ALIZATION-FIX=20(Image-Manifest=20app/-Pr=C3=A4fix,=20Container?=
 =?UTF-8?q?-Pfad=20/app/app)=20+=20Critical-File-Pfadfix?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../control-plane/cp2a2_2b/rq-historical        | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/red-queen-architecture/control-plane/cp2a2_2b/rq-historical b/red-queen-architecture/control-plane/cp2a2_2b/rq-historical
index 4a60d25..8e92741 100644
--- a/red-queen-architecture/control-plane/cp2a2_2b/rq-historical
+++ b/red-queen-architecture/control-plane/cp2a2_2b/rq-historical
@@ -459,16 +459,17 @@ verify_critical_files() {
   local base_dir="${1:-}"
   local img_shas=""
   if [ -n "$base_dir" ]; then
-    # Recovery-Image-SHAs aus kopiertem Tree
+    # Recovery-Image-SHAs aus kopiertem Tree. Der Tree ist prefixlos (docker cp
+    # von /app/app), daher wird der app/-Präfix aus CRITICAL_PATH entfernt.
     for k in "${!CRITICAL_SHA[@]}"; do
-      path="app/${CRITICAL_PATH[$k]#app/}"
+      path="${CRITICAL_PATH[$k]#app/}"
       [ -f "$base_dir/$path" ] && img_shas="$img_shas $k:$(sha256sum "$base_dir/$path" | awk '{print $1}')" || img_shas="$img_shas $k:MISSING"
     done
   fi
   local allok=1
   for k in "${!CRITICAL_SHA[@]}"; do
-    path="app/${CRITICAL_PATH[$k]#app/}"
-    csha="$(docker exec "$HISTORICAL_SERVICE" sha256sum "/$path" 2>/dev/null | awk '{print $1}')" || csha="MISSING"
+    # Container-Pfad: Code liegt im Container unter /app/app/<rel> (docker cp von /app/app)
+    csha="$(docker exec "$HISTORICAL_SERVICE" sha256sum "/app/app/${CRITICAL_PATH[$k]#app/}" 2>/dev/null | awk '{print $1}')" || csha="MISSING"
     gold="${CRITICAL_SHA[$k]}"
     img="MISSING"
     if [ -n "$base_dir" ]; then
@@ -557,10 +558,14 @@ verify_recovery_gold_image() {
   docker create --name "$tmpc" --entrypoint /bin/true "$RECOVERY_REBUILD_TAG" >/dev/null 2>&1 || die "verify: Temp-Container Fehler (FAIL CLOSED)"
   docker cp "$tmpc:/app/app" "$tmpdir/appapp" >/dev/null 2>&1 || { docker rm -f "$tmpc" >/dev/null 2>&1; rm -rf "$tmpdir"; die "verify: /app/app nicht lesbar (FAIL CLOSED)"; }
   docker rm -f "$tmpc" >/dev/null 2>&1 || true
-  # Manifest aus kopiertem Recovery-Image-Tree gegen Gold-Manifest
+  # Manifest aus kopiertem Recovery-Image-Tree gegen Gold-Manifest.
+  # KANONISCHER NAMESPACE: Image-Manifest wird mit app/-Präfix erzeugt, damit es
+  # dem konservierten GOLD_MANIFEST (app/...) entspricht. Der kopierte Tree liegt
+  # unter $tmpdir/appapp und enthaelt die Dateien prefixlos (run_backfill_year.py,
+  # trust/trust_gate.py) -> hier wird app/ vorangestellt. KEINE Inhaltsnormalisierung.
   tmpf="$(mktemp)"
   ( cd "$tmpdir/appapp" && find . -type f -name '*.py' ! -path '*/__pycache__/*' -printf '%P\n' 2>/dev/null | sort \
-      | while IFS= read -r rel; do [ -f "$rel" ] && sha256sum "$rel"; done | sed 's#  ./#  #' ) > "$tmpf"
+      | while IFS= read -r rel; do [ -f "$rel" ] && sha256sum "$rel"; done | awk '{print $1"  app/"$2}' ) > "$tmpf"
   classify_and_report "$tmpf"
   gret="$G_RET"; rm -f "$tmpf"
   if [ "$gret" != "ok" ]; then