From cfb0435d9662ee0e8081e922dfa63c5c31e6d936 Mon Sep 17 00:00:00 2001
From: funman300 <funman300@gmail.com>
Date: Tue, 11 Aug 2026 05:03:47 +0000
Subject: [PATCH] redirector.sh: verify the RUNNING process's commit, not just
 the binary on disk

`verify` inspects `$BIN --identity`, which is the file on disk. That is not
necessarily what is serving. Caught during gate 14 setup: the live process had
been started from 5bc39e9, then `cargo test` re-ran build.rs (the branch ref
moved when an unrelated script was committed) and restamped the on-disk binary
to fc411bb. `verify` then reported "build identity OK" about an artifact that
was not the running service.

`start` now records the stamped commit to $RUNDIR/redirector.commit, and
`verify-running` compares THAT against HEAD, refusing when they differ. The
existing on-disk check stays -- it is the right gate for "may I start this" --
but only the recorded stamp answers "is the thing currently serving the thing I
think it is", which is the question a live gate's evidence depends on.
---
 openfut-redirector-host/redirector.sh | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/openfut-redirector-host/redirector.sh b/openfut-redirector-host/redirector.sh
index 8f686cd..ee13ddd 100755
--- a/openfut-redirector-host/redirector.sh
+++ b/openfut-redirector-host/redirector.sh
@@ -17,6 +17,10 @@ ROOT="$(cd "$HERE/.." && pwd)"
 RUNDIR="${OPENFUT_REDIRECTOR_RUNDIR:-${TMPDIR:-/tmp}/openfut-redirector}"
 PIDFILE="$RUNDIR/redirector.pid"
 PORTFILE="$RUNDIR/redirector.port"
+# Commit the RUNNING process was started from. `verify` alone inspects the
+# on-disk binary, which a rebuild (even `cargo test`, which re-runs build.rs
+# when the branch ref moves) can silently advance past the live process.
+STAMPFILE="$RUNDIR/redirector.commit"
 LOGFILE="${OPENFUT_REDIRECTOR_LOG:-$RUNDIR/redirector.log}"
 BIN="$ROOT/target/debug/openfut-redirector-host"
 [[ -x "$BIN" ]] || BIN="$ROOT/target/release/openfut-redirector-host"
@@ -56,6 +60,7 @@ cmd_start() {
   cmd_verify || die "build identity check failed — refusing to start"
 
   mkdir -p "$RUNDIR"; echo "$OPENFUT_REDIRECTOR_HOST_PORT" > "$PORTFILE"
+  stamped_commit > "$STAMPFILE"
   "$BIN" >"$LOGFILE" 2>&1 &
   local pid=$!; echo "$pid" > "$PIDFILE"
   local w=0
@@ -102,10 +107,23 @@ cmd_status() {
   return 0
 }
 
+cmd_verify_running() {
+  [[ -f "$STAMPFILE" ]] || die "no running-process stamp — was it started by this script?"
+  local running head
+  running="$(cat "$STAMPFILE")"; head="$(git -C "$ROOT" rev-parse --short=7 HEAD 2>/dev/null)"
+  if [[ "$running" != "$head" ]]; then
+    echo "REFUSING: the RUNNING process was started from $running but HEAD is $head" >&2
+    echo "  Restart before treating this run as evidence." >&2
+    return 1
+  fi
+  echo "running-process identity OK: started from $running == HEAD"
+}
+
 case "${1:-}" in
   start)  cmd_start ;;
   stop)   cmd_stop ;;
   status) cmd_status ;;
   verify) cmd_verify ;;
+  verify-running) cmd_verify_running ;;
   *) sed -n '2,6p' "$0" | sed 's/^# \?//'; exit 2 ;;
 esac