#!/bin/sh
# ─────────────────────────────────────────────────────────────────────────────
# MIZAN · verify a credential on YOUR machine, trusting nobody.
#
# This downloads a small source-available verifier and a real MIZAN credential,
# then re-checks the credential against YOUR own copy of the public data. Every
# check is recomputed locally — nothing is trusted. The strategy stays hidden.
#
# Read this whole script before running it — that is the entire point.
# Run:   sh verify.sh      (macOS, Apple Silicon)
# ─────────────────────────────────────────────────────────────────────────────
set -e
BASE="https://mizan.market/verify/files"
DIR="mizan-verify"
mkdir -p "$DIR" && cd "$DIR"

echo "→ downloading the verifier, a real credential, and the canonical data…"
curl -fsSL -o verifier    "$BASE/mizan-verifier-v10-macos-arm64"
curl -fsSL -o cred.bundle "$BASE/mizan_blackbox_fractional.bundle"
curl -fsSL -o aux.json    "$BASE/mizan_blackbox_fractional_parts.json"
curl -fsSL -o track.json  "$BASE/mizan_blackbox_fractional_track_head.json"
curl -fsSL -o btc_4h.csv  "$BASE/btc_4h.csv"

chmod +x verifier
xattr -d com.apple.quarantine verifier 2>/dev/null || true   # clear Gatekeeper on the unsigned binary

echo "→ pin the verifier by its published fingerprint (optional but recommended):"
echo "    your copy: $(shasum -a 256 verifier | cut -d' ' -f1)"
echo "    compare to the SHA-256 published at mizan.market/verify"
echo ""
echo "→ verifying — YOUR machine does the math, MIZAN is not involved:"
echo ""
./verifier cred.bundle btc_4h.csv --aux aux.json --track track.json