/100-phase-pack

Phase 4: PACK

**Goal:** Bundle all artifacts into a self-contained, verifiable proof package (schema v4.8) with embedded artifact contents.

Step 4.0: Transition contract status to completed

Transition the contract status from `active` to `completed` and record the `completedAt` timestamp:

source lib/contract-dir.sh 2>/dev/null || true
ARTIFACT_ROOT="$(active_artifact_root 2>/dev/null || echo .signum/)"
CONTRACT_PATH="${ARTIFACT_ROOT}contract.json"
CONTRACT_TMP_PATH="${CONTRACT_PATH%.json}-tmp.json"
COMPLETED_TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
jq --arg ts "$COMPLETED_TS" \
  '.status = "completed" | .timestamps.completedAt = $ts' \
  "$CONTRACT_PATH" > "$CONTRACT_TMP_PATH" && \
  mv "$CONTRACT_TMP_PATH" "$CONTRACT_PATH"
echo "Contract status: active → completed at $COMPLETED_TS"

Step 4.0.5: PROOFPACK_REUSE_SUMMARY

When Codebase Awareness is enabled, summarize run-scoped reuse evidence for PACK. This packages existing evidence only; it does not change the audit decision.

source lib/contract-dir.sh 2>/dev/null || true
ARTIFACT_ROOT="$(active_artifact_root 2>/dev/null || echo .signum/)"

CONTRACT_PATH="${ARTIFACT_ROOT}contract.json"
IMPLEMENTATION_CONTEXT_PATH="${ARTIFACT_ROOT}implementation_context.json"
REUSE_CANDIDATES_PATH="${ARTIFACT_ROOT}reuse_candidates.json"
REUSE_DECISION_PATH="${ARTIFACT_ROOT}reuse_decision.json"
DUPLICATE_SCAN_PATH="${ARTIFACT_ROOT}duplicate_scan.json"
AUDIT_SUMMARY_PATH="${ARTIFACT_ROOT}audit_summary.json"
REUSE_SUMMARY_PATH="${ARTIFACT_ROOT}reuse_summary.json"

_POLICY_CODEBASE_MODE=""
if [ -f ".signum/policy.toml" ]; then
  _POLICY_CODEBASE_MODE=$(python3 - ".signum/policy.toml" <<'PY' 2>/dev/null || true
import re
import sys

mode = ""
try:
    text = open(sys.argv[1], encoding="utf-8").read()
except OSError:
    text = ""

match = re.search(r"^\[codebase_awareness\]\s*(.*?)(?=^\[|\Z)", text, re.MULTILINE | re.DOTALL)
if match:
    for raw in match.group(1).splitlines():
        line = raw.split("#", 1)[0].strip()
        if "=" not in line:
            continue
        key, _, value = line.partition("=")
        if key.strip() == "mode":
            mode = value.strip().strip('"').strip("'")

print(mode)
PY
)
fi

CODEBASE_AWARENESS_MODE="${SIGNUM_CODEBASE_AWARENESS:-${_POLICY_CODEBASE_MODE:-off}}"
case "$CODEBASE_AWARENESS_MODE" in
  off|hint|warn|gate)
    ;;
  *)
    echo "WARNING: invalid SIGNUM_CODEBASE_AWARENESS '$CODEBASE_AWARENESS_MODE'; using off"
    CODEBASE_AWARENESS_MODE="off"
    ;;
esac
export SIGNUM_CODEBASE_AWARENESS="$CODEBASE_AWARENESS_MODE"

if [ "$CODEBASE_AWARENESS_MODE" = "off" ]; then
  echo "PROOFPACK_REUSE_SUMMARY: skipped (Codebase Awareness off)"
else
  rm -f "$REUSE_SUMMARY_PATH"
  if [ "$CODEBASE_AWARENESS_MODE" = "hint" ] \
    && [ ! -f "$IMPLEMENTATION_CONTEXT_PATH" ] \
    && [ ! -f "$REUSE_CANDIDATES_PATH" ] \
    && [ ! -f "$REUSE_DECISION_PATH" ] \
    && [ ! -f "$DUPLICATE_SCAN_PATH" ]; then
    echo "PROOFPACK_REUSE_SUMMARY: skipped (no Codebase Awareness artifacts found)"
  else
    echo "PROOFPACK_REUSE_SUMMARY: mode=$CODEBASE_AWARENESS_MODE output=$REUSE_SUMMARY_PATH"
    set +e
    python3 scripts/build_reuse_summary.py \
      --project-root . \
      --contract "$CONTRACT_PATH" \
      --implementation-context "$IMPLEMENTATION_CONTEXT_PATH" \
      --reuse-candidates "$REUSE_CANDIDATES_PATH" \
      --reuse-decision "$REUSE_DECISION_PATH" \
      --duplicate-scan "$DUPLICATE_SCAN_PATH" \
      --audit-summary "$AUDIT_SUMMARY_PATH" \
      --output "$REUSE_SUMMARY_PATH" \
      --mode "$CODEBASE_AWARENESS_MODE"
    _REUSE_SUMMARY_STATUS=$?
    set -e

    if [ "$_REUSE_SUMMARY_STATUS" -eq 0 ]; then
      echo "PROOFPACK_REUSE_SUMMARY: wrote $REUSE_SUMMARY_PATH"
    elif [ "$CODEBASE_AWARENESS_MODE" = "gate" ]; then
      echo "ERROR: PROOFPACK_REUSE_SUMMARY failed in gate mode (exit=$_REUSE_SUMMARY_STATUS, output=$REUSE_SUMMARY_PATH)" >&2
      exit "$_REUSE_SUMMARY_STATUS"
    else
      echo "WARNING: PROOFPACK_REUSE_SUMMARY failed in $CODEBASE_AWARENESS_MODE mode (exit=$_REUSE_SUMMARY_STATUS, output=$REUSE_SUMMARY_PATH); continuing PACK" >&2
    fi
  fi
fi

Step 4.1: Collect metadata and build proofpack

Use the Bash tool:

# Cross-platform sha256 helper
if command -v sha256sum >/dev/null 2>&1; then
  HASH_CMD="sha256sum"
elif command -v shasum >/dev/null 2>&1; then
  HASH_CMD="shasum -a 256"
else
  echo "ERROR: no sha256 tool found"; exit 1
fi

hash_file() {
  local f="$1"
  [ -f "$f" ] || { echo "missing"; return; }
  $HASH_CMD "$f" | awk '{print $1}'
}

file_size() {
  local f="$1"
  [ -f "$f" ] || { echo "0"; return; }
  wc -c < "$f" | tr -d ' '
}

source lib/contract-dir.sh 2>/dev/null || true
ARTIFACT_ROOT="$(active_artifact_root 2>/dev/null || echo .signum/)"
CONTRACT_PATH="${ARTIFACT_ROOT}contract.json"
BASELINE_PATH="${ARTIFACT_ROOT}baseline.json"
COMBINED_PATCH_PATH="${ARTIFACT_ROOT}combined.patch"
EXECUTE_LOG_PATH="${ARTIFACT_ROOT}execute_log.json"
MECHANIC_REPORT_PATH="${ARTIFACT_ROOT}mechanic_report.json"
HOLDOUT_REPORT_PATH="${ARTIFACT_ROOT}holdout_report.json"
POLICY_SCAN_PATH="${ARTIFACT_ROOT}policy_scan.json"
AUDIT_SUMMARY_PATH="${ARTIFACT_ROOT}audit_summary.json"
APPROVAL_PATH="${ARTIFACT_ROOT}approval.json"
PROOFPACK_PATH="${ARTIFACT_ROOT}proofpack.json"
ANTI_ENTROPY_PATH="${ARTIFACT_ROOT}anti_entropy_report.json"
REUSE_SUMMARY_PATH="${ARTIFACT_ROOT}reuse_summary.json"
DUPLICATE_SCAN_PATH="${ARTIFACT_ROOT}duplicate_scan.json"
CONTRACT_HASH_PATH="${ARTIFACT_ROOT}contract-hash.txt"
EXECUTION_CONTEXT_PATH="${ARTIFACT_ROOT}execution_context.json"
AUDIT_ITERATION_LOG_PATH="${ARTIFACT_ROOT}audit_iteration_log.json"
REVIEWS_DIR="${ARTIFACT_ROOT}reviews"
RECEIPTS_EXEC_PATH="${ARTIFACT_ROOT}receipts/execute.json"

# Metadata
DECISION=$(jq -r '.decision' "$AUDIT_SUMMARY_PATH")
GOAL=$(jq -r '.goal' "$CONTRACT_PATH")
RISK=$(jq -r '.riskLevel' "$CONTRACT_PATH")
ATTEMPTS=$(jq -r '.totalAttempts' "$EXECUTE_LOG_PATH" 2>/dev/null || echo "unknown")
MECHANIC=$(