zeekay e7d26fa2dd submission: cut-submission.sh + check-high-assurance.sh ...

Mirror Pulsar's submission orchestration scripts adapted to Magnetar
specifics:

- scripts/cut-submission.sh: 8-step tarball cut. Verifies clean tree
  + branch=main, runs high-assurance gate, regenerates KATs via
  ref/go/cmd/genkat and verifies byte-identical with committed
  vectors/*.json, runs core tests, tars (excluding .git / .claude /
  bench/results), SHA-256s, tags. Idempotent (refuses tag/tarball
  re-cut unless --force). Dry-run mode for review.

- scripts/check-high-assurance.sh: per-push gate. Runs go build +
  go vet + secret-log grep + short test suite. HONEST about absent
  gates (no EC/Lean/Jasmin theories for threshold overlay; libjade
  covers FIPS 205 single-party but not redistributed). Honest scope
  documented in the script header; closure targets cross-referenced
  to CRYPTOGRAPHER-SIGN-OFF.md Gates section.

Tested: bash scripts/check-high-assurance.sh exits 0.

2026-05-19 08:03:28 -07:00

..

check-high-assurance.sh

submission: cut-submission.sh + check-high-assurance.sh

2026-05-19 08:03:28 -07:00

cut-submission.sh

submission: cut-submission.sh + check-high-assurance.sh

2026-05-19 08:03:28 -07:00