1:( set -Eeuo pipefail; export LC_ALL=C;  EXPECTED_HOST="Work"; EXPECTED_USER="ray";  APP="/home/ray/ARMOR/apps/shire-mobile"; PACKAGE="com.shire.mobile"; ADB="/home/ray/Android/Sdk/platform-tools/adb";  GRADLE="$APP/app/build.gradle.kts"; APK="$APP/app/build/outputs/apk/debug/app-debug.apk";  GATEWAY_SCRIPT="/usr/local/lib/shire-mobile-gateway/server.py"; GATEWAY_ENV="/etc/shire-mobile-gateway/mobile-gateway.env"; GATEWAY_SERVICE="shire-mobile-gateway.service";  SENTINEL_BRIDGE="/usr/local/lib/shire-sentinel/alert_bridge.py"; SENTINEL_CONFIG="/etc/shire-sentinel/alert-bridge.json";  BACKUP_ROOT="/SHiREVault/Backup/OSBackups"; STAMP="$(date -u +%Y%m%dT%H%M%SZ)"; EVIDENCE="$BACKUP_ROOT/SHIRE-MOBILE-SENTINEL-REPLAY-AUDIT-$STAMP"; WORK="$(mktemp -d /tmp/shire-mobile-replay-audit.XXXXXX)";  HISTORY_CAPTURE="$WORK/history.txt"; RECOVERED="$EVIDENCE/corrected-pixel-deployment-recovered.sh";  cleanup() {   rm -rf "$WORK"; };  trap cleanup EXIT;  echo "============================================================"; echo " SHiRE MOBILE — SENTINEL DEPLOYMENT REPLAY AUDIT"; echo " Recover and inspect only — nothing will be deployed"; echo "============================================================"; echo;  [[ "$(hostname)" == "$EXPECTED_HOST" ]] || {   echo "STOP: Run this on SHiRE MINI — hostname Work.";   exit 1; };  [[ "$(id -un)" == "$EXPECTED_USER" ]] || {   echo "STOP: Run this as user ray.";   exit 1; };  [[ -d "$APP" ]] || {   echo "STOP: SHiRE Mobile project is missing:";   echo "  $APP";   exit 1; };  [[ -f "$GRADLE" ]] || {   echo "STOP: SHiRE Mobile Gradle file is missing.";   exit 1; };  [[ -x "$ADB" ]] || {   echo "STOP: ADB is unavailable.";   exit 1; };  FSTYPE="$(
17:)";  echo; echo "Selected ADB device: $DEVICE"; echo "Model: $MODEL"; echo "Android: $ANDROID";  [[ "$MODEL" == "Pixel 9 Pro Fold" ]] || {   echo "STOP: The authorised device is not the expected Pixel 9 Pro Fold.";   exit 1; };  echo; echo "2. CURRENT MOBILE VERSION"; echo "------------------------------------------------------------";  echo "Project version:";  grep -E   'versionCode[[:space:]]*=|versionName[[:space:]]*='   "$GRADLE"   | tee "$EVIDENCE/project-version-before.txt";  echo; echo "Pixel version:";  "$ADB" -s "$DEVICE"   shell dumpsys package "$PACKAGE"   | grep -E     'versionCode=|versionName=|firstInstallTime=|lastUpdateTime='   | sed -n '1,12p'   | tee "$EVIDENCE/pixel-version-before.txt";  CURRENT_PROJECT_VERSION="$(
18:  sed -nE \
23:  sed -nE \
27:)";  echo; echo "Current project versionName: $CURRENT_PROJECT_VERSION"; echo "Current project versionCode: $CURRENT_PROJECT_CODE"; echo;  echo "3. RECOVER EXACT FAILED DEPLOYMENT FROM SHELL HISTORY"; echo "------------------------------------------------------------";  HISTTIMEFORMAT=; history > "$HISTORY_CAPTURE";  python3 -   "$HISTORY_CAPTURE"   "$RECOVERED" <<'PY'
105:  chmod 600 "$RECOVERED";  echo; echo "Recovered script:"; echo "  $RECOVERED";  echo "SHA-256:"; sha256sum "$RECOVERED"   | tee "$EVIDENCE/recovered-script.sha256";  echo; echo "4. VERIFY RECOVERED COMMAND IDENTITY"; echo "------------------------------------------------------------";  for REQUIRED_TEXT in   "SHIRE-MOBILE-SENTINEL-PIXEL-FIXED-"   "SentinelMobileAlerts.kt"   "/usr/local/lib/shire-mobile-gateway/server.py"   "/etc/shire-mobile-gateway/mobile-gateway.env"   "/usr/local/lib/shire-sentinel/alert_bridge.py"   "/etc/shire-sentinel/alert-bridge.json"   "CORRECTED SENTINEL PIXEL DEPLOYMENT"; do   grep -Fq "$REQUIRED_TEXT" "$RECOVERED" || {     echo "STOP: Recovered command is missing:";     echo "  $REQUIRED_TEXT";     exit 1;   }; done;  echo "Recovered command identity: PASS"; echo;  echo "5. AUDIT INTENDED VERSION"; echo "------------------------------------------------------------";  grep -nE   'versionCode|versionName|0\.7\.[0-9]|EXPECTED_VERSION'   "$RECOVERED"   | sed -n '1,120p'   | tee "$EVIDENCE/recovered-version-references.txt"   || true;  TARGET_VERSION="$(
106:  python3 - "$RECOVERED" <<'PY'
136:)";  echo; echo "Current project version: $CURRENT_PROJECT_VERSION"; echo "Recovered command target references: ${TARGET_VERSION:-not resolved}";  VERSION_SAFE="unknown";  if [[ -n "$TARGET_VERSION" ]]; then   if printf '%s\n' "$TARGET_VERSION"     | grep -Fq "$CURRENT_PROJECT_VERSION";   then     VERSION_SAFE="same";   else     VERSION_SAFE="different";   fi; fi;  echo "Recovered target matches current project: $VERSION_SAFE"; echo;  echo "6. AUDIT FILE AND SERVICE CHANGES"; echo "------------------------------------------------------------";  grep -nE   '(^|[[:space:]])(cat >|install |cp |mv |rm |sed |python3 |systemctl |adb .*install|gradlew|alert_bridge\.py)'   "$RECOVERED"   | sed -n '1,260p'   | tee "$EVIDENCE/recovered-change-outline.txt"   || true;  echo; echo "Rollback references:";  grep -nEi   'rollback|restore|previous token|PREVIOUS_TOKEN|previous Pixel|safe rollback'   "$RECOVERED"   | sed -n '1,180p'   | tee "$EVIDENCE/recovered-rollback-outline.txt"   || true;  echo; echo "7. CURRENT FILE STATE AFTER PRIOR ROLLBACK"; echo "------------------------------------------------------------";  FILES=(   "$APP/app/src/main/java/com/shire/mobile/MainActivity.kt"   "$APP/app/src/main/java/com/shire/mobile/SentinelMobileAlerts.kt"   "$APP/app/src/main/AndroidManifest.xml"   "$APP/app/build.gradle.kts"   "$APP/gradle.properties" );  for FILE in "${FILES[@]}"; do   if [[ -f "$FILE" ]]; then     printf 'PRESENT  ';     sha256sum "$FILE";   else     echo "ABSENT   $FILE";   fi; done   | tee "$EVIDENCE/current-mobile-files.txt";  echo; echo "Privileged runtime files:";  for FILE in   "$GATEWAY_SCRIPT"   "$GATEWAY_ENV"   "$SENTINEL_BRIDGE"   "$SENTINEL_CONFIG"; do   if sudo -n test -f "$FILE" 2>/dev/null; then     echo "PRESENT  $FILE";      if [[ "$FILE" == "$GATEWAY_ENV" ]]; then       echo "  Environment keys:";        sudo -n awk -F=         '/^[A-Za-z_][A-Za-z0-9_]*=/ {
138:        }'         "$FILE";     fi;   else     echo "ABSENT_OR_UNREADABLE  $FILE";   fi; done   | tee "$EVIDENCE/current-runtime-files.txt";  echo; echo "8. CURRENT SERVICE HEALTH — NO RESTART"; echo "------------------------------------------------------------";  for SERVICE in   "$GATEWAY_SERVICE"   shire-sentinel-alert.service   shire-sentinel-suricata.service   tailscaled.service; do   printf '%-42s %s\n'     "$SERVICE"     "$(systemctl is-active "$SERVICE" 2>/dev/null || true)"; done   | tee "$EVIDENCE/service-state.txt";  echo; echo "9. CURRENT APK STATE"; echo "------------------------------------------------------------";  if [[ -f "$APK" ]]; then   echo "APK present: YES";   echo "APK bytes: $(stat -c '%s' "$APK")";   sha256sum "$APK"     | tee "$EVIDENCE/current-apk.sha256"; else   echo "APK present: NO"; fi;  echo; echo "10. PRESERVE AUDIT EVIDENCE"; echo "------------------------------------------------------------";  {   echo "audit=shire-mobile-sentinel-replay";   echo "captured_at_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)";   echo "host=$(hostname)";   echo "user=$(id -un)";   echo "pixel_device=$DEVICE";   echo "pixel_model=$MODEL";   echo "current_version_name=$CURRENT_PROJECT_VERSION";   echo "current_version_code=$CURRENT_PROJECT_CODE";   echo "recovered_target_versions=${TARGET_VERSION:-unresolved}";   echo "target_matches_current=$VERSION_SAFE";   echo "deployment_executed=no";   echo "mobile_source_changed=no";   echo "gateway_changed=no";   echo "sentinel_changed=no";   echo "pixel_app_changed=no";   echo "services_restarted=no"; } > "$EVIDENCE/audit-result.txt";  MANIFEST_TEMP="$(mktemp)";  find "$EVIDENCE"   -type f   ! -path "$EVIDENCE/SHA256SUMS.txt"   -print0   | sort -z   | xargs -0 sha256sum   > "$MANIFEST_TEMP";  install   -m 0600   "$MANIFEST_TEMP"   "$EVIDENCE/SHA256SUMS.txt";  rm -f "$MANIFEST_TEMP";  (   cd /;   sha256sum -c     "$EVIDENCE/SHA256SUMS.txt"     >/dev/null; );  echo "Evidence verification: PASS"; echo; echo "============================================================"; echo " SENTINEL DEPLOYMENT REPLAY AUDIT — COMPLETE"; echo "============================================================"; echo; echo "Recovered command:"; echo "  $RECOVERED"; echo; echo "Current SHiRE Mobile:"; echo "  versionName=$CURRENT_PROJECT_VERSION"; echo "  versionCode=$CURRENT_PROJECT_CODE"; echo; echo "Recovered target:"; echo "  ${TARGET_VERSION:-UNRESOLVED}"; echo; echo "TARGET_MATCHES_CURRENT=$VERSION_SAFE"; echo "PIXEL_ADB_READY=YES"; echo "DEPLOYMENT_EXECUTED=NO"; echo "SOURCE_CHANGED=NO"; echo "SERVICES_RESTARTED=NO"; echo "NEXT_STAGE_READY=YES"; echo "============================================================"; )