eac77ef7b4
Collection of operational skills for VaultMesh infrastructure including: - backup-sovereign: Backup and recovery operations - btc-anchor: Bitcoin anchoring - cloudflare-tunnel-manager: Cloudflare tunnel management - container-registry: Container registry operations - disaster-recovery: Disaster recovery procedures - dns-sovereign: DNS management - eth-anchor: Ethereum anchoring - gitea-bootstrap: Gitea setup and configuration - hetzner-bootstrap: Hetzner server provisioning - merkle-forest: Merkle tree operations - node-hardening: Node security hardening - operator-bootstrap: Operator initialization - proof-verifier: Cryptographic proof verification - rfc3161-anchor: RFC3161 timestamping - secrets-vault: Secrets management 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
59 lines
1.7 KiB
Markdown
59 lines
1.7 KiB
Markdown
---
|
|
name: merkle-forest
|
|
description: >
|
|
Build deterministic Merkle roots over files using BLAKE3, emit ROOT.txt and PROOF.json,
|
|
with plan/apply/rollback, verification, and audit report. Designed to feed rfc3161-anchor,
|
|
eth-anchor, and btc-anchor. Triggers: 'merkle root', 'build merkle tree', 'root.txt',
|
|
'proof receipt', 'hash artifacts'.
|
|
version: 1.0.0
|
|
---
|
|
|
|
# Merkle Forest (BLAKE3)
|
|
|
|
Computes:
|
|
- Leaf hashes: BLAKE3(file bytes)
|
|
- Merkle root: BLAKE3(left_hex || right_hex) up levels (duplicate last if odd)
|
|
- ROOT.txt + PROOF.json receipts
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
cd ~/.claude/skills/merkle-forest
|
|
|
|
export INPUT_DIR="$HOME/infrastructure" # or INPUT_FILES="a,b,c"
|
|
export LABEL="infra-snapshot"
|
|
export NODE_NAME="node-a"
|
|
|
|
./scripts/00_preflight.sh
|
|
./scripts/10_plan.sh
|
|
|
|
export DRY_RUN=0
|
|
./scripts/11_apply.sh
|
|
|
|
./scripts/90_verify.sh
|
|
./scripts/99_report.sh
|
|
```
|
|
|
|
## Inputs
|
|
|
|
| Parameter | Required | Default | Description |
|
|
|---|---:|---|---|
|
|
| INPUT_DIR | No | (empty) | Directory to hash recursively |
|
|
| INPUT_FILES | No | (empty) | Comma-separated file paths |
|
|
| EXCLUDES | No | .git,node_modules,target,dist,outputs | Exclude patterns |
|
|
| LABEL | No | snapshot | Run label |
|
|
| NODE_NAME | No | node-a | Node id |
|
|
| OUTPUT_DIR | No | outputs | Outputs base |
|
|
| DRY_RUN | No | 1 | Apply refuses unless DRY_RUN=0 |
|
|
| REQUIRE_CONFIRM | No | 1 | Require confirmation phrase |
|
|
| CONFIRM_PHRASE | No | I UNDERSTAND THIS WILL HASH FILES AND EMIT A ROOT | Safety phrase |
|
|
|
|
## Outputs
|
|
|
|
`outputs/runs/<node>_<label>_<timestamp>/`
|
|
- files.txt, leaf_hashes.txt, levels/, ROOT.txt, PROOF.json, status_matrix.json, audit_report.md
|
|
|
|
## EU Compliance
|
|
|
|
EU (Ireland - Dublin), Irish jurisdiction. Local-first proof artifacts.
|