# Vaultfire V3 partner-review tooling

This checksummed post-tag tooling bundle contains the read-only orchestration
needed to verify the exact public V3 source release. It does not modify the
frozen candidate, deploy contracts, contact wallets, submit payments, enable
V3 routes, or sign the pending owner delegation.

## Contents

- `partner-review.sh`: clean-checkout orchestration for exact Git identity,
  attestations, source verification, PR7, SDK, V2 compatibility, OpenAPI,
  JSON Schema, sandbox, release-discovery, and fail-closed gate checks.
- `verify-v3-expanded.py`: content-only verifier for the expanded source
  archive when Git metadata is unavailable.
- `vaultfire-v3-source-2026-08-27-expanded.files.sha256`: complete file
  manifest for the expanded archive.
- `SHA256SUMS`: hashes for every file inside this tooling bundle.

## Verify and install into an exact public checkout

From the directory containing the downloaded tooling archive:

```bash
sha256sum --check SHA256SUMS
mkdir vaultfire-v3-review-tooling
tar -xzf vaultfire-v3-review-tooling.tar.gz \
  --strip-components=1 \
  -C vaultfire-v3-review-tooling
(cd vaultfire-v3-review-tooling && sha256sum --check SHA256SUMS)

cd /path/to/exact/public/vaultfire-checkout
install -m 0755 \
  /path/to/vaultfire-v3-review-tooling/partner-review.sh \
  scripts/partner-review.sh
install -m 0755 \
  /path/to/vaultfire-v3-review-tooling/verify-v3-expanded.py \
  scripts/verify-v3-expanded.py
```

If the exact public checkout already contains these scripts, compare them
before running:

```bash
cmp scripts/partner-review.sh \
  /path/to/vaultfire-v3-review-tooling/partner-review.sh
cmp scripts/verify-v3-expanded.py \
  /path/to/vaultfire-v3-review-tooling/verify-v3-expanded.py
```

Run the review from a clean checkout. The default result directory is outside
the checkout so the command does not dirty the reviewed worktree:

```bash
./scripts/partner-review.sh
```

To choose a durable result directory:

```bash
PARTNER_REVIEW_OUTPUT_DIR=/absolute/path/to/results \
  ./scripts/partner-review.sh
```

The command emits a machine-readable `result.json`, a concise `summary.txt`,
and one retained log per check. Heavy Forge, native Solana/SBF,
local-validator, and fork gates are opt-in and are never represented as run
when unavailable.

## Trust boundary

Checksums establish byte equality with the published manifests. They are not
an owner signature. The source tag and attestation commit are unsigned, and
the owner delegation must remain `awaiting_owner_signature`.