{
  "report_info": {
    "version": "9.0.1",
    "generated_at": "2026-07-21T01:54:28Z",
    "binary_name": "integrity-check"
  },
  "binary": {
    "name": "integrity-check",
    "path": "/opt/kodachi/dashboard/hooks/integrity-check",
    "timestamp": "2026-07-21T01:54:28Z",
    "file_info": {
      "size": 3851168,
      "sha256": "d4f0ae3cfaeba5ec902650684891b6dfb134f9956ff7a8b8dc683aabe492400e"
    },
    "flag_n": {
      "command": "info",
      "data": {
        "author": "Warith Al Maawali",
        "copyright": "© 2026 Kodachi OS",
        "description": "A system integrity checker for verifying script and configuration files",
        "features": [
          "File integrity verification using SHA-256 hashes",
          "Cryptographic signature verification",
          "Version checking against remote repositories",
          "Configuration file validation",
          "Offline mode support",
          "Comprehensive logging and reporting"
        ],
        "license": "Proprietary",
        "name": "integrity-check",
        "securityFeatures": {
          "authentication": "Certificate pinning for secure connections",
          "encryption": "TLS 1.3 for all network communications",
          "inputValidation": "All inputs validated and sanitized",
          "rateLimiting": "Maximum 3 retries with configurable timeouts"
        },
        "systemRequirements": {
          "dependencies": [
            "OpenSSL",
            "curl"
          ],
          "os": "Linux (Debian-based)",
          "privileges": "sudo for 'generate', 'check-signatures' and 'check-all'. The read-only checks run as your normal user, but anything that writes into the install directory (the generated and remote hash manifests) needs write access to it"
        },
        "version": "9.8.4 (build 320)",
        "website": "https://digi77.com"
      },
      "errors": [],
      "metadata": {
        "executionTime": 0,
        "hostname": "REDACTED-BUILD-HOST",
        "user": "REDACTED-BUILD-USER"
      },
      "status": "success",
      "timestamp": "2026-07-21T01:54:28.159813459Z",
      "version": "9.8.4 (build 320)",
      "warnings": []
    },
    "flag_v": {
      "command": "version",
      "data": {
        "buildDate": "REDACTED-BUILD-TIME",
        "gitCommit": "unknown",
        "name": "integrity-check",
        "rustVersion": "1.82.0",
        "version": "9.8.4 (build 320)"
      },
      "errors": [],
      "metadata": {
        "executionTime": 0,
        "hostname": "REDACTED-BUILD-HOST",
        "user": "REDACTED-BUILD-USER"
      },
      "status": "success",
      "timestamp": "2026-07-21T01:54:28.259742539Z",
      "version": "9.8.4 (build 320)",
      "warnings": []
    },
    "flag_h": {
      "command": "help",
      "data": {
        "commandCategories": [
          {
            "category": "Integrity Operations",
            "commands": [
              {
                "description": "Verify file integrity for scripts, binaries, and configs",
                "examples": [
                  "integrity-check check-integrity",
                  "integrity-check check-integrity --json"
                ],
                "name": "check-integrity",
                "options": [
                  {
                    "description": "Run against a different install root instead of the detected one",
                    "flag": "--base-dir <DIR>"
                  },
                  {
                    "description": "Offline mode: compare against the cached local manifest, no remote fetch",
                    "flag": "--no-network"
                  },
                  {
                    "description": "Also fail on local-only files that are absent from the remote manifest",
                    "flag": "--strict"
                  },
                  {
                    "description": "Network timeout for fetching the remote manifest [default: 30]",
                    "flag": "--timeout <SECS>"
                  },
                  {
                    "description": "Retry attempts for the remote fetch, 1-20 [default: 3]",
                    "flag": "--retry <COUNT>"
                  },
                  {
                    "description": "Detail level 0-3 [default: 1]",
                    "flag": "-V, --verbosity <LEVEL>"
                  },
                  {
                    "description": "Machine readable output for scripting or the dashboard",
                    "flag": "--json / --json-pretty / --json-human"
                  }
                ],
                "requires_sudo": false,
                "usage": "integrity-check check-integrity [OPTIONS]"
              },
              {
                "description": "Generate new hash file for all tracked files",
                "examples": [
                  "integrity-check generate",
                  "integrity-check generate --json"
                ],
                "name": "generate",
                "options": [
                  {
                    "description": "Run against a different install root instead of the detected one",
                    "flag": "--base-dir <DIR>"
                  },
                  {
                    "description": "Offline mode: hash local files only, do not contact the server",
                    "flag": "--no-network"
                  },
                  {
                    "description": "Enable strict validation while hashing",
                    "flag": "--strict"
                  },
                  {
                    "description": "Detail level 0-3 [default: 1]",
                    "flag": "-V, --verbosity <LEVEL>"
                  },
                  {
                    "description": "Machine readable output for scripting or the dashboard",
                    "flag": "--json / --json-pretty / --json-human"
                  }
                ],
                "requires_sudo": true,
                "usage": "integrity-check generate [OPTIONS]"
              },
              {
                "description": "Verify cryptographic signatures of tracked files",
                "examples": [
                  "integrity-check check-signatures",
                  "integrity-check check-signatures --json"
                ],
                "name": "check-signatures",
                "options": [
                  {
                    "description": "Run against a different install root instead of the detected one",
                    "flag": "--base-dir <DIR>"
                  },
                  {
                    "description": "Fail on any signature mismatch instead of only reporting it",
                    "flag": "--strict"
                  },
                  {
                    "description": "Detail level 0-3 [default: 1]",
                    "flag": "-V, --verbosity <LEVEL>"
                  },
                  {
                    "description": "Machine readable output for scripting or the dashboard",
                    "flag": "--json / --json-pretty / --json-human"
                  }
                ],
                "requires_sudo": true,
                "usage": "integrity-check check-signatures [OPTIONS]"
              }
            ]
          },
          {
            "category": "Verification Operations",
            "commands": [
              {
                "description": "Compare local package versions against remote repositories",
                "examples": [
                  "integrity-check check-version",
                  "integrity-check check-version --json"
                ],
                "name": "check-version",
                "options": [
                  {
                    "description": "Offline mode. Version checking needs the network, so this leaves nothing to compare",
                    "flag": "--no-network"
                  },
                  {
                    "description": "Network timeout for the remote version lookup [default: 30]",
                    "flag": "--timeout <SECS>"
                  },
                  {
                    "description": "Retry attempts for the remote lookup, 1-20 [default: 3]",
                    "flag": "--retry <COUNT>"
                  },
                  {
                    "description": "Detail level 0-3 [default: 1]",
                    "flag": "-V, --verbosity <LEVEL>"
                  },
                  {
                    "description": "Machine readable output for scripting or the dashboard",
                    "flag": "--json / --json-pretty / --json-human"
                  }
                ],
                "requires_sudo": false,
                "usage": "integrity-check check-version [OPTIONS]"
              },
              {
                "description": "Verify the integrity and format of configuration files",
                "examples": [
                  "integrity-check check-config",
                  "integrity-check check-config --json"
                ],
                "name": "check-config",
                "options": [
                  {
                    "description": "Run against a different install root instead of the detected one",
                    "flag": "--base-dir <DIR>"
                  },
                  {
                    "description": "Enable strict validation of the configuration files",
                    "flag": "--strict"
                  },
                  {
                    "description": "Detail level 0-3 [default: 1]",
                    "flag": "-V, --verbosity <LEVEL>"
                  },
                  {
                    "description": "Machine readable output for scripting or the dashboard",
                    "flag": "--json / --json-pretty / --json-human"
                  }
                ],
                "requires_sudo": false,
                "usage": "integrity-check check-config [OPTIONS]"
              },
              {
                "description": "Perform comprehensive check including integrity, versions, and signatures",
                "examples": [
                  "integrity-check check-all",
                  "integrity-check check-all --json"
                ],
                "name": "check-all",
                "options": [
                  {
                    "description": "Run against a different install root instead of the detected one",
                    "flag": "--base-dir <DIR>"
                  },
                  {
                    "description": "Offline mode: run the local integrity pass only, skip the remote manifest",
                    "flag": "--no-network"
                  },
                  {
                    "description": "Also fail on local-only files that are absent from the remote manifest",
                    "flag": "--strict"
                  },
                  {
                    "description": "Network timeout, raise it for a slow link [default: 30]",
                    "flag": "--timeout <SECS>"
                  },
                  {
                    "description": "Retry attempts for the remote fetch, 1-20 [default: 3]",
                    "flag": "--retry <COUNT>"
                  },
                  {
                    "description": "Detail level 0-3 [default: 1]",
                    "flag": "-V, --verbosity <LEVEL>"
                  },
                  {
                    "description": "Machine readable output for scripting or the dashboard",
                    "flag": "--json / --json-pretty / --json-human"
                  }
                ],
                "requires_sudo": true,
                "usage": "integrity-check check-all [OPTIONS]"
              }
            ]
          },
          {
            "category": "Utility Operations",
            "commands": [
              {
                "description": "Display the most recent integrity check logs",
                "examples": [
                  "integrity-check view-logs",
                  "integrity-check view-logs --json"
                ],
                "name": "view-logs",
                "options": [
                  {
                    "description": "Detail level 0-3 [default: 1]",
                    "flag": "-V, --verbosity <LEVEL>"
                  },
                  {
                    "description": "Machine readable output for scripting or the dashboard",
                    "flag": "--json / --json-pretty / --json-human"
                  },
                  {
                    "description": "Show at most N log records",
                    "flag": "--limit <N>"
                  }
                ],
                "requires_sudo": false,
                "usage": "integrity-check view-logs [OPTIONS]"
              }
            ]
          }
        ],
        "description": "A system integrity checker for verifying script and configuration files",
        "environmentVariables": [
          {
            "default": "info",
            "description": "Set logging level",
            "name": "RUST_LOG",
            "values": "error|warn|info|debug|trace"
          },
          {
            "default": "unset",
            "description": "Disable all colored output when set",
            "name": "NO_COLOR",
            "values": "1|true|yes (any value disables color)"
          },
          {
            "default": "unset",
            "description": "HTTP proxy for network requests",
            "name": "HTTP_PROXY",
            "values": "http://proxy:port"
          },
          {
            "default": "unset",
            "description": "HTTPS proxy for secure requests",
            "name": "HTTPS_PROXY",
            "values": "https://proxy:port"
          }
        ],
        "exitCodes": {
          "0": "Success",
          "1": "General error",
          "10": "Check failure - integrity/version issues found",
          "2": "Invalid arguments",
          "3": "Permission denied",
          "4": "Network error",
          "5": "File not found",
          "6": "Timeout error",
          "7": "Authentication error",
          "8": "Internal error",
          "9": "Validation error"
        },
        "globalOptions": [
          {
            "description": "Print help information",
            "flag": "-h, --help"
          },
          {
            "description": "Print version information",
            "flag": "-v, --version"
          },
          {
            "description": "Display detailed information",
            "flag": "-n, --info"
          },
          {
            "description": "Show usage examples",
            "flag": "-e, --examples"
          },
          {
            "description": "Output in JSON format",
            "flag": "--json"
          },
          {
            "description": "Pretty-print JSON output",
            "flag": "--json-pretty"
          },
          {
            "description": "Filter JSON output fields",
            "flag": "--json-filter <FIELDS>"
          },
          {
            "description": "Enable verbose output",
            "flag": "--verbose"
          },
          {
            "description": "Suppress non-essential output",
            "flag": "--quiet"
          },
          {
            "description": "Disable colored output",
            "flag": "--no-color"
          },
          {
            "description": "Use custom configuration file",
            "flag": "--config <FILE>"
          },
          {
            "description": "Set timeout (default: 30)",
            "flag": "--timeout <SECS>"
          },
          {
            "description": "Retry attempts, 1-20 [default: 3]. This is the flag that actually sets the retry count",
            "flag": "--retry <COUNT>"
          },
          {
            "description": "Colorized, jq-style JSON output",
            "flag": "--json-human"
          },
          {
            "description": "Select which fields to keep in JSON output",
            "flag": "--fields <FIELDS>"
          },
          {
            "description": "Limit the number of records in JSON output",
            "flag": "--limit <N>"
          },
          {
            "description": "Skip the first N records in JSON output",
            "flag": "--offset <N>"
          },
          {
            "description": "Output format (text|json) [default: text]",
            "flag": "-o, --output-format <FORMAT>"
          },
          {
            "description": "Base directory for the application. Rejects '..', shell metacharacters and the system prefixes /etc, /sys, /proc, /dev, /root",
            "flag": "--base-dir <DIR>"
          },
          {
            "description": "Working directory for the process",
            "flag": "-d, --work-dir <DIR>"
          },
          {
            "description": "Override the network port used for remote lookups",
            "flag": "--port <PORT>"
          },
          {
            "description": "Verbosity level (0-3) [default: 1]",
            "flag": "-V, --verbosity <LEVEL>"
          },
          {
            "description": "Logging level (error|warn|info|debug|trace)",
            "flag": "--log-level <LEVEL>"
          },
          {
            "description": "Offline mode: skip every remote call, verify against the local manifest only",
            "flag": "--no-network"
          },
          {
            "description": "Strict validation: local-only files missing from the remote manifest also fail the check",
            "flag": "--strict"
          }
        ],
        "name": "integrity-check",
        "usage": "integrity-check [OPTIONS] [COMMAND] [ARGS]"
      },
      "errors": [],
      "metadata": {
        "executionTime": 0,
        "hostname": "REDACTED-BUILD-HOST",
        "user": "REDACTED-BUILD-USER"
      },
      "status": "success",
      "timestamp": "2026-07-21T01:54:28.361728370Z",
      "version": "9.8.4 (build 320)",
      "warnings": []
    },
    "flag_e": {
      "command": "examples",
      "data": {
        "categories": [
          {
            "description": "Core integrity checking operations. check-integrity compares every tracked file against the hash manifest and reports what changed.",
            "examples": [
              {
                "command": "integrity-check check-integrity",
                "description": "Verify integrity of all tracked files",
                "expectedOutput": "A per-file pass/fail list, then a summary of hash mismatches and missing files. Exit code 10 if anything failed",
                "notes": "This refreshes the cached remote manifest inside the install directory, so on a root-owned install (for example /opt) prefix it with sudo or pass --no-network."
              },
              {
                "command": "integrity-check check-integrity --json",
                "description": "Integrity check with JSON output",
                "expectedOutput": "A JSON envelope whose data holds the mismatch, missing-local and missing-remote lists"
              },
              {
                "command": "integrity-check check-integrity --base-dir /opt/kodachi/dashboard/hooks",
                "description": "Check a second Kodachi install instead of the detected one",
                "expectedOutput": "Integrity results for the files under that directory",
                "notes": "--base-dir is validated: '..', shell metacharacters (* ? { } ( ) ; | & $ ` < >) and the system prefixes /etc, /sys, /proc, /dev and /root are all rejected."
              },
              {
                "command": "integrity-check check-integrity --base-dir /opt/kodachi/dashboard/hooks --json",
                "description": "Same check against a custom install root, as JSON",
                "expectedOutput": "JSON envelope with the results for that directory"
              }
            ],
            "id": "1_basic_usage",
            "title": "Basic Usage"
          },
          {
            "description": "check-all runs the file integrity pass and the package version comparison together, and writes the refreshed remote manifest into the install directory, which is why it wants root.",
            "examples": [
              {
                "command": "sudo integrity-check check-all",
                "description": "Complete system verification",
                "expectedOutput": "Integrity results followed by the version comparison, then a combined pass/fail summary",
                "notes": "Needs root because it rewrites the cached manifest inside a root-owned install directory."
              },
              {
                "command": "sudo integrity-check check-all --timeout 300",
                "description": "Full system verification over a slow or Tor-routed link",
                "expectedOutput": "The same report, with up to 300 seconds allowed per network call",
                "notes": "--timeout accepts 1 to 300 seconds. The default of 30 is often too short over Tor."
              },
              {
                "command": "sudo integrity-check check-all --strict --json",
                "description": "Fail the run if any local file is absent from the remote manifest",
                "expectedOutput": "JSON envelope, with a failing status if the missing-remote list is not empty",
                "notes": "Without --strict, local-only files are reported but do not fail the check."
              }
            ],
            "id": "2_comprehensive_checks",
            "title": "Comprehensive System Checks"
          },
          {
            "description": "Creating and managing file integrity hashes",
            "examples": [
              {
                "command": "sudo integrity-check generate",
                "description": "Create a new hash manifest covering all tracked files",
                "expectedOutput": "The generated hash manifest is written into the install directory, replacing the previous one",
                "notes": "Needs root. This OVERWRITES the existing manifest: whatever is on disk right now becomes the new baseline, so only run it when you trust the current state of the system. Running it on a tampered system makes the tampering the reference."
              },
              {
                "command": "sudo integrity-check generate --json",
                "description": "Hash generation with JSON output for automation",
                "expectedOutput": "JSON envelope reporting how many files were hashed and where the manifest was written"
              }
            ],
            "id": "3_hash_generation",
            "title": "Hash Generation"
          },
          {
            "description": "Package version verification against remote repositories",
            "examples": [
              {
                "command": "integrity-check check-version",
                "description": "Compare local package versions against remote repositories",
                "expectedOutput": "A per-package comparison of the local version against the remote one, and a list of any mismatches",
                "notes": "Needs network access. With --no-network there is nothing to compare against."
              },
              {
                "command": "integrity-check check-version --json",
                "description": "Version check with JSON output for scripting",
                "expectedOutput": "JSON envelope with the local and remote version of each tracked package"
              }
            ],
            "id": "4_version_checking",
            "title": "Version Checking"
          },
          {
            "description": "Configuration file verification and validation",
            "examples": [
              {
                "command": "integrity-check check-config",
                "description": "Verify the integrity and format of configuration files",
                "expectedOutput": "A pass/fail line per configuration file, with the parse error shown for any file that is malformed"
              },
              {
                "command": "integrity-check check-config --json",
                "description": "Configuration check with JSON output",
                "expectedOutput": "JSON envelope listing each configuration file and whether it validated"
              }
            ],
            "id": "5_configuration_management",
            "title": "Configuration Management"
          },
          {
            "description": "Cryptographic signature validation",
            "examples": [
              {
                "command": "sudo integrity-check check-signatures",
                "description": "Verify cryptographic signatures of tracked files",
                "expectedOutput": "A verified/failed line per signed file, checked against the bundled public key",
                "notes": "Needs root to read the protected signature material in the install directory."
              },
              {
                "command": "sudo integrity-check check-signatures --json",
                "description": "Signature verification with JSON output",
                "expectedOutput": "JSON envelope with the signature status of every signed file"
              },
              {
                "command": "sudo integrity-check check-signatures --strict",
                "description": "Strict signature verification",
                "expectedOutput": "The same report, but the command exits non-zero on the first signature that does not verify",
                "notes": "Use this in automation: without --strict a mismatch is reported but does not fail the run."
              }
            ],
            "id": "6_signature_verification",
            "title": "Signature Verification"
          },
          {
            "description": "Viewing and managing integrity check logs",
            "examples": [
              {
                "command": "integrity-check view-logs",
                "description": "Display the most recent integrity check logs",
                "expectedOutput": "The most recent log entries, newest last"
              },
              {
                "command": "integrity-check view-logs --json",
                "description": "View logs in JSON format for parsing",
                "expectedOutput": "JSON envelope with one object per log record",
                "notes": "Useful for log analysis tools"
              }
            ],
            "id": "7_log_management",
            "title": "Log Management"
          },
          {
            "description": "--no-network is the headline offline mode: it skips every remote call so the check runs entirely against the local manifest, which is what you want on an air-gapped machine or when you do not want the box reaching out at all. --strict tightens what counts as a failure, and --verbosity controls how much detail is printed.",
            "examples": [
              {
                "command": "integrity-check check-integrity --no-network",
                "description": "Verify files offline, against the manifest already on disk",
                "expectedOutput": "The usual pass/fail list, with no remote fetch and no manifest rewrite",
                "notes": "Nothing leaves the machine. The cached remote manifest is not refreshed, so results are only as current as the last online run."
              },
              {
                "command": "sudo integrity-check generate --no-network --strict",
                "description": "Rebuild the hash manifest from local files only",
                "expectedOutput": "A regenerated hash file covering every tracked file",
                "notes": "Needs root: it writes the manifest into the install directory. Run it after a deliberate system update, otherwise a later check-integrity will report your own changes as tampering."
              },
              {
                "command": "integrity-check check-integrity --verbosity 2",
                "description": "Show more detail about each file as it is checked",
                "expectedOutput": "Per-file progress lines in addition to the summary",
                "notes": "Levels are 0 (quiet) to 3 (most detail). Default is 1."
              },
              {
                "command": "sudo integrity-check check-all --output-format json --timeout 60 --retry 5",
                "description": "Automation-friendly run with an explicit retry budget",
                "expectedOutput": "A single JSON envelope, retrying each failed network call up to 5 times",
                "notes": "--retry accepts 1 to 20. The older --max-retries flag is deprecated and ignored: only --retry changes the retry count."
              }
            ],
            "id": "8_offline_and_hardened",
            "title": "Offline and Hardened Operation"
          }
        ],
        "description": "Usage examples for integrity-check",
        "name": "integrity-check",
        "quickReference": [
          "integrity-check check-integrity",
          "sudo integrity-check check-all",
          "sudo integrity-check generate",
          "integrity-check check-version",
          "integrity-check check-config",
          "sudo integrity-check check-signatures",
          "integrity-check view-logs",
          "integrity-check --help",
          "integrity-check --version",
          "integrity-check --info",
          "integrity-check --examples"
        ]
      },
      "errors": [],
      "metadata": {
        "executionTime": 2,
        "hostname": "REDACTED-BUILD-HOST",
        "user": "REDACTED-BUILD-USER"
      },
      "status": "success",
      "timestamp": "2026-07-21T01:54:28.640473534Z",
      "version": "9.8.4 (build 320)",
      "warnings": []
    }
  }
}