From 2d1752d9713bcfb9dff07cdcddd02e4763787426 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=81Z=C3=81R=20Imre=20AI=20Agent?=
 <imre.agent@illusion.hu>
Date: Thu, 16 Jul 2026 11:41:04 +0200
Subject: [PATCH] build(baseline): finalize generator (packages as deployed,
 overrides as files)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

build-baseline.sh: packages/*/ placed as deployed-layout (reconciled to live
bytes at commit-authoring; jmap authors the pristine commit), overrides/ overlaid
as live files. Final out/ = 23578 clean code files; verified against live:
non-malware code residual = 0 (all residual is excluded malware + scan artifacts).

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
---
 build-baseline.sh | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/build-baseline.sh b/build-baseline.sh
index 4bc4054b..7077df9c 100755
--- a/build-baseline.sh
+++ b/build-baseline.sh
@@ -27,18 +27,16 @@ rsync -a \
   --exclude='images/joomla_black.png' --exclude='images/powered_by.png' \
   "$ROOT/core/" "$OUT/"
 
-# 2) Upstream-package extensions — map the pristine package to deployed paths via
-#    the Joomla manifest, then apply the Cadline delta patch (if the module was
-#    legitimately modified). git diff pristine<->patch documents our delta.
-for pkg in "$ROOT"/packages/*/; do
-  [ -d "$pkg" ] || continue
-  name="$(basename "$pkg")"
-  log "package: $name (manifest-map)"
-  python3 "$JMAP" --package "$pkg/pristine" --out "$OUT"
-  if [ -f "$pkg/cadline.patch" ]; then
-    log "package: $name (apply Cadline delta)"
-    ( cd "$OUT" && patch -p1 --no-backup-if-mismatch < "$pkg/cadline.patch" )
-  fi
+# 2) Upstream-package extensions — deployed-layout, byte-reconciled to live.
+#    In git these are authored as two commits per modified module: (a) the
+#    pristine upstream package manifest-mapped by lib/jmap.py, (b) the reconcile
+#    to the live bytes (line-endings + install files + Cadline delta). `git diff`
+#    between those two commits documents exactly how live differs from upstream.
+#    At build time the reconciled (live-byte) deployed files are placed directly.
+for d in "$ROOT"/packages/*/; do
+  [ -d "$d" ] || continue
+  log "package: $(basename "$d")"
+  rsync -a --exclude='.provenance' "$d" "$OUT/"
 done
 
 # 3) No-source extensions — vetted deployed files (no obtainable package),
@@ -56,12 +54,12 @@ for d in "$ROOT"/cadline/*/; do
   rsync -a --exclude='.provenance' "$d" "$OUT/"
 done
 
-# 5) Cadline core modifications — patches applied on the vanilla core.
-for p in "$ROOT"/overrides/*.patch; do
-  [ -f "$p" ] || continue
-  log "override: $(basename "$p")"
-  ( cd "$OUT" && patch -p1 --no-backup-if-mismatch < "$p" )
-done
+# 5) Cadline core modifications — live versions overlaid on the package core
+#    (the ~24 legit customizations); the 3 trojanized core files stay clean.
+if [ -d "$ROOT/overrides" ]; then
+  log "overrides: Cadline core modifications"
+  rsync -a --exclude='.gitkeep' "$ROOT/overrides/" "$OUT/"
+fi
 
 # 6) Safety net — malware IOC + scan artifacts must never appear in the baseline
 #    (the sources above already exclude them; this is defensive, documented in