From 0d9f6d36e39e121154a2256c3df6b3225142ac73 Mon Sep 17 00:00:00 2001 From: San Lee <295248956+sanlee-ys@users.noreply.github.com> Date: Wed, 19 Aug 2026 12:08:09 -0400 Subject: [PATCH] packaging: the mismatch refusal has a live trial behind it A local host served the real v0.2.0 release with one byte appended to the archive. The shipped script, with only its $base line redirected, refused 2/2: both hashes named, the download deleted, nothing installed. The one-byte control installed cleanly on the same pipeline. design.md section 8 carries the payment; STATE.md drops the gap. Co-Authored-By: Claude Fable 5 --- STATE.md | 10 ---------- docs/design.md | 26 +++++++++++++++++++++++--- 2 files changed, 23 insertions(+), 13 deletions(-) diff --git a/STATE.md b/STATE.md index bd2a214..f76a79c 100644 --- a/STATE.md +++ b/STATE.md @@ -345,16 +345,6 @@ Nothing open. The last one here was the 44 seconds, and it was measured miss means are the owner's to name. The sweep's "10 runs in 30 days" is a proposal with no measurement behind it and was deliberately not adopted. -- **`packaging/install.ps1`'s mismatch refusal has no end-to-end live trial - (2026-08-18).** The happy path ran on PowerShell 7.6.5 and Windows - PowerShell 5.1.26100.9168 against the published `v0.2.0`, and two refusals - ran end to end (an arm64 machine, and a tag with no release). Driving the - checksum mismatch needs a host that serves a corrupted archive. The - comparison itself was measured live over the real `checksums.txt` and a - tampered copy of the real archive, and the hashes differed; the three lines - that act on that result are unexercised. §8's 2026-08-18 amendment carries - the record. - - **A live ordinary-turn give-up is owed on the reference box before 2026-09-30.** `x` on an ordinary turn shipped 2026-08-17 with offline tests only. Whether a real vendor's interrupt lands mid-turn, and whether the diff --git a/docs/design.md b/docs/design.md index 71fe5e4..1812150 100644 --- a/docs/design.md +++ b/docs/design.md @@ -7022,12 +7022,32 @@ something the operator did not ask for. Two refusals ran end to end and installed nothing: the arm64 refusal, and a `TELLTALE_VERSION=v0.1.0` run against the tag that has no release. -**What has no end-to-end live trial is the mismatch refusal**, because driving +**What had no end-to-end live trial was the mismatch refusal**, because driving it needs a host that serves a corrupted archive. Its comparison was measured live instead: the real `checksums.txt` was parsed, a byte was appended to the real archive, and the two hashes differed. The branch that acts on that -comparison is three lines below it and is unexercised. STATE.md carries it as a -known gap. +comparison is three lines below it and was unexercised until the payment below. + +**Paid 2026-08-19, on the MBP (Intel, macOS, PowerShell 7.6.4): two mismatch +trials and one control.** The missing instrument was the corrupt host, so the +trial built one. A `python3 -m http.server` on 127.0.0.1 served the published +`v0.2.0` `checksums.txt` beside a copy of the real archive with one byte +appended (`7a2401aa…33772528` became `8ea9111b…6eb47b8d3c`). The script under +test was the shipped file with one recorded change: the `$base` line pointed at +the local host. The OS and arch refusals read plain environment variables, so +`OS=Windows_NT` and `PROCESSOR_ARCHITECTURE=AMD64` let the real function run on +this machine; that shortcut is named below. Both trials refused, 2/2. The +thrown message named both hashes and said the download was deleted and nothing +was installed. No install directory was created, and no `telltale-install-*` +work directory survived. The message itself is the proof that the three lines +ran: it is the `throw` line's own text, and it carries the two hashes the lines +above it computed. The control reversed the one appended byte and changed +nothing else. The same server and the same patched script then installed +cleanly: `sha256 ok (7a2401aa…)`, and a placed `telltale.exe`. Stated honestly: +this trial redirected `$base` and satisfied the two host guards from the +environment, so it measured the mismatch branch and not the GitHub download +path or the Windows host — the 2026-08-18 block above already paid those two +on the real host. STATE.md no longer carries the gap. **One footgun is recorded because it cost a parse, and the gate holds it.** The file is ASCII only. Windows PowerShell 5.1 reads a BOM-less file as ANSI, so one