diff --git a/history/fp-driver-d2-355e3e62.sh b/fp-driver-d2.sh index 684a0536..d99ac9ad 100644 --- a/history/fp-driver-d2-355e3e62.sh +++ b/fp-driver-d2.sh @@ -126,7 +126,13 @@ W='C:/Users/decid/Documents/projects/spt-core/.worktrees/304-w2-repr' SP='C:/Users/decid/AppData/Local/Temp/claude/C--Users-decid-Documents-projects-spt-core/909af448-f4ab-4fa1-ba30-02e38b275a11/scratchpad/bundle-r5' BIN="$SP/fp-bin" # INSTRUMENTS — never written to by a run RUN_ROOT="$SP/fp-run" # one timestamped subdir per run -H="$SP/fp-home-d2" # isolated SPT_HOME, THIS experiment only. D2 SUCCESSOR: +H="$SP/fp-home-d2-a2" # isolated SPT_HOME, THIS ATTEMPT only. fp-home-d2 belongs to + # the RETAINED failed run and is PRESERVED, not reused or + # cleared: a run that adopted it could not tell its own state + # from that run's, and the evidence of a failure is not scratch + # space (doyle K4QDUUVV). The pre-existence refusal below is + # KEPT unchanged and now bites on a prior ATTEMPT of this + # successor rather than on anyone else's evidence. EARLIER: # r10 left a populated fp-home beside this one (measured # present, 10 entries), and a run that adopted it could not # tell its own state from r10's. The name is fresh so S0b's @@ -2034,20 +2040,28 @@ record "PRE_SETUP_ABSENCE measured: both owned names absent — [$PRE_SETUP_ABSE prep_check prepared-acknowledgment handoff_request prepare \ "ACKNOWLEDGE ONLY -- RUN NOTHING. Confirm you are prepared to execute the setup leg and that you have started nothing yet, and report the sha256 of BOTH subjects this leg would run, AS YOU MEASURE THEM NOW: the pinned executable and the capture script." \ - "ACKNOWLEDGEMENT ONLY. Do not run the product. Reply in the receipt with the four tokens: PREPARED, NOT_STARTED, executable_sha256=, and capture_sha256=" + "ACKNOWLEDGEMENT ONLY. Do not run the product. Reply in the receipt with these four tokens, EACH ON A LINE OF ITS OWN AND NOTHING ELSE ON THAT LINE: PREPARED, NOT_STARTED, executable_sha256=, capture_sha256=. If you are NOT prepared, say so in words -- do not write NOT_PREPARED on a line by itself and expect it to read as a refusal." PREPARED_ACK="$HO_RECEIPT" # NOT `if ! handoff_await trial`: that exact line is the anchor of an assembly-time correction # applied to the RETAINED setup wait, and the assembler asserts it appears exactly once. Same # call, same context, written so the anchor stays unique -- the rig refused this and was right. handoff_await trial || die "no PREPARED/NOT_STARTED acknowledgment within the preparation budget. The experimental window is NEVER OPENED: nothing was dispatched, nothing was created, and there is nothing to tear down." ack_missing='' -grep -q "PREPARED" "$PREPARED_ACK" 2>/dev/null || ack_missing="$ack_missing PREPARED" -grep -q "NOT_STARTED" "$PREPARED_ACK" 2>/dev/null || ack_missing="$ack_missing NOT_STARTED" -grep -q "executable_sha256=$EXE_SHA" "$PREPARED_ACK" 2>/dev/null || ack_missing="$ack_missing executable_sha256=$EXE_SHA" +# EXACT WHOLE-LINE TOKENS (doyle K4QDUUVV). A substring search for PREPARED is satisfied by +# NOT_PREPARED, and one for GO_AUTHORIZED by NOT_GO_AUTHORIZED -- so a receipt that REFUSES would +# have read as a receipt that agrees, which is the worst direction for this particular mistake. +# Matching is whole-line and the hash fields are matched entire, so a truncated or prefixed hash +# cannot satisfy one either. CR IS STRIPPED FIRST: the receipt is written by a Windows elevated +# leg, so its lines end CRLF, and a whole-line match against a line ending in \r matches nothing -- +# the tightening would otherwise have refused every honest receipt. +ack_line() { tr -d '\r' < "$1" 2>/dev/null | grep -qx -F -- "$2"; } +ack_line "$PREPARED_ACK" "PREPARED" || ack_missing="$ack_missing PREPARED" +ack_line "$PREPARED_ACK" "NOT_STARTED" || ack_missing="$ack_missing NOT_STARTED" +ack_line "$PREPARED_ACK" "executable_sha256=$EXE_SHA" || ack_missing="$ack_missing executable_sha256=$EXE_SHA" # BOTH SUBJECTS, NOT ONE (doyle LIRX7EUS). The leg runs the product AND the capture script, and the # documents this run reasons about are whatever the capture script produced. An acknowledgment that # measured only the executable proved the leg could see half of what it is about to run. -grep -q "capture_sha256=$CAPTURE_SHA" "$PREPARED_ACK" 2>/dev/null || ack_missing="$ack_missing capture_sha256=$CAPTURE_SHA" +ack_line "$PREPARED_ACK" "capture_sha256=$CAPTURE_SHA" || ack_missing="$ack_missing capture_sha256=$CAPTURE_SHA" if [ -n "$ack_missing" ]; then record "PREPARED_ACK_CONTENTS: [$(tr -d '\r' < "$PREPARED_ACK" 2>/dev/null | tr "\n" " ")]" die "the acknowledgment is missing:$ack_missing. An unverified acknowledgment opens no window -- a receipt that cannot state the subject it measured is not evidence that the executor is looking at this run." @@ -2064,12 +2078,15 @@ record "PREPARED_IS_NOT_AUTHORIZATION - readiness says the leg CAN act; it does prep_check go-authorization handoff_request go-authorization \ "AUTHORIZE ONLY -- RUN NOTHING. This is not a readiness question; you have already answered that. Authorize the experimental window to OPEN for this run, knowing the 300s activity clock starts when it does." \ - "AUTHORIZATION ONLY. Do not run the product. Reply in the receipt with BOTH tokens: GO_AUTHORIZED and the nonce of THIS request, quoted exactly." + "AUTHORIZATION ONLY. Do not run the product. Reply in the receipt with BOTH: the token GO_AUTHORIZED on a line of its own and nothing else on that line, and the nonce of THIS request quoted exactly (anywhere). To WITHHOLD authorization, say so in words -- there is no negative token this check reads." GO_ACK="$HO_RECEIPT"; GO_ACK_NONCE="$HO_NONCE" handoff_await trial || die "no GO authorization within the preparation budget. The experimental window is NEVER OPENED: readiness alone does not open it, nothing was dispatched, and there is nothing to tear down." go_missing='' -grep -q "GO_AUTHORIZED" "$GO_ACK" 2>/dev/null || go_missing="$go_missing GO_AUTHORIZED" -grep -q "$GO_ACK_NONCE" "$GO_ACK" 2>/dev/null || go_missing="$go_missing nonce=$GO_ACK_NONCE" +ack_line "$GO_ACK" "GO_AUTHORIZED" || go_missing="$go_missing GO_AUTHORIZED" +# THE NONCE KEEPS ITS SUBSTRING MATCH, deliberately: it is quoted inside a line the executor +# writes in its own words ("nonce: "), and it is a run-scoped value that nothing else on +# the receipt can accidentally contain. +grep -q -F -- "$GO_ACK_NONCE" "$GO_ACK" 2>/dev/null || go_missing="$go_missing nonce=$GO_ACK_NONCE" if [ -n "$go_missing" ]; then record "GO_ACK_CONTENTS: [$(tr -d '\r' < "$GO_ACK" 2>/dev/null | tr "\n" " ")]" die "the GO authorization is missing:$go_missing. An authorization that cannot quote the nonce of the request it answers is not bound to this run, and this window does not open on it."