caoer115/ucc
1
0
Fork 0
Code Issues Pull requests 45 Projects Releases Packages Wiki Activity

update door: one §tooling reader, shape floors, branch equality (delta-review-2 P0 new 1 + residuals) #37

Open
caoer115 wants to merge 0 commits from agent/5fa27f17-update-door-readers into main
pull from: agent/5fa27f17-update-door-readers
merge into: caoer115:main
Conversation 0 Commits - Files changed -
caoer115 commented 2026-10-16 23:58:35 +00:00
Owner
Copy link

Closes delta-review-2 P0 new finding 1 (the §tooling reader disagreement) and its shape residuals (new 18, §Open 1/2, per-item 13), leader ruling A6, and the §one push / §fleet hosts text. Proof: lane round r250 (U8 stage) — rows F20-shadow-tooling, F21-vendor-platform, F22-paseo-dist-tag, F23-cross-version-link, F24-cc-downgrade. Local reproduction of the P0 reader-agreement against 4 shadow variants passed. Gate: bash rounds/lib/tooling.sh rc 0.

Closes delta-review-2 P0 new finding 1 (the §tooling reader disagreement) and its shape residuals (new 18, §Open 1/2, per-item 13), leader ruling A6, and the §one push / §fleet hosts text. Proof: lane round r250 (U8 stage) — rows F20-shadow-tooling, F21-vendor-platform, F22-paseo-dist-tag, F23-cross-version-link, F24-cc-downgrade. Local reproduction of the P0 reader-agreement against 4 shadow variants passed. Gate: bash rounds/lib/tooling.sh rc 0.
New finding 1 (P0): `ucc` and `install.sh` read UPDATE.md §tooling with an awk
that takes the first `## tooling` line anywhere, while the installed lock pins
the section through mrd, whose reader is fence-aware. A shadow `## tooling` in an
unpinned region (a code fence, an HTML comment, under another H1) let the two
readers name different hashes while the walk stayed green, so a push could run a
changed install.sh as the user. Every reader of §tooling (ucc update, ucc walk,
install.sh, tooling.sh) now refuses more than one `## tooling` heading before
anything is staged; a shadow reds the walk on ucc:UPDATE.md and the host asks its
owner. Proven locally against 4 shadow variants (fence/H1/comment/bare): the
shell refuses every one, mrd reads the real hashes, the legit file passes.

Residuals on the same door:
- new 18 platform bind: the vendor claude-stock object is bound to the host's own
  platform (uname), not any published platform.
- new 18 claude_code floor: a plain update never lowers the official Claude Code
  below the installed version (--to/--rollback go behind by choice).
- new 18 paseo: the pin must be a strict version (x.y.z), not an npm dist-tag.
- §Open 2 link binding: a record's get-ucc release-set links must be its own
  releases/ucc/v<N>/ set, never another release's published object.
- per-item 13 branch check: install.sh holds a clone to equality with the followed
  branch head (not merge-base ancestor), and refuses — never skips — a dir that is
  neither a clone nor a release stage (a repo archive); git's own stderr reaches
  the owner on a refusal (closes §Open 1 / finding E).

Ruling A6: the bare-update foreign-red refusal names where the owner reads the
move (the release CHANGELOG entry or the forge diff); the start "refused — the
lock is red on " and end "ask your owner" are unchanged (round-host.sh
public_update still matches).

Text: UPDATE.md §one push true as written; §fleet hosts drops the false claim that
the fleet's sessions:HOOKS.md carries the no-self-update rule (it does not).

Rounds: F20-shadow-tooling (the P0 plant), F21-vendor-platform, F22-paseo-dist-tag,
F23-cross-version-link, F24-cc-downgrade in the U8 stage, manifest and U8_ROWS.
F1 (P0): the shell no longer has a reader of its own for a section the lock
pins. ucc reads UPDATE.md § tooling and releases/current.md § version with
pinned(): the mrd that walks the lock, at the lock's own row
(ucc:<file>#<selector>), the stage's UPDATE.md and current.md cmp'd to the
walked files. install.sh reads § tooling and current.md § pins with
here_section(): the stage's mrd, the one it pins the lock by (its drawer
removed when the read made it). rounds/lib/tooling.sh reads and verifies
its write through mrd; rounds/lib/release-check.sh reads every section
through mrd on the commit's blob and compares fingerprints, the walk's own
notion of "moved". The grep-count shadow guards are gone: a heading line mrd
does not take for the section (fence, comment, another H1, an indented real
heading beside it) is text to every reader as it is to the walk.

F2 (P1): public/ serves only the sessions-root template and its init a v1 or
v2 record names, at their exact links; a v3+ record links its own set.

Codex P2: install.sh's branch-equality check resolves the followed branch's
head with git ls-remote on the remote the host will follow (refusal with
git's stderr when unreachable), not the clone's stale tracking ref.

Rows: F20 now expects red on ucc:install.sh alone; F22-F24 renumbered
F30-F32 (PR #36 owns F22-F26); new F33-shadow-indented (indented real
heading + fenced shadow), F34-public-pack (every row at public/), F35-
shadow-version (fenced ## version ahead of the real one). Local-mode
teardown also matches a daemon started from a stage's bin/mrd.
Codex second pass on PR #37 (results/codex-review-p0-door-2.md) and the second security
review's battery gap. The class: any shell reader of a markdown section that decides an
install, pinned or not.

- P2-1, frontmatter version: vs § version. install.sh reads the frontmatter with mrd props
  and refuses (exit 4) a releases/current.md whose frontmatter names another release than
  § version; RELVER — opt/VERSION.md release: — comes from § version as mrd reads it, never
  the unpinned frontmatter. ucc step 2 refuses the same on a plain update (rc 3, nothing
  downloaded; PR #36's text); on --to/--rollback the stage's current.md is written from the
  record when either name differs. release-check refuses it at <to>.
- P2-2, the release record. ucc reads releases/v<N>.md § pins and § artifacts once, through
  the mrd that read the root (rsec, `release v<N>/<sec>`), and its type/version with mrd
  props; the shape check, the stage's PINS, the downloads and step 7's hash check take those
  bytes. The awk section() is gone; fm reads opt/VERSION.md alone. A record mrd serves no
  single § pins or § artifacts is refused. release-check reads the record's type, version
  and status as mrd props and refuses a record mrd serves no single § pins or § artifacts.
- UPDATE.md: § tooling's reader line and § one push name the record and the frontmatter.
- rounds: F36-version-two-names (frontmatter V3, § version V2, V3 record valid: no line,
  ucc update rc 3, still V2; release-check rc 1 on the move), F37-shadow-pins (real
  § pins paseo=latest, a fenced valid § pins ahead of it: refused, not a strict version),
  F38-shadow-artifacts (real bin/cccd at evil.invalid, fenced valid rows ahead: refused,
  off the release).

Battery (both readers and the release gate against a real mrd walk): 83 variants, 0 fails —
the 47 before, the review's anchor-token, %%-comment, embed and setext variants, 8
frontmatter variants (ucc's and the installer's decision agree; every frontmatter-only change
refuses), 19 record-shadow variants (ucc's record read equals the gate's in each).
r250's U8-update-again: ucc update's rm -rf of the old stage failed "Directory not empty" under
set -e. here_read read with MERIDIAN_WORKSPACE=<stage>, registering the stage with the user's
resident mrd daemon; the registration outlived the install, and each file event in the stage
made the daemon rewrite <stage>/.meridian, racing the delete. here_read now reads a byte copy in
$UCC/cache/mrd-read (HERE's MERIDIAN.md beside it) and unregisters it; the stage is never
registered. A non-regular file reads as empty, as mrd does not read through a link.

F21-vendor-platform: plant the darwin-arm64 vendor link on the bin/claude-stock row itself (a
--round host's records link file:// copies, so the old sed planted nothing) and assert landing.
F33-shadow-indented: the indented heading's space falls in § sop's span, so § sop reds too;
the row requires ucc:install.sh among the reds.
- release-publish.sh reads the record's frontmatter and `# release v<N>` § artifacts through mrd, from a byte
  copy in a scratch workspace unregistered at exit: what it uploads and reads back is the table ucc downloads.
- release-record.sh --rows-from takes the rows of that record's § artifacts as mrd serves it.
- release-check.sh unregisters each scratch workspace before removing it; its pins() filter takes the
  *_sha256 keys too, so current.md and the record must agree on every pin.
- ucc record_shape and release-check refuse a § pins or § artifacts holding anything but key=value lines or
  table rows, or naming a key or path twice: a fenced or commented row inside the section is text mrd serves
  with it, which every reader would take while the forge shows an example.
- Round calls of release-record.sh run with the round's mrd (--rows-from on the --public line).
- After install.sh returns, opt/VERSION.md release: must equal TARGET, else die 6 naming both.
- F39: a fenced bin/cccd row (the release's own mrd object and hash) inside the real § artifacts — on the
  release's hosts and hashing true — is refused by ucc's section shape before the download; the plant
  asserts its landing. Manifest and U8_ROWS.
- UPDATE.md § tooling regenerated for ucc.
- ucc: #36's shared record_shape/fetch/download_record take this branch's mrd reads
  (REC_PINS/REC_ARTS, rread/rprop by RMRD); FMV through prop; #36's STOPPED guard kept.
- ucc stage (install.sh --release, a host with no mrd yet): the record's one bin/mrd row
  is fetched and hashed, that mrd reads the record from a scratch workspace (unregistered
  at exit), and its bin/mrd row must be the fetched one; a second bin/mrd line refuses.
- download_record writes <path>.part, hashes it, renames it into place: ucc stage's mrd
  runs as the resident daemon and a running binary is never written over.
- install.sh: #36's refuse() for every stop; RELVER at #36's position read by
  here_version; --release checks the clone's § version through the stage's mrd after
  ucc stage; the readers are defined before the --release block.
- UPDATE.md: #36's --release paragraph and steps 1-2 with this branch's ls-remote
  sentence and step 3; the reader sentence names ucc stage; § tooling regenerated.
- rounds: U8_ROWS union; F36-version-two-names dropped, #36's F25-record-two-names
  covers the same guard and install.sh by hand.
A curl shim on zt2's PATH holds the first download until the harness, woken by
update.log's stage line (after step 1 walked V3's push), has pushed a § sop move.
Asserts rc 0, V3 green, the lock and the installer's 'ucc: not pulled' at the
walked commit; after ucc-follow the walk reads red on § sop and the next
ucc update refuses rc 3. Both pushes taken back, the host at V2 again.
- sec_lines (ucc, rounds/lib/release-check.sh) trims a table path's edges by
  [[:space:]] as record_shape and download_record do: '| bin/cccd |' and
  '| bin/cccd\f |' name one path twice.
- the INSTALLED != TARGET stop runs after step 7's root check, so a lock that
  re-pinned the root is put back before that stop too.
- ucc stage fetches the bootstrap bin/mrd to .part and moves it only after its
  hash passes; a failing one is removed.

UPDATE.md § tooling regenerated.
ucc stage (install.sh --release) takes the release's own mrd from the record's
one literal bin/mrd line before mrd reads the record, then requires mrd's
bin/mrd row to be that line (kept). release-check now refuses a record whose
file names bin/mrd on any other count of lines, or whose one bin/mrd line is
not the row mrd serves, so a release the gate approves is one ucc stage can
build: a fenced illustration naming bin/mrd stays out of a record.

F41-boot-row-example: a V3 candidate passes the gate (control); with a fenced
illustration naming bin/mrd in its introduction the gate refuses it (rc 1)
and ucc stage refuses the same record (rc 3, nothing downloaded). Nothing is
pushed. UPDATE.md § release names the rule.
Security review 5 (pr37-69d9534) § Hardenings 1: release-check reads the record
through $(git show …), which drops NUL bytes, so it counted one bin/mrd line in
a record that ucc stage, grepping the file itself, reads as binary with no
bin/mrd line and refuses. The gate now refuses a record whose blob holds a NUL
(counted on git cat-file's bytes), so it admits only what ucc stage admits.
UPDATE.md § release names it.

F41-boot-row-example keeps its control (the candidate passes, rc 0) and gains
two plants beside the fenced illustration: a NUL byte in the introduction (gate
rc 1 naming the NUL, ucc stage rc 3 before any download) and the real bin/mrd
row moved out of § artifacts into the illustration, so the file's one bin/mrd
line is not a row mrd serves (gate rc 1, the row_cells mismatch branch; review
5 § Testing gaps). The moved leg is gate-only in a round: a round's V3 links are
not on V3's own set, so ucc stage refuses every candidate at the link check
before that point; the battery's stagetest runs it (rc 3, § artifacts lacks
bin/mrd). No ucc or install.sh change, no manifest line.
r253 (--public, 69d9534) was void: #37's own-set rule (ucc on_hosts: a link on
the release sets only under the target's own v<N>/) refused the U8 records,
which linked the planted v<V2>/v<V3> at v<V1>'s published set (90-u8.sh:108).
The rule stays as it is, and ucc and install.sh are unchanged. The harness
now writes each record as the rule requires: releases/<V2>.md links get-ucc's
<V2>/ and every <V3> record links <V3>/, with <V1>'s published hashes
(--rows-from).

Only v<V1>/ serves those objects. A curl shim first on zt2's PATH
(~/.local/bin, ahead of the rest through install.sh's env.sh, which every
launcher sources) sends a fetch of <V2>/ or <V3>/ to the same object at <V1>/
on the real host. The token stays on curl's stdin, and every other call goes
to curl unchanged. ucc's own-set check and every hash check run on the record
as written. Each aliased url (no token) is logged to ~/curl-alias.log; the
round copies it to u8/curl-alias.log.

Every --public U8 fetch therefore stays a real-host fetch with the token. The
fetch at the release's own path, unaliased, is proven by the install rows and
install-update (zitao2: install.sh --release <V1>, ucc stage downloading the
set, r253 cli/install-reinstall-zitao2.txt). U8-token-argv proves the token
stays off argv through the alias.

The two rows with their own curl shim, U8-token-argv and F40, chain to the
alias (u8_shim_on/u8_shim_off move it aside and back) instead of replacing and
deleting ~/.local/bin/curl. The non-public line is unchanged (file:// links;
U8_LINKS2 = U8_LINKS).
F28-incomplete-foreign regenerates § tooling through the round's mrd, as
F13 does, and scores missed when the plant does not land; r254's bare
tooling.sh found no mrd and the refusal named ucc:install.sh alone.
F25-record-two-names runs install.sh by hand with the followed
checkout's own remote, so #37's head check passes and the record is
what refuses (rc 4); with the forge's remote it stopped at rc 2.
This branch is already included in the target branch. There is nothing to merge.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin agent/5fa27f17-update-door-readers:agent/5fa27f17-update-door-readers
git switch agent/5fa27f17-update-door-readers

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff agent/5fa27f17-update-door-readers
git switch agent/5fa27f17-update-door-readers
git rebase main
git switch main
git merge --ff-only agent/5fa27f17-update-door-readers
git switch agent/5fa27f17-update-door-readers
git rebase main
git switch main
git merge --no-ff agent/5fa27f17-update-door-readers
git switch main
git merge --squash agent/5fa27f17-update-door-readers
git switch main
git merge --ff-only agent/5fa27f17-update-door-readers
git switch main
git merge agent/5fa27f17-update-door-readers
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
caoer115/ucc!37
No description provided.