2 Commits

Include renames

Author	SHA1	Message	Date
ilaandClaude Fable 5	09f56478d3	Add Phase 3 review cross-check ruling ... Adjudicate Codex's review correction: concede three overstatements in the original review (M3 loop not actually complete - InstallService has no production assembly and T-401 launch is unbuilt; scope 'no security defect' to T-302/T-303; O2 mischaracterized - ENOSPC during io.Copy is misclassified as zip_corrupt with a broken error chain, escalate to P1; O1 fix was flawed - recheck IsRunning explicitly instead of inferring app_running from rename failure). Add finding: disk-full surfaces at write/sync/close with three different codes, so the O2 fix must span the whole write->sync->close sequence. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 20:06:55 +08:00
ilaandClaude Fable 5	1ad00f8ef2	Add Phase 3 install integration review (T-301~T-303) ... Code-level audit of the verified install chain: hash-before-parse and single-file-handle TOCTOU defenses in verified_package.go, strict app.json parse cross-checked against the signed Catalog, untrusted download verified against Catalog Size/SHA256, mandatory non-bypassable pre-extract disk/running checks, and a complete stable failure-code enum. No security defect found; records five minor optimizations, the top being the IsRunning TOCTOU (recheck before the current->backup rename). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-19 19:44:57 +08:00