Pin overnight DTD artifacts by hash

3a963587b2a78f9488a5f61df892b16b64ee76c1 · 2026-09-02 23:45:00 -0700 · Steve Abrams
Files touched

A config/yoloforever-dtd-sha256.tsv
M scripts/codex-yoloforever.sh
M scripts/verify-zero-cost-dtd.sh
M test/yoloforever-preflight-boundary.sh
Diff

commit 3a963587b2a78f9488a5f61df892b16b64ee76c1
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Sep 2 23:45:00 2026 -0700

    Pin overnight DTD artifacts by hash
---
 config/yoloforever-dtd-sha256.tsv      |  3 +++
 scripts/codex-yoloforever.sh           |  2 +-
 scripts/verify-zero-cost-dtd.sh        | 24 +++++++++++++++++++++---
 test/yoloforever-preflight-boundary.sh | 26 +++++++++++++++++++++++---
 4 files changed, 48 insertions(+), 7 deletions(-)

diff --git a/config/yoloforever-dtd-sha256.tsv b/config/yoloforever-dtd-sha256.tsv
new file mode 100644
index 00000000..d8968301
--- /dev/null
+++ b/config/yoloforever-dtd-sha256.tsv
@@ -0,0 +1,3 @@
+agents_panel	ef59033e6cd1423568099bed98080438d88a63de86ccb4acda4ba1d9e21bb042
+agents_post	622affd2a7e1abd74e07371e0ce5169f4b1f120a0c8be31a150e40f00a9115a9
+claude_panel	863910ebbc3ac617cf26889c78ba07c7ff5763b4ca0a8df3cef997d3d9c65430
diff --git a/scripts/codex-yoloforever.sh b/scripts/codex-yoloforever.sh
index d5fe78d1..d3b4804a 100755
--- a/scripts/codex-yoloforever.sh
+++ b/scripts/codex-yoloforever.sh
@@ -31,7 +31,7 @@ if [[ "${CYF_TEST_MODE:-0}" == 1 ]]; then
   LAUNCHCTL="${CYF_TEST_LAUNCHCTL:?CYF_TEST_LAUNCHCTL is required in test mode}"
   PLIST="$ROOT/com.steve.codex-yoloforever.plist"
   if [[ -n "${CYF_TEST_AGENTS_PANEL:-}" ]]; then
-    PREFLIGHT_ARGS=("$CYF_TEST_AGENTS_PANEL" "$CYF_TEST_AGENTS_POST" "$CYF_TEST_CLAUDE_PANEL")
+    PREFLIGHT_ARGS=("$CYF_TEST_AGENTS_PANEL" "$CYF_TEST_AGENTS_POST" "$CYF_TEST_CLAUDE_PANEL" "${CYF_TEST_DTD_MANIFEST:?CYF_TEST_DTD_MANIFEST is required with test artifacts}")
   fi
 fi
 
diff --git a/scripts/verify-zero-cost-dtd.sh b/scripts/verify-zero-cost-dtd.sh
index a903baa1..71be5477 100755
--- a/scripts/verify-zero-cost-dtd.sh
+++ b/scripts/verify-zero-cost-dtd.sh
@@ -4,14 +4,32 @@ set -euo pipefail
 AGENTS_PANEL="${1:-/Users/macstudio3/.agents/skills/dtd/scripts/panel.sh}"
 AGENTS_POST="${2:-/Users/macstudio3/.agents/skills/dtd/scripts/post-decision-codex.sh}"
 CLAUDE_PANEL="${3:-/Users/macstudio3/.claude/skills/dtd/scripts/panel.sh}"
+PROJECT_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+MANIFEST="${4:-$PROJECT_ROOT/config/yoloforever-dtd-sha256.tsv}"
 TMP=$(mktemp -d /private/tmp/yoloforever-zero-cost-preflight.XXXXXX)
 trap 'rm -rf "$TMP"' EXIT
 
-for script in "$AGENTS_PANEL" "$AGENTS_POST" "$CLAUDE_PANEL"; do
+[[ -f "$MANIFEST" ]] || { echo "missing DTD hash manifest: $MANIFEST" >&2; exit 1; }
+
+verify_hash() {
+  local key="$1" script="$2" expected actual matches
   [[ -f "$script" ]] || { echo "missing DTD artifact: $script" >&2; exit 1; }
   bash -n "$script"
-done
-shasum -a 256 "$AGENTS_PANEL" "$AGENTS_POST" "$CLAUDE_PANEL"
+  matches=$(awk -F '\t' -v key="$key" '$1 == key { count++ } END { print count + 0 }' "$MANIFEST")
+  [[ "$matches" == 1 ]] || { echo "manifest must contain exactly one $key entry" >&2; exit 1; }
+  expected=$(awk -F '\t' -v key="$key" '$1 == key { print $2 }' "$MANIFEST")
+  [[ "$expected" =~ ^[0-9a-f]{64}$ ]] || { echo "invalid expected hash for $key" >&2; exit 1; }
+  actual=$(shasum -a 256 "$script" | awk '{ print $1 }')
+  [[ "$actual" == "$expected" ]] || {
+    echo "DTD artifact hash mismatch: $key expected=$expected actual=$actual path=$script" >&2
+    exit 1
+  }
+  printf 'VERIFIED %s %s %s\n' "$key" "$actual" "$script"
+}
+
+verify_hash agents_panel "$AGENTS_PANEL"
+verify_hash agents_post "$AGENTS_POST"
+verify_hash claude_panel "$CLAUDE_PANEL"
 
 mkdir -p "$TMP/bin" "$TMP/home/Projects/secrets-manager" "$TMP/home/.claude/skills/dtd"
 printf '%s\n' \
diff --git a/test/yoloforever-preflight-boundary.sh b/test/yoloforever-preflight-boundary.sh
index c1358303..2dcd0878 100755
--- a/test/yoloforever-preflight-boundary.sh
+++ b/test/yoloforever-preflight-boundary.sh
@@ -7,6 +7,7 @@ PREFLIGHT="$ROOT/scripts/verify-zero-cost-dtd.sh"
 AGENTS_PANEL="/Users/macstudio3/.agents/skills/dtd/scripts/panel.sh"
 AGENTS_POST="/Users/macstudio3/.agents/skills/dtd/scripts/post-decision-codex.sh"
 CLAUDE_PANEL="/Users/macstudio3/.claude/skills/dtd/scripts/panel.sh"
+PROD_MANIFEST="$ROOT/config/yoloforever-dtd-sha256.tsv"
 TMP=$(mktemp -d /private/tmp/yoloforever-preflight-boundary.XXXXXX)
 trap 'rm -rf "$TMP"' EXIT
 
@@ -28,7 +29,7 @@ SHIM
 }
 
 run_isolated() {
-  local root="$1" panel="$2"
+  local root="$1" panel="$2" manifest="$3"
   CYF_TEST_MODE=1 \
   CYF_TEST_ROOT="$root" \
   CYF_TEST_CODEX="$root/bin/codex" \
@@ -37,6 +38,7 @@ run_isolated() {
   CYF_TEST_AGENTS_PANEL="$panel" \
   CYF_TEST_AGENTS_POST="$AGENTS_POST" \
   CYF_TEST_CLAUDE_PANEL="$CLAUDE_PANEL" \
+  CYF_TEST_DTD_MANIFEST="$manifest" \
   CYF_MARKER="$root/codex.marker" \
   CYF_LAUNCHCTL_MARKER="$root/launchctl.marker" \
   zsh "$RUNNER" run
@@ -53,9 +55,14 @@ claude -p "$1" > "$DIR/claude.txt"
 printf 'unguarded\n' > "$DIR/codex.txt"
 BAD
 chmod +x "$TMP/unguarded-panel.sh"
+unguarded_hash=$(shasum -a 256 "$TMP/unguarded-panel.sh" | awk '{ print $1 }')
+agents_post_hash=$(shasum -a 256 "$AGENTS_POST" | awk '{ print $1 }')
+claude_panel_hash=$(shasum -a 256 "$CLAUDE_PANEL" | awk '{ print $1 }')
+printf 'agents_panel\t%s\nagents_post\t%s\nclaude_panel\t%s\n' \
+  "$unguarded_hash" "$agents_post_hash" "$claude_panel_hash" > "$TMP/unguarded-manifest.tsv"
 
 set +e
-run_isolated "$NEG" "$TMP/unguarded-panel.sh"
+run_isolated "$NEG" "$TMP/unguarded-panel.sh" "$TMP/unguarded-manifest.tsv"
 negative_rc=$?
 set -e
 [[ "$negative_rc" == 78 ]]
@@ -64,9 +71,22 @@ set -e
 grep -q '^disable gui/.*/com\.steve\.codex-yoloforever$' "$NEG/launchctl.marker"
 grep -q 'safety tripwire: zero-cost DTD preflight failed' "$NEG/codex-yoloforever.log"
 
+DRIFT="$TMP/drift"
+make_root "$DRIFT"
+cp "$AGENTS_PANEL" "$TMP/drifted-panel.sh"
+printf '\n' >> "$TMP/drifted-panel.sh"
+set +e
+run_isolated "$DRIFT" "$TMP/drifted-panel.sh" "$PROD_MANIFEST"
+drift_rc=$?
+set -e
+[[ "$drift_rc" == 78 ]]
+[[ -f "$DRIFT/data/codex-yoloforever/STOPPED" ]]
+[[ ! -e "$DRIFT/codex.marker" ]]
+grep -q 'DTD artifact hash mismatch: agents_panel' "$DRIFT/data/codex-yoloforever/zero-cost-preflight.log"
+
 POS="$TMP/positive"
 make_root "$POS"
-run_isolated "$POS" "$AGENTS_PANEL"
+run_isolated "$POS" "$AGENTS_PANEL" "$PROD_MANIFEST"
 [[ ! -e "$POS/data/codex-yoloforever/STOPPED" ]]
 grep -q 'runner codex invoked DTD_ZERO_COST=1' "$POS/codex.marker"
 grep -q '^PASS zero-cost DTD preflight$' "$POS/data/codex-yoloforever/zero-cost-preflight.log"
← 44ade028 Fail closed on zero-cost DTD drift · back to Ticket System · record collision-safe yoloforever cycle 5de64894 →