[object Object]

← back to Ticket System

pin the canonical DTD cost guard

44846a550cd1c5e2024b8de481c81e094f961068 · 2026-09-03 07:18:30 -0700 · Steve Abrams

Files touched

Diff

commit 44846a550cd1c5e2024b8de481c81e094f961068
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 3 07:18:30 2026 -0700

    pin the canonical DTD cost guard
---
 config/yoloforever-dtd-sha256.tsv |  6 +++---
 scripts/verify-zero-cost-dtd.sh   | 15 ++++++++-------
 test/yoloforever-zero-cost-dtd.sh | 13 +++++++------
 3 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/config/yoloforever-dtd-sha256.tsv b/config/yoloforever-dtd-sha256.tsv
index 2aeb8429..3c3dbb14 100644
--- a/config/yoloforever-dtd-sha256.tsv
+++ b/config/yoloforever-dtd-sha256.tsv
@@ -1,3 +1,3 @@
-agents_panel	c24e4ccdd8b2ea3b02cb4daaef27188fe50008788445593daa410864f0f346e3
-agents_post	b5613185dc39b1f66dc889106c519646ab24ce52a280066d5ac2ab53dd3cdcab
-claude_panel	d1cac86ad432fe2afb9457e54d2cdcacd834643290a22850718dbf304ff19aac
+agents_panel	c62d3ad635af598fb41c029c8d272f079a420cd9812a34a71ff08e776d59c93b
+agents_post	c89d41d74256d739f7bb0756ccd8d8e25228398b026abfb49d5c594fffe7f503
+claude_panel	ba5636f32e338483fdcd2cfd4fd79a0529740408ba3f68b8c5eb78222583e102
diff --git a/scripts/verify-zero-cost-dtd.sh b/scripts/verify-zero-cost-dtd.sh
index fb730c47..4fe8ea0d 100755
--- a/scripts/verify-zero-cost-dtd.sh
+++ b/scripts/verify-zero-cost-dtd.sh
@@ -101,15 +101,16 @@ if grep -Eq 'CLAUDE|api\.openai\.com|api\.x\.ai|api\.moonshot\.ai' "$TMP/calls.l
 fi
 grep -q '^CODEX ' "$TMP/calls.log"
 
-# Missing guard is unsafe and must fail before any provider command.
+# A redirected guard is unsafe even when readable and must fail before any provider command.
 : > "$TMP/calls.log"
+printf 'PAID_ALLOWED\n' > "$TMP/redirected-cost-mode"
 set +e
-DTD_COST_MODE_FILE="$TMP/missing-cost-mode" DTD_DIR="$TMP/missing" bash "$AGENTS_PANEL" "Choose A or B" >/dev/null 2>&1
-missing_panel_rc=$?
-DTD_COST_MODE_FILE="$TMP/missing-cost-mode" bash "$AGENTS_POST" "$TMP/agents" A >/dev/null 2>&1
-missing_post_rc=$?
+DTD_COST_MODE_FILE="$TMP/redirected-cost-mode" DTD_DIR="$TMP/redirected" bash "$AGENTS_PANEL" "Choose A or B" >/dev/null 2>&1
+redirected_panel_rc=$?
+DTD_COST_MODE_FILE="$TMP/redirected-cost-mode" bash "$AGENTS_POST" "$TMP/agents" A >/dev/null 2>&1
+redirected_post_rc=$?
 set -e
-[[ "$missing_panel_rc" == 78 ]]
-[[ "$missing_post_rc" == 78 ]]
+[[ "$redirected_panel_rc" == 78 ]]
+[[ "$redirected_post_rc" == 78 ]]
 [[ ! -s "$TMP/calls.log" ]]
 echo "PASS zero-cost DTD preflight"
diff --git a/test/yoloforever-zero-cost-dtd.sh b/test/yoloforever-zero-cost-dtd.sh
index 4b06739b..c2c5fe89 100755
--- a/test/yoloforever-zero-cost-dtd.sh
+++ b/test/yoloforever-zero-cost-dtd.sh
@@ -86,14 +86,15 @@ fi
 grep -q '^CODEX ' "$TMP/calls.log"
 
 : > "$TMP/calls.log"
+printf 'PAID_ALLOWED\n' > "$TMP/redirected-mode"
 set +e
-DTD_COST_MODE_FILE="$TMP/missing-mode" DTD_DIR="$TMP/missing-mode-run" bash "$AGENTS_PANEL" "Choose A or B" >/dev/null 2>&1
-missing_panel_rc=$?
-DTD_COST_MODE_FILE="$TMP/missing-mode" bash "$AGENTS_POST" "$TMP/agents-zero" A >/dev/null 2>&1
-missing_post_rc=$?
+DTD_COST_MODE_FILE="$TMP/redirected-mode" DTD_DIR="$TMP/redirected-mode-run" bash "$AGENTS_PANEL" "Choose A or B" >/dev/null 2>&1
+redirected_panel_rc=$?
+DTD_COST_MODE_FILE="$TMP/redirected-mode" bash "$AGENTS_POST" "$TMP/agents-zero" A >/dev/null 2>&1
+redirected_post_rc=$?
 set -e
-[[ "$missing_panel_rc" == 78 ]]
-[[ "$missing_post_rc" == 78 ]]
+[[ "$redirected_panel_rc" == 78 ]]
+[[ "$redirected_post_rc" == 78 ]]
 [[ ! -s "$TMP/calls.log" ]]
 
 bash -n "$AGENTS_PANEL" "$AGENTS_POST" "$CLAUDE_PANEL"

← 8dea1d94 prove both DTD entry points fail closed  ·  back to Ticket System  ·  close zero-cost legacy-panel proof gap 09aeede0 →