Development record

2026-08-01 — itd-105 / spc-21, FIFTH round (concurrent session B, landed alongside the entry above): a fresh security review returned BLOCK on a bypass it reproduced, and a fresh correctness review returned MERGE with minor findings; both are closed here on the same branch. (1) BLOCKER — none of `hooks/bootstrap.sh`'s four `curl` calls passed `-q`, so curl loaded its own configuration surface: `$CURL_HOME/.curlrc` (curl >= 7.73, falling back to `$HOME/.curlrc`), where a single `connect-to` or `resolve` line re-points the connection while the URL on the command line still literally reads `https://github.com/…`. The transport pin `--proto '=https' --proto-redir '=https'` therefore still HELD and proved nothing, and because the binary and the `checksums.txt` that verifies it travel the same route, the SHA-256 check was vacuous — the poisoned config supplied both. Reproduced end to end before the fix: a `.curlrc` carrying `connect-to` plus its own `cacert` diverted all five requests to a second local server and installed the forged binary at the guard path, where it would run unattended as the Bash shell guard on every tool call. Fixed by passing `-q` as the FIRST argument of every call (curl honours it in no other position) and by removing, before any fetch, the other names curl reads without being told to: `HTTPS_PROXY https_proxy HTTP_PROXY http_proxy ALL_PROXY all_proxy CURL_HOME` and `CURL_CA_BUNDLE SSL_CERT_FILE SSL_CERT_DIR`. ACCEPTED COST, deliberately: a machine that can only reach the network through a proxy no longer bootstraps automatically — `refuse()` already names the manual-install and build-from-source ways out, and a proxy plus an attacker-chosen CA is precisely the pairing that makes the redirection succeed on TLS, so the seam is not worth keeping for the convenience. (2) MAJOR — the suite could not have caught (1): it only exercised the removed `ABCD_BOOTSTRAP_*` script variables, never curl's own config surface. `TestBootstrapIgnoresCurlsOwnConfigSurface` now runs the fixture-pointed copy with a poisoned `.curlrc` under both `CURL_HOME` and `HOME`, and asserts the published bytes are installed and the forger is contacted zero times; it was watched failing against the pre-fix script in exactly the shape described above. `TestBootstrapFetchOriginsAreConstants` gained the structural half — every `curl -` line must carry `curl -q ` as well as the literal transport pin, and both scrub lines must be present exactly once — verified by deleting a `-q` and shortening the scrub list and watching it fail. The one test-side concession is that `bootstrapFixtureScript` neutralises the CA-scrub line in its throwaway COPY, because `CURL_CA_BUNDLE` is the only way a real curl trusts the self-signed local fixture; that widens what curl will ACCEPT and can never name a different server, the `CURL_HOME`/proxy scrub stays intact in the copy (which is what makes the poisoned-config case meaningful), and the shipped bytes are held by the structural test. (3) MINOR — the `.binary-meta` install had no regular-file guard, so a directory at that path swallowed the record as `.binary-meta/binary-meta` (the same `mv -f` hazard `$binary` already refuses) while the success notice claimed provenance had been recorded. The install itself is genuine there, so this REPORTS rather than refuses: the notice now says the path exists and is not a regular file, and `TestBootstrapReportsAnObstructedBinaryMeta` proves the record is never moved into the obstruction. NOT FIXED, deliberately: the stale-lock double-break race (already disclosed and accepted above), the "120 bytes" comment wording and the `checksums.txt` text-vs-binary-mode parsing convention (cosmetic, not worth the churn at a merge gate), and the hook-ordering assumption (already disclosed, no code change).