Audit question: is the documentation coherent, and is the app portable
to a fresh machine (macOS) with proper isolation? Findings and fixes:
- README never mentioned the cockpit/deck/lab manual (three rounds of UI
evolution invisible at the front door). Added: human-surface section
with the one command, expanded Install (editable-from-clone is the
supported mode — repo files are part of the product; zero-install
PYTHONPATH=src alternative; fresh-machine skip behavior), macOS
openssl/LibreSSL Ed25519 prerequisite with a one-line self-check,
wallet commands in the command list.
- The lab manual violated the repo's own macOS law (AGENTS.md): GNU
sha256sum -> shasum -a 256; GNU sed -i -> portable python3 -c
one-liner (executed and output-matched before shipping: entry 0 hash
mismatch, BROKEN, exit 1).
- Fresh-clone bootstrap was actually tested end to end in a scratch
clone: zero-install suite 130 passed / 0 failed / 14 skipped after
fixing the one unguarded test (test_ledger_is_hash_chained now skips
like its siblings when the dogfood binary is absent - capability gap,
not failure); venv + pip install -e . -> pacta console script serves
bridge/deck/manual/sample-prefill/drift-tripwire with no PYTHONPATH.
- PYTHONPATH incantations simplified: cockpit needs src only (provider
never imported by src/pacta); manual + cockpit.md updated.
- threat-model.md: cockpit attack-surface note (no mutating routes,
no auth because nothing to operate, localhost-only disclosure risk,
probe-only network I/O, fake-cockpit = host-compromise boundary).
- products.md: cockpit named as the shared human surface of all four
profiles. AGENTS.md: doc-portability law + the cockpit's three laws
added to the standing guidance.
Suite 144 green here; 130/0/14 on a bare clone.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
README: truth boundary rewritten to the proven four-tier reality (with
the still-unproven list at equal weight); risk expectations state the
R4 path and the now-openable wallet gate; new sections for the STH
pin store / split-view defense and the dogfood verifier; notebook
course list gains lecture 9 and the ratchet rule; test-runner note.
AGENTS.md gains the operating rules the new subsystems depend on:
boundary tables mirror the repos' buttons (the button is the
authority); observation-vs-verdict for providers; degradation
semantics for partial attestations; the pinning rules (equivocation,
growth-needs-proof, rollback, anchor-root checking); dogfood
provenance/fallback-visibility rules; ML-DSA stays fail-closed; the
mini runner must keep covering the whole suite.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
