solpbc.org / solstone
personal memory agent
Star
Fork 0
Watch

fix(transfer): verify extracted import bytes against the manifest sha256 master

import_archive now verifies each extracted temp file's sha256 against the manifest before install_file promotes it. A mismatch aborts with the target file, expected hash, and actual hash, and installs nothing for that file. The plan pre-pass also fails visibly when an archive member has no manifest hash entry or the manifest lists a file the archive does not carry. Add a mismatch regression test covering the failed file, an earlier valid import, and an already-synced segment. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author Jer Miller Co-author Claude Opus 4.8 (1M context) Date Commit 9ddfa8a4 Parent 08617ec9
+123 -3
2 changed files