57 lines
1.8 KiB
Markdown
57 lines
1.8 KiB
Markdown
# Phase 0.9E-R official Y2JB host sender audit
|
||
|
||
Date: 2026-07-18
|
||
|
||
Official sender:
|
||
`Gezine/Y2JB@0dbbf4e7e0203af7e5d101a3256c634edf4e3ba2:payload_sender.py`
|
||
|
||
Identity:
|
||
|
||
- size: 1064 bytes;
|
||
- SHA-256:
|
||
`8c87920c41dbdbd66b9f36ca9509f0d6bef9170f351dd97ff831cfb98e642ec6`;
|
||
- Git blob: `4ad80085bd8f2cf9ca3520d8ff1353b9c764fb75`;
|
||
- same blob in all five official tags;
|
||
- originating commit:
|
||
`edf0d631dd6e4dbd5a3db54ebdae47934d8bd994`.
|
||
|
||
The file was inspected statically and was never run against any network
|
||
target.
|
||
|
||
## Contract
|
||
|
||
| Lines | Behavior |
|
||
|---|---|
|
||
| 2 | `send_payload(path, host, port=50000)` |
|
||
| 3–4 | opens the selected local file `rb` and reads it completely |
|
||
| 6 | creates IPv4 TCP socket |
|
||
| 7 | blocking connect to caller-supplied host/port |
|
||
| 8 | `sendall(data)`; CPython manages short sends or raises |
|
||
| 9 | closes after successful `sendall` |
|
||
| 10 | reports local byte count, not peer acknowledgement |
|
||
| 14–22 | accepts `host file` or `host port file`; explicit port uses `int()` |
|
||
| 23–29 | prints usage/examples, including non-binding 9020 example |
|
||
|
||
Findings:
|
||
|
||
- binary mode: yes;
|
||
- default port: 50000;
|
||
- explicit port selection: yes;
|
||
- maximum input size: absent;
|
||
- timeout: absent;
|
||
- automatic retry/resume: absent;
|
||
- response read: absent;
|
||
- acknowledgement, remote byte count, checksum, or hash: absent;
|
||
- exception handling: absent; file/socket errors propagate;
|
||
- success exit: implicit zero;
|
||
- usage error exit: also implicit zero;
|
||
- local mutation: none; selected file is read-only;
|
||
- duplex classification: false.
|
||
|
||
The server added same-connection log writes in Y2JB 1.4, but this official
|
||
sender closes after `sendall` and never reads. Transport-level duplex
|
||
capability is not an end-to-end duplex sender contract.
|
||
|
||
No claim is made that this official sender is the one actually used by the
|
||
operator. That requires the separate operator attestation.
|