chimera-gfx-Public/docs/runtime/phase-0.9e-r-official-hostsender-audit.md

Phase 0.9E-R official Y2JB host sender audit

Date: 2026-07-18

Official sender: Gezine/Y2JB@0dbbf4e7e0203af7e5d101a3256c634edf4e3ba2:payload_sender.py

Identity:

• size: 1064 bytes;
• SHA-256: 8c87920c41dbdbd66b9f36ca9509f0d6bef9170f351dd97ff831cfb98e642ec6;
• Git blob: 4ad80085bd8f2cf9ca3520d8ff1353b9c764fb75;
• same blob in all five official tags;
• originating commit: edf0d631dd6e4dbd5a3db54ebdae47934d8bd994.

The file was inspected statically and was never run against any network target.

Contract

Lines	Behavior
2	send_payload(path, host, port=50000)
3–4	opens the selected local file rb and reads it completely
6	creates IPv4 TCP socket
7	blocking connect to caller-supplied host/port
8	sendall(data); CPython manages short sends or raises
9	closes after successful sendall
10	reports local byte count, not peer acknowledgement
14–22	accepts host file or host port file; explicit port uses int()
23–29	prints usage/examples, including non-binding 9020 example

Findings:

• binary mode: yes;
• default port: 50000;
• explicit port selection: yes;
• maximum input size: absent;
• timeout: absent;
• automatic retry/resume: absent;
• response read: absent;
• acknowledgement, remote byte count, checksum, or hash: absent;
• exception handling: absent; file/socket errors propagate;
• success exit: implicit zero;
• usage error exit: also implicit zero;
• local mutation: none; selected file is read-only;
• duplex classification: false.

The server added same-connection log writes in Y2JB 1.4, but this official sender closes after sendall and never reads. Transport-level duplex capability is not an end-to-end duplex sender contract.

No claim is made that this official sender is the one actually used by the operator. That requires the separate operator attestation.