# Echo Proof Lab 0.1

Run the reference. Inspect the effect. Publish the limits.

This source kit runs ten adversarial cases against the existing HAP-1 / Draft
Desk file gate. It creates real synthetic files and signed snapshots, then
checks those files with a separate Python verifier. It does not contact a
Money Musk API, require an account, or use a coin. It is authored by Money Musk;
running it is not evidence that an outside team implemented the protocol.

## Prepare once

Extract `echo-proof-lab.zip`. Use Linux or macOS, Node 22.13+ (22.x) or Node 24,
Python 3, and the pinned Python dependency. Windows is not supported by the
inherited Draft Desk private-directory profile. Preparation may need internet:

```sh
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install -r hap1/requirements-verify.txt
```

Read the source and authenticate its origin. The source digest manifest is
unsigned. A digest supplied alongside a download is not independent trust.
No package installation, DNS lookup or HTTP request is part of the authority
flow. The basic runner performs a bounded network-denial probe against a reserved
documentation address and a local UDP socket; it does not send user data.

## Reproduce

```sh
node proof-lab/run.mjs
```

The command prints a fresh temporary output directory and an unsigned report.
Keep that directory for review. Each case has its own `outbox`, signed
`evidence.json` and public `pin.json`. Signing keys exist only in process memory.
Only fixed synthetic drafts are accepted by this runner. There is no input for
private documents, credentials or an actual payment.

The basic command does not establish network isolation. For Linux with
`libseccomp.so.2`, use the stricter launcher:

```sh
python3 proof-lab/isolate.py --run
```

It applies inherited kernel syscall restrictions before starting Node: socket
creation/use and io_uring submission are denied. The runner must observe denied
TCP and UDP probes or the run is refused. It does not disable host networking or
request administrator access. Restrictions apply to this process tree only;
local files, pipes and anonymous Unix socket pairs still work. Trusted source,
OS and libraries remain assumptions.
Do not present this as a general sandbox for arbitrary untrusted code.

A separate Linux Landlock probe attempts direct create, overwrite and delete
operations from a restricted child. Its result is `LANDLOCK_DENIED`, `UNSUPPORTED`
or `FAILED`. The probe does not retrofit a sandbox onto every Echo application.
To require both restrictions, use:

```sh
python3 proof-lab/isolate.py --run --require-landlock
```

Unsupported protection never becomes a successful isolation result. A basic
reference run may pass its protocol cases while Landlock is unsupported; read
the separate fields. The strict command exits nonzero in that situation.

## Inspect the files

```sh
python3 proof-lab/verify-run.py /path/to/echo-proof-lab-RUN
```

This checks the source snapshot, case ordering, retained key pins, signature
chains, exact action bindings, signed results and supplied file bytes. It does
not trust `passed: true` in a report. Changing an output file or signature fails
verification. Inspect the pins independently: a complete bundle provided by one
untrusted person does not authenticate that person or prove a real execution.

The checker reports historical evidence only. It cannot reconstruct the live
network or OS restrictions from an unsigned report; reproduce those locally.
No report is a new permit, proof of human presence, independent audit, Bitcoin
timestamp, production payment settlement or universal non-execution.

## Share carefully

`report.json` contains fixed case IDs, source/evidence digests and bounded result
codes. It contains no draft text, keys, account IDs, hostname, local path or
operator identity. It is deliberately unsigned and does not identify a reviewer.

The full case directories contain synthetic drafts, signed evidence, public
keys and local journals. Keep pins separately if distributing a review bundle.
Do not use this profile to redact arbitrary production evidence: removing text
from an existing signed file is not a valid privacy-preserving proof.

All independence/adoption/human-presence claims remain false in generated
reports. An external reviewer should add a separate record using `REVIEW.md`;
the runner cannot determine who operated it or whether their code is original.

## Understand the five-second case

The test clock is controlled, not a physical latency measurement. One case
intentionally withholds revocation and dispatches at 4,999 ms using an already
issued permit. That expected save exposes the remaining window. At 5,000 ms a
different case refuses. Delivered revocation before final dispatch defeats the
permit and survives reopening. Revocation cannot undo a completed file.

No physical phone, QR, sensor, bank or robot is exercised by this kit. Echo
Connect's real iPhone/computer pairing remains a separate field test.