From 21e3e84b147c58d02581ad5c8cbe99c4d579d05c Mon Sep 17 00:00:00 2001 From: Russell Ballestrini Date: Thu, 28 May 2026 19:20:57 -0400 Subject: [PATCH] CLAUDE.md: document make stamp page-integrity workflow --- CLAUDE.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 6baa0ff..e16683e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -119,3 +119,22 @@ Handshake frame: `[0x5A 0x42 0x01 baud_lo baud_hi xor_cksum]` — 6 bytes at 50 - stereo (channels=2) required for Battle Toads — open web/index.html, click 'start audio' - userland only — survives without root - **Operation Voyeur**: all terminal output is public — never pass secrets through these channels unencrypted. The web page does ECDH key exchange + AES-256-GCM before TX. + +### Web page integrity stamping + +Each deployed page (`web/chat.html`, `web/zebra-audio.html`, `web/how-it-works.html`) +carries a footer with the build date + its own MD5 + SHA-256. **Run `make stamp` +before deploying any page change** — it sets today's date and recomputes the +hashes (`web/stamp.js`). + +- A file can't hold its own hash, so the hashes are computed with the two hash + fields **zeroed**, then written back (same length). Self-consistent and + idempotent: re-running `make stamp` gives identical hashes unless the content + changed. +- The stamp is **static HTML written at build time** — no JavaScript computes or + injects it in the browser. `stamp.js` is build tooling, never loaded by a page. +- **Verify a served page**: blank the md5 field to 32 zeros and the sha256 field + to 64 zeros, then re-hash with `sha256sum`/`md5sum` — must match the footer. +- **Deploy flow**: edit `web/*.html` → `make stamp` → commit here → copy the + page(s) into `~/git/www.unturf.com/zebra-report/` (`chat.html` → `index.html`, + others same name) → commit + push there.