Problem
fabric update --url accepts only --sha256. The explicit source sets expected_version to None.
The updater runs the staged binary with --version, but it has no caller-provided version for comparison. Any valid older or wrong build reports its own version and passes this check.
The SHA-256 proves that the downloaded bytes match the caller's hash. It does not prove that the build is newer or that the caller selected the correct asset.
The tag path has a separate protection. It compares the installed and available Git commits through the GitHub API. It refuses an older or diverged build unless the caller gives the explicit downgrade override. The URL path performs no equivalent direction or expected-version check.
Discovery
This gap was accepted deliberately on 2026-09-05 for Bluey's planned update. Bluey's strict one-member reader cannot install the canonical paired 0.2.4 archive. It must use a distinct one-member asset through --url and --sha256.
Silber.cos will compare the literal URL and checksum against the published 0.2.4 release before Nathan receives the command. This human comparison replaces the missing machine check for one update only.
Do not rely on this human control a second time.
Intended follow-up
Design an explicit-source expected-version input. The updater must compare it with the staged binary's reported version before any installed path changes.
Keep this change separate from release 0.2.4. A new update option on the weakest-recovery machine would add more release risk than it removes today.
Problem
fabric update --urlaccepts only--sha256. The explicit source setsexpected_versiontoNone.The updater runs the staged binary with
--version, but it has no caller-provided version for comparison. Any valid older or wrong build reports its own version and passes this check.The SHA-256 proves that the downloaded bytes match the caller's hash. It does not prove that the build is newer or that the caller selected the correct asset.
The tag path has a separate protection. It compares the installed and available Git commits through the GitHub API. It refuses an older or diverged build unless the caller gives the explicit downgrade override. The URL path performs no equivalent direction or expected-version check.
Discovery
This gap was accepted deliberately on 2026-09-05 for Bluey's planned update. Bluey's strict one-member reader cannot install the canonical paired 0.2.4 archive. It must use a distinct one-member asset through
--urland--sha256.Silber.cos will compare the literal URL and checksum against the published 0.2.4 release before Nathan receives the command. This human comparison replaces the missing machine check for one update only.
Do not rely on this human control a second time.
Intended follow-up
Design an explicit-source expected-version input. The updater must compare it with the staged binary's reported version before any installed path changes.
Keep this change separate from release 0.2.4. A new update option on the weakest-recovery machine would add more release risk than it removes today.