Ballast reviewer evidence — 0.4.11-beta

This companion describes one exact application archive. It is not an independent audit, Windows publisher certification or guarantee of safe trading. Check validation.json for actual results, skips and work that was not performed.

Contents and meaning

sbom.cdx.json: CycloneDX 1.6 component inventory of the locked runtime and

bootstrap wheels plus bundled JavaScript. Allowed wheel hashes are labeled as such; they are not asserted to be hashes of every user's installed files. Dependency relationships describe the recorded build platform without extras. Windows, the browser, Python standard library and hosted services are outside this inventory. Python is a separately supplied prerequisite.

dependency-audit.json: scanner/date/lock hashes and Python advisory findings.

It does not scan application behavior or certify vendored JavaScript.

validation.json: package gate results, exact archive hash and stated limits.
file-inventory.json: exact released member hashes.
tools/review_release.py: standalone read-only signature/archive verifier.

It does not import, extract, install or execute the application.

tests/: curated synthetic regression fixtures and isolated data setup.

This is a reproducible subset, not the complete maintainer test repository. The runner explicitly deselects one archive test requiring the undistributed maintainer packager; that test is still run in the complete release gate.

Verify before running

First inspect this utility's source and obtain the release public key through an independently trusted channel. A key from the same untrusted download cannot establish publisher identity. Use a separately trusted Python environment with cryptography available; do not launch Ballast to bootstrap verification.

python tools/review_release.py ..\ballast-0.4.11-beta.zip ..\ballast-0.4.11-beta.manifest.json --trusted-key TRUSTED_PUBLIC_KEY --evidence ..\ballast-0.4.11-beta-review-evidence.zip --evidence-manifest ..\ballast-0.4.11-beta-review-evidence.manifest.json

The verifier checks signed payloads, archive/member hashes, exact inventory, path safety, duplicate names, symlinks and evidence-to-application binding. A failure is a reason to stop. A pass establishes integrity under the supplied key; it does not prove that the signed author or code is trustworthy.

Optional synthetic regression checks

Review code before authorizing execution. Use a disposable Windows environment and a fresh Python virtual environment; install the supplied bootstrap and dev locks with pip --isolated --require-hashes --only-binary=:all:. Extract the verified application separately, then run:

python run_checks.py --app ..\ballast

The runner sets a temporary DATA_DIR, FORCE_PAPER and BALLAST_NO_SCHED. Tests use synthetic credentials and mocked provider/Windows-startup calls. It does not register real login startup or validate live trades. It does not install packages for you. See the source fixtures for precise coverage.

From the extracted application directory, the frontend regression can also be run with Node: node ..\review-evidence\tests\test_referral_counts_ui.js (adjust the companion path). It reads that directory's packaged main.js. The separate final-artifact receipt binds post-extraction checks to the exact ZIP and manifest inventory; package-gate results alone are working-tree checks.

For dependency reproduction, use a different disposable environment with the audit lock, then run python -m pip_audit --disable-pip --require-hashes --vulnerability-service pypi -r requirements.txt -f json. Recheck bootstrap and dev locks as well. New advisories may change results after the recorded scan.

Remaining trust work

This release has no established Windows Authenticode publisher signature and no commissioned external review. A host-isolated test is not a clean Windows VM or a different user's device. Read SECURITY.md in the application: noncredential records are not encrypted as a whole, same-user malware remains a threat, and ambiguous orders can block subsequent protective orders. Do not disable Windows security protections to make installation succeed.