Test: Prove verified bootstrap boundaries

tests/setup/readme-contract

@@ -19,6 +19,8 @@ panama="$repo_dir/bin/panama"
 
 findings=()
 note() { findings+=("$1"); }
+work="$(mktemp -d)"
+trap 'rm -rf -- "$work"' EXIT
 
 # ── Verified bootstrap command ───────────────────────────────────────────────
 
@@ -88,6 +90,87 @@ if grep -qE 'curl[^|]*\|[[:space:]]*(bash|sh)|bash[[:space:]]+<\(curl' "$readme"
     note 'the README pipes a network response into a shell'
 fi
 
+# Run the two exact documented blocks with a successful download and a failing
+# checksum. The Bash adapter records only the verified boot invocation; the
+# contract itself uses /usr/bin/bash so the adapter cannot hide this behavior.
+checksum_stub_dir="$work/checksum-bin"
+checksum_boot_calls="$work/checksum-boot-calls"
+mkdir -p "$checksum_stub_dir"
+
+cat >"$checksum_stub_dir/curl" <<'STUB'
+#!/usr/bin/bash
+set -u
+destination=""
+while (( $# > 0 )); do
+    case "$1" in
+        --output)
+            destination="${2:-}"
+            shift 2
+            ;;
+        *) shift ;;
+    esac
+done
+[[ -n "$destination" ]] || exit 97
+printf 'tampered boot bytes\n' >"$destination"
+STUB
+chmod +x "$checksum_stub_dir/curl"
+
+cat >"$checksum_stub_dir/sha256sum" <<'STUB'
+#!/usr/bin/bash
+[[ "${1:-}" == -c ]] || exit 97
+exit 1
+STUB
+chmod +x "$checksum_stub_dir/sha256sum"
+
+cat >"$checksum_stub_dir/bash" <<'STUB'
+#!/usr/bin/bash
+printf 'verified-boot %s\n' "$*" >>"$PANAMA_README_BOOT_CALLS"
+exit 0
+STUB
+chmod +x "$checksum_stub_dir/bash"
+
+mapfile -d $'\036' -t bootstrap_snippets < <(
+    awk '
+      /^```sh$/ { in_block = 1; block = ""; next }
+      /^```$/ && in_block {
+        if (block ~ /bootstrap_commit=/) printf "%s%c", block, 30
+        in_block = 0
+        next
+      }
+      in_block { block = block $0 "\n" }
+    ' "$readme"
+)
+
+checksum_failure_stops_boot() {
+    local snippet="$1" status
+    : >"$checksum_boot_calls"
+    PATH="$checksum_stub_dir:/usr/bin:/bin" \
+      PANAMA_README_BOOT_CALLS="$checksum_boot_calls" \
+      /usr/bin/bash -c "$snippet" >/dev/null 2>&1
+    status=$?
+    (( status != 0 )) && [[ ! -s "$checksum_boot_calls" ]]
+}
+
+if (( ${#bootstrap_snippets[@]} != 2 )); then
+    note 'the README does not contain exactly two executable verified bootstrap blocks'
+else
+    bootstrap_labels=(desktop server)
+    for index in "${!bootstrap_snippets[@]}"; do
+        snippet="${bootstrap_snippets[$index]}"
+        label="${bootstrap_labels[$index]}"
+        if ! checksum_failure_stops_boot "$snippet"; then
+            note "the $label command invoked boot after checksum failure"
+        fi
+
+        weakened_snippet="${snippet//$'set -euo pipefail\n'/}"
+        if [[ "$weakened_snippet" == "$snippet" ]]; then
+            note "the $label command has no fail-closed shell control to test"
+        elif checksum_failure_stops_boot "$weakened_snippet"; then
+            note "the $label checksum assertion accepts removal of fail-closed shell control"
+        fi
+    done
+fi
+
 # ── The contract count ───────────────────────────────────────────────────────
 #
 # Counted the way `panama test` collects the suite, so the README agrees with