fix(security): stabilize remote checksum requirements

Author: Dicklesworthstone

scripts/generated/internal_checksums.sh

@@ -8,7 +8,7 @@
 # Used by check-manifest-drift.sh to detect unauthorized changes.
 
 declare -gA ACFS_INTERNAL_CHECKSUMS=(
-  [scripts/lib/security.sh]="3fbf41fedfc47a8ef7bf382d6ca9b5d5a64db223a00a367fd2616a08c54a98a6"
+  [scripts/lib/security.sh]="e71370eab043af60c60e56a627410ea5073c9715b9a4bbf213536b407c35d192"
   [scripts/lib/agents.sh]="66fac24c48c9ce7d17ae213ff2f8669a1902e77f01266f4eeaccdcef09e02856"
   [scripts/lib/update.sh]="c6c35bbaec3ce7d62e1ad024a1583ec99a58b3a89587b010ed37f70aadf5906f"
   [scripts/lib/doctor.sh]="8b055f242330f1e9571bb25d006ff09cf1f8bcbe81ba07260959e37c1b0f9e2b"

scripts/lib/security.sh

@@ -375,6 +375,7 @@ declare -gA KNOWN_INSTALLERS=(
     [asb]="https://raw.githubusercontent.com/Dicklesworthstone/agent_settings_backup_script/main/install.sh"
     [pcr]="https://raw.githubusercontent.com/Dicklesworthstone/post_compact_reminder/main/install-post-compact-reminder.sh"
 )
+declare -ga ACFS_SECURITY_REQUIRED_INSTALLERS=("${!KNOWN_INSTALLERS[@]}")
 
 # ============================================================
 # Checksum Verification Policy
@@ -1079,7 +1080,7 @@ acfs_checksums_file_looks_valid() {
         fi
     done < "$file"
 
-    for tool in "${!KNOWN_INSTALLERS[@]}"; do
+    for tool in "${ACFS_SECURITY_REQUIRED_INSTALLERS[@]}"; do
         if [[ -z "${parsed_installers[$tool]:-}" ]] || [[ -z "${parsed_checksums[$tool]:-}" ]]; then
             return 1
         fi

tests/unit/lib/test_security.bats

@@ -22,7 +22,7 @@ write_security_checksums_fixture() {
     local index=1
 
     printf 'installers:\n' > "$output_file"
-    for tool in "${!KNOWN_INSTALLERS[@]}"; do
+    for tool in "${ACFS_SECURITY_REQUIRED_INSTALLERS[@]}"; do
         printf -v checksum '%064d' "$index"
         printf '  %s:\n' "$tool" >> "$output_file"
         printf '    url: "%s"\n' "${KNOWN_INSTALLERS[$tool]}" >> "$output_file"
@@ -528,6 +528,17 @@ EOF
     assert_failure
 }
 
+@test "acfs_checksums_file_looks_valid: ignores dynamic local installer keys" {
+    local full_file
+    full_file="$(create_temp_file)"
+
+    write_security_checksums_fixture "$full_file"
+    KNOWN_INSTALLERS["local_only_tool"]="https://example.com/local-only.sh"
+
+    run acfs_checksums_file_looks_valid "$full_file"
+    assert_success
+}
+
 @test "acfs_refresh_loaded_checksums_from_remote: partial remote metadata preserves loaded state" {
     local existing_sha="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"