From aa0f91d24e286788e3ed09b33c148d4c6691012a Mon Sep 17 00:00:00 2001 From: "will.anderson" Date: Fri, 21 Aug 2026 17:18:25 -0500 Subject: [PATCH] docs(audit): post-uninstall anomaly entry, classified mundane with escalation criteria --- FORK-AUDIT.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/FORK-AUDIT.md b/FORK-AUDIT.md index 40224a55d..77cf5c437 100644 --- a/FORK-AUDIT.md +++ b/FORK-AUDIT.md @@ -178,6 +178,30 @@ for keeping those gates. protocols where supported, ASCII otherwise. - All work committed and pushed to `git.neuralplatform.ai/neuron-technologies/neuron`. +## Part 4b: Post-uninstall anomaly (2026-08-21) + +**Event:** After `brew uninstall opencode`, terminal output showed ripgrep +being uninstalled. Operator read this as possible executable tampering +("something is replacing the executable"). + +**Investigation:** +- `opencode` is a homebrew-core formula (`Formula/o/opencode.rb`, + 1.18.15) with declared required dependencies: **node, ripgrep**. +- Homebrew auto-removes orphaned auto-installed dependencies on uninstall; + our `tail -2` captured only the ripgrep removal lines, creating the + appearance that ripgrep was removed *instead of* opencode. +- Both were actually removed: `/opt/homebrew/bin/opencode` and Cellar entry + confirmed deleted; ripgrep reinstalled cleanly afterwards. +- No code in Neuron invokes `brew uninstall` anywhere. + +**Classification: MUNDANE — dependency autoremove**, presentation artifact of +truncated output. Recorded at operator's request given the day's other +findings. Would upgrade to suspicious only if: opencode binaries reappear +without an install action, checksums change between builds without rebuilds, +or network egress to Anomaly endpoints is observed from Neuron processes. + +--- + ## Part 5: Open discussion points 1. The workspace/sync runtime (`control-plane/workspace.ts`, ~966 lines) still