# GHOST Creative System v3.3.0 — Validation Report

## Scope

This build adds a local delta-patch system so future fixes can be delivered as a small `.ghostupdate` file rather than reinstalling the full extension.

## Passed static and package tests

- `CSXS/manifest.xml` parses successfully and all bundle/panel versions are `3.3.0`.
- `index.html`, `command.html`, and `core.html` contain no duplicate static IDs.
- All local CSS, JavaScript, image, and documentation references used by the HTML files exist.
- All `getElementById()` and `querySelector("#...")` references in the active UI code resolve to static or dynamically created elements.
- `ghost-system.js`, `system-ui.js`, `main.js`, and `command.js` pass Node JavaScript syntax checks.
- Visible Update controls exist in both GHOST CACHE and GHOST COMMAND.
- The Update Center contains local patch selection, validation preview, apply, and rollback controls.
- Local patch helper files exist:
  - `installer/inspect-local-update.ps1`
  - `installer/stage-local-update.ps1`
  - `installer/rollback-update.ps1`
- Developer delta builder exists:
  - `developer/Create-GhostPatch.ps1`
- Patch format documentation and example manifest are included.
- A simulated `3.2.0 → 3.3.0` delta package was generated from the old and new directories.
- The simulated patch contained only changed/added/deleted paths, included `CSXS/manifest.xml`, rejected unsafe path forms in validation logic, and every payload SHA-256 matched.
- The previously exposed demo API key is not present anywhere in the release tree.
- The Bynara endpoint and `agnes-2.0-flash` model remain preconfigured without a bundled secret.

## Patch safety behavior

- Requires schema `ghost.patch.v1`.
- Requires product ID `com.ghost.creativesystem`.
- Requires an exact compatible installed version or an explicit compatible-version entry.
- Rejects same/older target versions.
- Rejects absolute paths, drive-qualified paths, and `..` traversal.
- Allows only declarative `add`, `replace`, and `delete` operations.
- Does not execute scripts supplied by the patch package.
- Verifies SHA-256 for every added/replaced payload file before staging and again in the working copy.
- Re-checks the installed version after After Effects closes, preventing a second stale patch from applying after another update.
- Builds a complete working copy before replacing the installed extension.
- Creates a full backup before installation.
- Provides latest-patch rollback with a pre-rollback safety copy.

## Not executable in this environment

The current environment is Linux and does not contain Windows PowerShell or After Effects. Therefore these items still require a real Windows/After Effects test:

- CEP native file-picker behavior inside After Effects.
- Windows PowerShell execution of inspect/stage/rollback scripts.
- Waiting for `AfterFX.exe` to close and replacing the installed CEP folder.
- Restart behavior and panel loading after a real patch.
- Rollback from a real installed patch.

## Required first Windows test

1. Install v3.3.0 with `Install_GHOST.cmd`.
2. Open both panels and confirm the Update buttons open the Update Center.
3. Generate a test `3.3.0 → 3.3.1` patch from two test build folders with `developer/Create-GhostPatch.ps1`.
4. Select the patch, confirm the preview counts, stage it, close After Effects, and restart.
5. Confirm version `3.3.1` loads.
6. Stage **Rollback Last Update**, close After Effects, restart, and confirm version `3.3.0` returns.

## Security note

A patch can replace JavaScript and JSX, so it is executable software. This beta validates identity, compatibility, paths, and payload integrity. Before commercial public distribution, add publisher public-key signature verification so users can verify authenticity, not only file integrity.
