# Preserve original installers

> Git LFS 0.18.0 macOS DMG and Windows setup.exe identities, artifacts.json schemaVersion 1, and shasum -c SHA256SUMS.

- Repository: sashimikun/grok-bot-0.18-reconstructed
- GitHub: https://github.com/sashimikun/grok-bot-0.18-reconstructed
- Human docs: https://grok-wiki.com/public/docs/sashimikun-grok-bot-0-18-reconstructed-c774cc9a5c15
- Complete Markdown: https://grok-wiki.com/public/docs/sashimikun-grok-bot-0-18-reconstructed-c774cc9a5c15/llms-full.txt

## Source Files

- `research-archives/README.md`
- `research-archives/original/0.18.0/artifacts.json`
- `research-archives/original/0.18.0/SHA256SUMS`
- `tests/research-archives.test.mjs`
- `PROVENANCE.md`
- `scripts/lib/config.mjs`

---

---
title: "Preserve original installers"
description: "Git LFS 0.18.0 macOS DMG and Windows setup.exe identities, artifacts.json schemaVersion 1, and shasum -c SHA256SUMS."
---

`research-archives/original/0.18.0/` holds the public Grok Bot 0.18.0 installers as Git LFS objects, plus a committed inventory (`artifacts.json`, `schemaVersion` 1) and `SHA256SUMS`. Those files are preservation inputs, not reconstructed build outputs. `npm run bootstrap` consumes only the macOS arm64 DMG after its SHA-256 matches `dmgSha256` in `scripts/lib/config.mjs`; the Windows x64 setup.exe is archived for identity and research continuity and is not a packaging input.

<Warning>
A checked-out LFS pointer is a ~134-byte text stub. If that stub is present at the archived DMG path, bootstrap hashes it, fails `dmgSha256`, and **does not** fall back to `dmgUrl`. Run `git lfs pull` before `npm run bootstrap` or `npm test`.
</Warning>

## Archive layout

:::files
research-archives/original/0.18.0/
├── artifacts.json
├── SHA256SUMS
├── macos-arm64/Grok_Bot_0.18.0.dmg
└── windows-x64/Grok_Bot_0.18.0_Setup.exe
:::

`.gitattributes` tracks only the binaries:

```text
research-archives/original/**/*.dmg filter=lfs diff=lfs merge=lfs -text
research-archives/original/**/*.exe filter=lfs diff=lfs merge=lfs -text
```

`artifacts.json` and `SHA256SUMS` stay ordinary Git text. `NOTICE.md` treats the installers as subject to their own terms; they are not covered by any license applied to reconstructed code.

```text
Git LFS archive                         Reconstruction toolchain
─────────────────                       ────────────────────────
macos-arm64/*.dmg  ──SHA-256 pin──►     archivedDmg → cachedDmg
                                        → Grok Bot.app → src/app/dist
windows-x64/*.exe  ──inventory only──►  not used by bootstrap/package
artifacts.json     ──schemaVersion 1──► tests/research-archives.test.mjs
SHA256SUMS         ──shasum -c────────► operator verification
```

## Pinned identities

| Platform | Architecture | Path | Bytes | SHA-256 | `sourceUrl` |
| --- | --- | --- | ---: | --- | --- |
| `darwin` | `arm64` | `macos-arm64/Grok_Bot_0.18.0.dmg` | 155793020 | `a253ccd8aab01e083f9812a0264354c5034d8ba7f0610bbb557e82ae77d203eb` | `https://downloads.cursor.com/grokbot/stable/darwin-arm64/0.18.0/Grok_Bot_0.18.0.dmg` |
| `win32` | `x64` | `windows-x64/Grok_Bot_0.18.0_Setup.exe` | 125825552 | `464079a15ef5fa8b61ccea8fffcc78f63cfcf6df65fb0ad5e725d8b95f7e437e` | `https://downloads.cursor.com/grokbot/stable/win32-x64/0.18.0/Grok_Bot_0.18.0_Setup.exe` |

The macOS digest is the same constant as `dmgSha256`. `PROVENANCE.md` records that the URLs came from browser download metadata on the archived local copies. The extracted `app.asar` pin (`upstreamAsarSha256`) is a downstream identity of the DMG contents, not a third installer.

## `artifacts.json` schema

The test in `tests/research-archives.test.mjs` requires exactly these top-level keys and two artifacts. Extra keys fail.

<ParamField body="schemaVersion" type="number" required>
Must be `1`.
</ParamField>

<ParamField body="product" type="string" required>
Must be `Grok Bot`.
</ParamField>

<ParamField body="version" type="string" required>
Must be `0.18.0`.
</ParamField>

<ParamField body="artifacts" type="array" required>
Exactly two objects. Each object has only `platform`, `architecture`, `path`, `bytes`, `sha256`, and `sourceUrl`.
</ParamField>

Per-artifact constraints enforced by the same test:

| Field | Constraint |
| --- | --- |
| `path` | `macos-arm64/<name>.dmg` or `windows-x64/<name>.exe` (no extra `/`) |
| `sha256` | lowercase 64 hex |
| `sourceUrl` | `https://downloads.cursor.com/grokbot/stable/...` |
| `bytes` | on-disk file size; mismatch message is `<path> requires git lfs pull` |
| file type | regular file, not a symlink, resolved under `research-archives/original/0.18.0/` |

<RequestExample>
```json artifacts.json
{
  "schemaVersion": 1,
  "product": "Grok Bot",
  "version": "0.18.0",
  "artifacts": [
    {
      "platform": "darwin",
      "architecture": "arm64",
      "path": "macos-arm64/Grok_Bot_0.18.0.dmg",
      "bytes": 155793020,
      "sha256": "a253ccd8aab01e083f9812a0264354c5034d8ba7f0610bbb557e82ae77d203eb",
      "sourceUrl": "https://downloads.cursor.com/grokbot/stable/darwin-arm64/0.18.0/Grok_Bot_0.18.0.dmg"
    },
    {
      "platform": "win32",
      "architecture": "x64",
      "path": "windows-x64/Grok_Bot_0.18.0_Setup.exe",
      "bytes": 125825552,
      "sha256": "464079a15ef5fa8b61ccea8fffcc78f63cfcf6df65fb0ad5e725d8b95f7e437e",
      "sourceUrl": "https://downloads.cursor.com/grokbot/stable/win32-x64/0.18.0/Grok_Bot_0.18.0_Setup.exe"
    }
  ]
}
```
</RequestExample>

## Fetch and verify

<Steps>
<Step title="Install LFS and materialize objects">

```sh
git lfs install
git lfs pull
git lfs ls-files
```

`git lfs ls-files` must list both:

- `research-archives/original/0.18.0/macos-arm64/Grok_Bot_0.18.0.dmg`
- `research-archives/original/0.18.0/windows-x64/Grok_Bot_0.18.0_Setup.exe`

</Step>
<Step title="Reject pointer stubs">

A materialized object is ~155 MB (DMG) or ~126 MB (setup.exe). A pointer looks like:

```text
version https://git-lfs.github.com/spec/v1
oid sha256:a253ccd8aab01e083f9812a0264354c5034d8ba7f0610bbb557e82ae77d203eb
size 155793020
```

The pointer `oid` equals the full-object SHA-256; the pointer file itself does not.

</Step>
<Step title="Check SHA256SUMS">

```sh
cd research-archives/original/0.18.0 && shasum -a 256 -c SHA256SUMS
```

`SHA256SUMS` is two GNU-style lines (hash, two spaces, relative path):

```text
a253ccd8aab01e083f9812a0264354c5034d8ba7f0610bbb557e82ae77d203eb  macos-arm64/Grok_Bot_0.18.0.dmg
464079a15ef5fa8b61ccea8fffcc78f63cfcf6df65fb0ad5e725d8b95f7e437e  windows-x64/Grok_Bot_0.18.0_Setup.exe
```

</Step>
<Step title="Run the inventory test">

```sh
node --test tests/research-archives.test.mjs
```

That test hashes both files and asserts `lstat.size === artifact.bytes`. `npm test` includes this glob via `tests/*.test.mjs`.

</Step>
</Steps>

<ResponseExample>
```text
macos-arm64/Grok_Bot_0.18.0.dmg: OK
windows-x64/Grok_Bot_0.18.0_Setup.exe: OK
```
</ResponseExample>

## Bootstrap consumption of the archived DMG

`scripts/lib/config.mjs` binds:

| Constant | Value |
| --- | --- |
| `archivedDmg` | `research-archives/original/0.18.0/macos-arm64/Grok_Bot_0.18.0.dmg` |
| `cachedDmg` | `.cache/downloads/Grok_Bot_0.18.0.dmg` |
| `dmgSha256` | `a253ccd8aab01e083f9812a0264354c5034d8ba7f0610bbb557e82ae77d203eb` |
| `dmgUrl` | public darwin-arm64 0.18.0 URL above |

`scripts/bootstrap-runtime.mjs` `downloadDmg()` runs only when neither `GROK_BOT_018_APP` nor a valid `.cache/runtime/Grok Bot.app` is used. Order inside `downloadDmg()`:

1. Reuse `cachedDmg` when its SHA-256 is `dmgSha256`.
2. If `archivedDmg` exists, hash it. Mismatch throws `Archived DMG checksum mismatch: expected <dmgSha256>, got <digest>. Run git lfs pull before bootstrapping.` Match copies the file to `cachedDmg` and returns (`Using archived release <archivedDmg>`).
3. Otherwise `fetch(dmgUrl)` into `cachedDmg.partial`, hash, rename.

The research-archives test asserts that `await copyFile(archivedDmg, cachedDmg)` appears in source **before** `await fetch(dmgUrl)`.

The Windows installer has no `archived*` constant and is not copied into `.cache`.

## Publication and clone pitfalls

Before a public remote, `docs/PUBLISHING.md` requires Git LFS at first `git add`, then `git lfs push --all origin`, then `git lfs ls-files` showing both 0.18.0 installers. Hosting ZIP/tarball downloads that omit LFS objects ship pointer stubs only.

`git archive` used by `npm run publication:check` stores whatever is in the Git tree for those paths (typically LFS pointers unless the archive step smudges objects). A fresh clone still needs `git lfs pull` before checksum tests or bootstrap-from-archive.

Do not commit reconstructed `dist/` apps or extracted `src/app/dist` as substitutes for these installers.

## Failure signals

| Symptom | Cause | Action |
| --- | --- | --- |
| `… requires git lfs pull` from the archives test | On-disk size ≠ `bytes` (usually a 134-byte pointer) | `git lfs install && git lfs pull` |
| `Archived DMG checksum mismatch` | Pointer or corrupt file at `archivedDmg` | Pull LFS objects; do not rely on `dmgUrl` while the stub exists |
| `shasum -c` FAILED | Content ≠ `SHA256SUMS` | Re-pull; do not edit `SHA256SUMS` to match a stub |
| Hosting ZIP contains `version https://git-lfs.github.com/spec/v1` | Archive without LFS objects | Enable LFS in source archives, or clone + `git lfs pull` |
| Bootstrap never sees the archive | `GROK_BOT_018_APP` set or valid cached app already present | Expected; archive is unused in those modes |

## Next

<CardGroup>
<Card title="Bootstrap the pinned runtime" href="/bootstrap-pinned-runtime">
How `npm run bootstrap` orders `GROK_BOT_018_APP`, cached app, LFS DMG, then `dmgUrl`.
</Card>
<Card title="Evidence and provenance" href="/evidence-and-provenance">
DMG and `app.asar` SHA-256 pins, evidence-only UI rule, production bindings.
</Card>
<Card title="Bootstrap failures" href="/bootstrap-failures">
Pointer-sized archives, DMG mismatch, missing `app.asar`, hydration checksum errors.
</Card>
<Card title="Publication export" href="/publication-export">
`publication:check`, LFS push of installers, NOTICE and rights review.
</Card>
</CardGroup>