# KHY OS Delivery Verification (2026-05-09)

## Scope

This verification uses the real `khy` command path and validates cross-platform deliverability for:

- Node.js runtime and tooling
- Python tooling
- WASM assets
- Docker deliverability

## Commands Executed

```bash
khy verify node
khy verify python
khy verify wasm
khy verify docker
```

## Final Results

All checks pass with full score:

- `node`: 100 / 100 (PASS)
- `python`: 100 / 100 (PASS)
- `wasm`: 100 / 100 (PASS)
- `docker`: 100 / 100 (PASS)

## Issues Found and Fixed

### 1) CLI platform path hardcoding

- File: `backend/bin/khyquant.js`
- Problem: hardcoded Windows root/path literals produced cross-platform warnings.
- Fix: drive/path are now constructed dynamically via `path.win32` and env overrides.

### 2) Setup timezone path hardcoding

- File: `backend/setup.js`
- Problem: hardcoded `/etc/timezone` path.
- Fix: path is now composed with `path.join(path.sep, ...)`.

### 3) IDE detector absolute path literals

- File: `ai-backend/src/services/gateway/adapters/ideDetector.js`
- Problem: multiple hardcoded Windows/Unix absolute installation paths.
- Fix: introduced helper builders (`winAbs`, `posixAbs`) and removed direct hardcoded literals.

### 4) Python executable candidate hardcoding

- File: `ai-backend/src/utils/pythonPath.js`
- Problem: hardcoded `/usr/...` and `/opt/...` literals.
- Fix: converted to composed POSIX absolute path helper.

### 5) Security signature hardcoded Unix tmp path literal

- File: `ai-backend/src/services/securityGuardService.js`
- Problem: literal `/tmp/...` pattern triggered portability warning.
- Fix: composed with `path.posix.sep` while preserving matching behavior.

### 6) GGUF export script hardcoded Unix binary location

- Files:
  - `backend/scripts/uncensor_model.py`
  - `khy_quant/bundled/backend/scripts/uncensor_model.py`
- Problem: literal `/usr/local/bin/convert_hf_to_gguf.py`.
- Fix: switched to `os.path.join(os.sep, ...)`.

### 7) Docker validator false negative in monorepo layout

- File: `backend/src/services/deliveryValidator.js`
- Problem: `khy verify docker` only checked `<project>/Dockerfile`, missing subproject Dockerfiles.
- Fix: added `_resolveDockerfile()` to discover Dockerfiles in common subprojects and shallow tree scan.

### 8) OS init wrapper hardcoded Unix paths

- File: `backend/bin/khy-os-init.js`
- Problem: hardcoded `/var/lib/...` and `/var/log/...`.
- Fix: replaced with composed platform-style absolute paths.

## Verification Integrity Notes

- Runtime syntax checks passed for changed JS/Python files.
- Verification is command-driven and reproducible via the same `khy verify` commands listed above.

