# Harmless Utility Build Contract

This source exists only for Modules 5 and 6. It lets learners compare source, compiler output, disassembly, and decompiler output without using an unknown binary.

## Declared behavior

- Input: the fixed `course-input.txt` file in the course working directory.
- Output: one new file named `course-summary.txt` in the same directory.
- Expected output text: `course_total=8` and `branch=alpha-less-than-beta`.
- Arguments: none. Any argument makes the program stop.
- Network, child processes, elevation, persistence, security-control changes, environment reads, and deletion: none.
- Existing `course-summary.txt`: causes a fail-closed stop; it is never overwritten.

## Build and analysis boundary

Use only a preinstalled compiler inside the disposable, network-disabled course VM. Record the compiler identity and version, compile debug and optimized variants from this exact source, and record the resulting SHA-256 values. Do not publish or redistribute compiled outputs. Module 6 uses the learner-built verified copy in Ghidra; the course does not ship a binary.

The exact compiler invocation depends on the preapproved VM image, so copy the fixed invocation from that image's lab card rather than installing a tool or pasting an internet command. If the source hash, compiler identity, output scope, or runtime behavior differs, stop and use the source-level control-flow record in `defensive-evidence-pack.json`.

## Teardown

Export only the build record, hashes, annotated assembly or screenshots, and written report. Delete `course-summary.txt` and the learner-built binaries, close the Ghidra project, power off the VM, and restore the clean snapshot.