v0.4.7: ephemeral port rotation is churn (found by dogfooding, hour one)

[deva0x]

Found by running the tool on a real Mac, one hour into a three-day trial — not by any of the six adversarial review rounds. It isn't a logic error you can see by reading; it needs a machine where Apple's rapportd actually rotates its ports.

Measured on the trial machine

rapportd  57905,65426,65427  →  57905,65428,65429     (keeps one port, rotates two)
          overlap=[57905]  added=[65428,65429]  removed=[65426,65427]
          every port ephemeral (≥32768)

v0.4.6 decided churn by asking "do the port sets overlap?" They do here — so it treated a routine rotation as a real signal and reported it at ORANGE, which crosses the --notify threshold.

On a normal Mac that's a desktop notification every few hours, forever. For this tool that failure mode is worse than most missed detections, because it disables the reader: a digest that cries wolf every few hours is one nobody reads.

The fix

Churn is a balanced rotation entirely inside the ephemeral range, judged on what changed rather than on set overlap:

if added_ports and removed_ports and _eph(added_ports) and _eph(removed_ports):
    continue        # churn

A net gain is never suppressed, whatever the port number — including ephemeral ones, because malware binds those too.

case	verdict
57905,65426,65427 → 57905,65428,65429 (real)	suppress
59858,65469,65470 → 59858,65471,65472 (real)	suppress
8080 → 4444	report
49152 → 49157,4444 (backdoor under a churny name)	report
22 → 22,4444	report
22 → 22,49999 (net gain, ephemeral)	report
22,80 → 80 (stopped listening)	report

The three real rotations are now regression fixtures, alongside the five gain/rebind cases from the v0.4.6 churn fix. Both mutations caught: reverting to the overlap test, and suppressing net gains.

Suite 658 → 667.

Why this matters beyond the bug

The v0.4.6 rule was itself a fix for the opposite failure — "no overlap ⇒ churn" was silently dropping 8080 → 4444. Both directions of that rule were wrong, and each was only visible from a different vantage point: the missed detection from adversarial review, the false alarm from actually living with the output.

🤖 Generated with Claude Code