fix(modules): platform-check existing executor in post-install 🐛🔒️

[dohernandez]

Summary

Field incident (2026-07-09): a genlayer-node linux-amd64 release tarball shipped a Mach-O arm64 genvm executor. Post-install's process_executor_version() only downloads the executor when the binary is absent, so it accepted the wrong-platform binary, LIEF-patched it in place, and the failure only surfaced at runtime as an opaque Exec format error. Forcing --executor-download true could not fix it.

This hardens the consumer side so a wrong executor is caught at install time regardless of who put it there (the producer bug — host-defaulted --os/--arch in genlayer-node's download_genvm.sh — is already fixed in genlayer-node#1540):

• New dependency-free detect_executable_platform(): sniffs the first 20 bytes — ELF e_machine (0x3E → amd64, 0xB7 → arm64) and 64-bit Mach-O magic + cputype (x86_64/arm64), both endiannesses. Unrecognized format/arch counts as a mismatch (a real executor is always a thin ELF/Mach-O).
• An existing executor/<version>/bin/genvm is now checked against --os/--arch before being trusted:
  • mismatch + download enabled → warn (found macos/arm64, expected linux/amd64), delete the poisoned version tree, fall through to the normal re-download (self-healing);
  • mismatch + download disabled → RuntimeError at install time with found-vs-expected platforms and a remediation hint;
  • match → untouched, proceeds as before.
• Drive-by (second commit): the skip-newer-version log line referenced an undefined next_version — a latent NameError whenever a manifest lists two adjacent patch versions.

Verification

• Detector unit-tested against crafted headers (both ELF arches, both Mach-O arches and byte orders, RISC-V ELF, shell script, truncated, empty) plus a real arm64 Mach-O binary — 10/10.
• End-to-end repro of the incident: fake bundle tree with a Mach-O arm64 planted at executor/v0.0.1/bin/genvm, targeting linux/amd64, release tarball served via file://:
  • download disabled → exit 1 with the full diagnostic;
  • download enabled → warns, deletes, re-downloads; healed binary verified ELF/amd64;
  • correct binary already present → untouched, exit 0.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6b8ab2cb-fd84-4c1a-b61b-4f6ec9a49a25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/postinstall-executor-platform-check

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

GenVM PR actions

Tick a box to run it (the box unticks itself when handled). Actions only run while the PR has the ci-safe label.

• Force run full tests
• Rerun full tests
• Merge into dev

_{Full GenVM CI runs only when rtm or run-full-tests is set — "Force run full tests" is a sticky toggle for run-full-tests. Adding rtm marks the PR ready-to-merge and also runs full tests. Merge requires: rtm, green full tests, green E2E, and the branch 0 commits behind.}