1.2 The honesty rules
These eight rules are not aspiration. Each is enforced somewhere in the tree, and each has a failure it prevents that has actually happened to somebody. A reader who internalises them will find the interfaces predictable; a reader who does not will read a grey chip as a bug report.
Rule 1 — Unmeasured is not absent
A node that has never been probed reports UNKNOWN, not ONLINE and not
OFFLINE. A posture dimension nobody observed is grey (UNOBSERVED), never
green. A capture store with no rows is not an empty air interface.
The reason is asymmetric risk. Treating "I did not look" as "nothing there" turns every failure of the tooling into a clean bill of health, and the operator who most needs to know the difference is the one who has just lost a radio, a capture interface or root.
Where it lives: node status words (§5.x), the target panel's posture chips
(§4.x), and every --status-tsv verb, which reports what was measured rather
than what is theoretically possible.
Rule 2 — The exit code carries the verdict
Four codes, defined once and used everywhere:
| Code | Meaning | What the operator does next |
|---|---|---|
0 |
Measured. The verb did what it says and the output is evidence. | Read the rows. |
1 |
Could not. Something was expected to work and did not. | Read the ERROR line; the tool is usually right about what broke. |
2 |
Refused. The request is invalid, unsafe, or outside what the tool will do. | Read the WHY line. |
3 |
Handoff. The work moved somewhere the toolkit cannot follow: another machine, a missing toolkit, an empty remote store. | The output names where it went. |
A refusal (2) is a result, not a defect. When 57_evil_twin.sh refuses to
radiate a twin that was prepared for contained mode, it is not failing — it is
preventing a loopback configuration from becoming a transmitter because a flag
was typed on the wrong command line.
Rule 3 — Observed and advertised are different strengths of claim
A fact a capture proves is observed. A fact a configuration file asserts is
advertised. The evil twin's evidence store carries the distinction in a
column, because "the twin sent PLMN 001-01" and "a phone read PLMN 001-01" are
different sentences about the world, and a report that merges them is a report
that cannot be trusted.
The same distinction appears in 19_cipher_audit.sh, where the cipher a
network advertises in system information is one store and the cipher a
session negotiated is another; the negotiated one wins, and the interface
names which store spoke.
Rule 4 — Capabilities are measured, never typed
A node's class, roles and capabilities are produced by asking the machine
(command -v, a probe over the transport) and never by a field the operator
fills in. Where a value cannot be measured the field is empty and the interface
says so. --presets deliberately ships without a capabilities column: a preset
is a guess about a device class, and a guess must not be dressed as a
measurement.
Where it lives: 59_remote_node.sh and the casebook's node table, the field
kit's RF pre-flight, and 01_radio.sh, which reports the direction of a radio
from its driver rather than from the operator's optimism.
Rule 5 — No invented call syntax
When a driver is not installed, the toolkit does not print a plausible command
line for it and hope. The transmit verbs of the air modules name the binary they
would have used and refuse. 01_radio.sh produces a handoff plan — a file
recording the tool it would have run — instead of a capture file that does not
exist.
This is why several modules look less capable than they could: a printed
hackrf_transfer command that has never been executed is worth less than a
sentence saying the transmitter is absent, and considerably more dangerous,
because it can be copied into a report as though something had happened.
Rule 6 — An unknown algorithm is never strong
The posture logic treats an unrecognised cipher as WEAK with the reason
"unknown strength", never as HARDENED. An integrity algorithm ending in 0
(a null integrity algorithm) is EXPOSED, because that is the configuration
that lets forged NAS and SMS land. A GSM session reporting n/a for integrity
is UNOBSERVED — not null, not strong: the concept does not apply to that
generation, and the manual says so where a reader will meet it (§5.x).
Rule 7 — A theme may not lie about a status colour
The GUI supports more than one palette. Every palette restates colours and leaves the status hues alone: green stays ok, amber stays degraded, red stays danger. A prettier red is still a red, and a theme that made a warning look calm would be a theme that made the toolkit lie.
Rule 8 — Absence of a verb is stated
Where a capability is missing on purpose, the interface says which clause is
missing rather than leaving a hole. 58_suci_catcher.sh states that its
catcher needs a core with a subscriber database. 37_femtocell.sh states which
piece of the small-cell stack is absent. The same rule governs this manual: a
reader who finds no section for a technique has found the toolkit's own verdict
on whether the technique is implemented.