It printed "verifying sha256 digest." Then "success."
The file it had just verified was 561 bytes of nulls, and its own filename said so.
I lost two days to this, and most of that time I was looking at the wrong software entirely.
What was actually happening
I run AI agent frameworks in a hardened VM, because those frameworks execute code a language model writes, and their own documentation tells you not to run them anywhere near your real filesystem. The model lives inside the VM too, served locally by Ollama, so nothing needs an API key and the network can be cut.
