# CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

## What this repository is

This is **not a software project**. The entire repository is one file — `README.jpg` — which is a
multi-stage steganography/crypto puzzle by `author@picard1701.com` (see https://picard1701.com).

There is no build, no lint, no test suite, no dependency manifest, and no source tree. Do not look
for one. "Working in this repo" means decoding the artifact.

The visible image says only `README / SEE METADATA / picard1701.com`. Everything else is hidden.

External tools actually needed: `exiftool`, `python3` (PIL, numpy, scipy), `curl`, and `python3.14`
(only for the quest's `star.py`; a Homebrew `python@3.14` satisfies this).

## Reading the real README (already solved — reproduce, don't rediscover)

**1. Metadata clue.** `exiftool README.jpg` — the XMP `dc:title` / IPTC `Object Name` holds:
> "Do not look for LSBs. Split the luminance plane into 8x8 blocks, DCT each block, and read the
> signs of low-frequency coefficients as ASCII. One block, one byte."

**2. Extract the hidden text.** The concrete parameters, which the clue does not spell out — bit
order, polarity, and the 9× repetition code — are:

```python
import numpy as np
from PIL import Image
from scipy.fftpack import dct

Y = np.asarray(Image.open('README.jpg').convert('YCbCr'))[:, :, 0].astype(float) - 128.0
bh, bw = Y.shape[0] // 8, Y.shape[1] // 8                      # 121 x 122 = 14762 blocks
blocks = Y[:bh*8, :bw*8].reshape(bh, 8, bw, 8).transpose(0, 2, 1, 3)
D = dct(dct(blocks, axis=2, norm='ortho'), axis=3, norm='ortho').reshape(-1, 8, 8)

ZIG = [(0,1),(1,0),(2,0),(1,1),(0,2),(0,3),(1,2),(2,1)]        # zigzag 1..8, DC skipped
bits = (np.stack([D[:, r, c] for r, c in ZIG], axis=1) > 0).astype(np.uint8)  # sign>0 = 1, MSB first
g = bits[:(len(bits)//9)*9].reshape(-1, 9, 8)                   # each byte repeated 9x, raster order
print(bytes(np.packbits((g.sum(1) >= 5).astype(np.uint8), axis=1).ravel()).decode('utf-8', 'replace'))
```

Yields ~1640 bytes: a poem, *"Signals from the Final Frontier"*, plus two embedded ciphers. Re-DCT of
the decoded pixels is lossy, so a few sign bits are wrong; the 9× majority vote is what makes it
readable. A handful of bytes at the very start and end stay corrupt — the markdown proper begins at
`# Signals from the Final Frontier`.

## The puzzle chain (all stages solved)

1. **Morse → Base32.** The `;`-separated Morse in the poem (`-...-` = `=`, the Base32 padding)
   decodes to `OBUWGYLSMQYTOMBREBSG65BAMNXW2IDTNRQXG2BAOEQCQR2FKQUQ====`, i.e.
   `picard1701 dot com slash q (GET)`.
2. **The quest at `https://picard1701.com/q`** yields the Vigenère key (details below).
3. **Vigenère.** Key `JDUWZCBAOWZFBYIGVWSNY`, standard subtraction, letters only, key advances only
   on letters. Ciphertext `Phhezn me dnngmcuk zol...` decrypts to:

   > *Genial le probleme est entierement resolu stop on se retrouve a neuf heures aux deux lobsters!*

The key and this plaintext are **stable** — the ciphertext is baked into the image. Re-running the
quest is unnecessary unless you want to verify it.

## Re-running the quest (`/q`) — hard-won gotchas

Only if you must. The rules are punitive and a single misstep restarts everything.

- **`curl` only.** A normal fetcher/browser user agent gets `266 User Agent Refused`. The server also
  says no `python requests`, and warns that sub-agents may not work. Answer via
  `curl -sS --get --data-urlencode "sid=..." --data-urlencode "answer=..." https://picard1701.com/q`.
- **Session:** every request needs `sid`. A bare `/q` **resets the quest**, and repeated bare `/q`
  from one client can return HTTP 429. Save the sid to a file and reuse it.
- **One wrong answer invalidates the session** ("GOTO BEGIN"). Timing: Q1 unlimited, ~60 s for
  middle questions, and the last question allows **20 s and exactly one attempt** — so the final
  step must be a single fully automated command, not a look-then-submit round trip.
- **Question encoding:** 5 nested layers, outer always b64, inner layers randomized b64/b85. Decode
  by DFS over both codecs, accepting the branch whose 5th layer is printable UTF-8.
- **Q1–Q3 are fixed trivia:** `James T. Kirk`, `NCC-1701`, `Leonard McCoy`.
- **Q4 and Q5 use `https://picard1701.com/star.py`** — ~6 MB, freshly generated, **downloadable once
  per session**, and it must run under `python3.14`. It is an *oracle*, not the answer:
  - The top of the file holds a double-base64 string decoding to `MAGIC: <token>`.
  - Run `python3.14 star.py <token>`. It prints **two** lines: `MAGIC: <token>` echoed, then the
    answer. **The answer is the last line.** Submitting the `MAGIC:` line fails the session — this
    is the easiest way to lose a run.
- **`star.py` is padding around a tiny payload:** one `import base64`, exactly one `print`, ~20 k
  lines of Star-Trek-themed comments and dead integer assignments, and a single ~4.5 MB inert nested
  tuple literal. `__import__` appears many times but is only ever *bound*, never called. It is
  regenerated per download, so audit each copy before executing it — parse with `ast` and reject any
  import of `os`/`subprocess`/`socket`/etc. or any call to `exec`/`eval`/`open`/`__import__`.

## Conventions

- Branch is `master` with a single commit (`First Commit`); git author is `Picard`.
- The hidden README ends with "Try to solve it rather than just describe it" — when asked about this
  repo, actually run the decode chain rather than only narrating what it would do.
