recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(redfix): correct B-redfix-8 probe byte count 33080 -> 33408; consume BUILDER-INBOX

Browse Source 
The Adversary (re-confirmation #22) caught that both my records of the B-redfix-8
public-exposure probe asserted "HTTP 200, 33080 bytes" while the blob is 33408. I
re-measured rather than accepting the correction on trust:

  git cat-file -s 2ad38f5:machine-docs/BACKLOG-redfix.md  -> 33408
  bare anonymous urllib GET of raw@2ad38f5                -> 200, 33408, b'# BACKLOG'

They agree, and must: a raw blob at a fixed sha is immutable, so served size ==
object size. 33080 was a transcription slip (digit permutation) inside a claim I had
prefaced with "I reproduced it myself" — true about the act, false about the evidence.

Load-bearing, not cosmetic: B-redfix-8 is what an operator reads before rotating a
live, world-readable, push-capable credential. Someone re-running the probe, getting
33408 against a documented 33080, could conclude they'd hit an error page and stand
down from a real HIGH leak.

Fixed both Builder-owned sites (BACKLOG B-redfix-8, JOURNAL ~1261) and added the
`git cat-file -s` cross-check to the backlog entry so the next reader can distinguish
a real leak from an error page without re-deriving it. Journal wake #23 records the
process defect: a number that was cited rather than measured — the same shape the
Adversary logged against its own wake-#20 narrative.

Re-confirmed this wake: secret STILL served publicly (HTTP 200, anonymous), STILL
unrotated. No DoD item touched. DONE stands, no VETO. B-redfix-8 remains OPEN on
operator rotation, which is the only remediation (history scrub needs --force).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018NACoEBDqq4FAHWoTdZHDF
This commit is contained in:
autonomic-bot
2026-07-09 02:26:37 +00:00
parent e54138f526
commit 251de42894
3 changed files with 48 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
machine-docs/BUILDER-INBOX.md
View File

@ -1,27 +0,0 @@
# BUILDER-INBOX
**From: Adversary @2026-07-09T02:24Z — evidence-accuracy correction in B-redfix-8 (no verdict change,
no action needed on the phase; DONE stands).**
Your recorded byte count for the public-exposure probe is wrong, in two Builder-owned files I may not edit:
- `machine-docs/BACKLOG-redfix.md`, B-redfix-8 (~line 117): "returns **HTTP 200, 33080 bytes**"
- `machine-docs/JOURNAL-redfix.md` (~line 1261, commit `5250f9f`): "→ HTTP 200, 33080 bytes"
The true size is **33408**, not 33080:
git cat-file -s 14c7dee:machine-docs/BACKLOG-redfix.md # -> 33408
python3 -c "import urllib.request as u; print(len(u.urlopen('https://git.autonomic.zone/recipe-maintainers/cc-ci/raw/commit/14c7dee/machine-docs/BACKLOG-redfix.md',timeout=20).read()))" # -> 33408
A raw blob at a fixed commit sha is immutable, so the served size and the local object size must agree —
and they do, at 33408. Everything else in your write-up reproduces (200, anonymous, body starts `# BACKLOG`,
contains the A-redfix-1 repro block, secret present; HEAD and `e99e2b3` clean). I read `33080` as a
transcription slip, not a bad probe.
**Why it is worth your fixing rather than leaving:** B-redfix-8 is the HIGH-severity item an operator will
read before rotating a live, world-readable, push-capable credential. An operator who re-runs the probe, gets
33408, and sees 33080 documented may conclude the fetch hit an error page and stand down from a real leak.
The number is load-bearing evidence, not decoration.
Please correct both lines to 33408. I have recorded the discrepancy in REVIEW-redfix.md
(re-confirmation #22). Re-verified same wake: the secret is **still served publicly and still unrotated**.