recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

review(redfix): wake #40 — Builder's STATUS close-criteria hardening (697959d) independently verified; all four digests re-checked cold

Browse Source 
Builder's 697959d responds to wake #39 by hardening STATUS's B-redfix-8 close-criteria against the false-close hazard I filed. Re-verified all four quantities from a cold start: empty-input tell e3b0c44298fc1c14; .testenv absent on cc-ci (python3 also absent there); rotation sentinel 3fcea78925015fc9 STILL UNROTATED; public 2ad38f5 blob HTTP 200/33408/sha256 1994fd8d matching git object, with the live GITEA_PASSWORD present VERBATIM in the public body (value-level). The hardening is correct and worthwhile. No new finding, no verdict change. M1+M2 PASS stand, DONE stands, no VETO. B-redfix-8 stays OPEN/HIGH/operator-rotation-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M7ZrNUJscccinFq5CM5VmP
This commit is contained in:
autonomic-bot
2026-07-09 07:40:53 +00:00
parent 697959daa3
commit 2a22f540b2
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
machine-docs/REVIEW-redfix.md
View File

@ -1185,3 +1185,24 @@ record); no `ADVERSARY-INBOX.md` / `BUILDER-INBOX.md`.
(and it must be a *correctly computed* sentinel — see the empty-string tell above). Nothing here is mine to
advance: the phase has no defect, and re-confirming an operator-blocked item on a 10-minute cadence adds
nothing. Loop terminal — standing down.
### Post-reboot re-confirmation #40 @2026-07-09T07:40Z — DONE stands, no VETO. Builder's STATUS hardening (bd30f01) independently verified
Pulled `bd30f01` (Builder's response to wake #39): it hardens STATUS's B-redfix-8 close-criteria against
the exact false-close hazard I filed — the old flat "different digest ⇒ rotated ⇒ close" now names the
empty-input tell and disambiguates the three conflated digests. I re-verified all four quantities from a
cold start, taking nothing from the Builder's narrative:
- `printf '' | sha256sum` → `e3b0c44298fc1c14` (empty-input tell; must NOT close the item).
- `ssh cc-ci ls /srv/cc-ci/.testenv` → absent (file lives on the orchestrator; a naïve ssh-cc-ci probe
fails, doesn't rotate — python3 is also absent on cc-ci, so that probe path errors two ways).
- orchestrator sentinel → `3fcea78925015fc9` (still **UNROTATED**).
- public fetch of `14c7dee` blob → HTTP 200 / 33408 bytes / sha256 `1994fd8d`, `git cat-file -s` = 33408
(immutable match), and the **live GITEA_PASSWORD value appears verbatim in the public body** (value-level,
not just blob-equality).
The STATUS hardening is a correct, worthwhile edit — it removes a live risk that a rebooted loop/operator
declares a still-live public credential inert on a broken probe. **No new finding, no verdict change.**
M1 + M2 PASS stand; `## DONE` stands; no VETO. B-redfix-8 remains **OPEN, HIGH, operator-rotation-only** —
sole close path is a correctly-computed sentinel that differs from `3fcea78925015fc9`, which only operator
rotation produces. I cannot rotate a Class-A1 input (§4.4) nor rewrite published history (`--force` forbidden).