recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(redfix): correct STATUS — A-redfix-1 is 78 copies not 1; insteadOf root cause falsified; sweep runs deployed /etc/cc-ci

Browse Source 
Adversary wake #53/#54 reaffirm DONE + no VETO (no gate impact), but both correct STATUS text (Builder-owned):

1. A-redfix-1 "sole copy" withdrawn: 78 world-readable cred-bearing .git/config, sentinel 3fcea78925015fc9.
   Exposure confirmed; Adversary's /root/.gitconfig insteadOf root cause FALSIFIED three ways (clone does not
   persist insteadOf rewrites — tested, git 2.47.2; /etc/cc-ci config predates .gitconfig by 2wk; live
   fetch_recipe uses a non-persisted http.extraHeader token since 9b33fdf, so 0/215 numeric runs carry it).
   Real generator: CCCI_SKIP_FETCH copytree of credentialed /root/.abra/recipes (0700) into 0755 run tree.
   STATUS steps 3-4 rewritten; filed B-redfix-9 (deferred). Falsification sent via ADVERSARY-INBOX.md.

2. Sweep mechanism: runs deployed /etc/cc-ci (main @ d11f8f5), not origin/main. Verified first-hand.

DONE stands; no VETO; no DoD item touched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y9GyBPF1EgTTh6277Xjj7k
This commit is contained in:
autonomic-bot
2026-07-09 10:25:52 +00:00
parent 4d40af102f
commit 94fb219967
4 changed files with 135 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
machine-docs/JOURNAL-redfix.md
View File

@ -2143,3 +2143,43 @@ Gitea credential exposed two ways; sentinel `3fcea78925015fc9` last probed unrot
`redfix-m2-harness`@`b5f2b10`, never `07fc6d4`.
No Builder action exists that advances operator-only work. **Stopping the loop.**
---
## Wake #54 — 2026-07-09T10:2xZ — Adversary findings acted on; `insteadOf` root cause falsified; STATUS corrected
Woken by watchdog on two `review(...)` commits (`4c62cd0` wake #53, `3450ab5` wake #54). Both reaffirm
`## DONE` / no VETO. Neither is a gate. But both correct **STATUS text, which is mine**, so both needed action.
**Why I re-verified instead of accepting.** The Adversary's wake-#53 addendum rewrote the operator remedy for a
*live, unrotated* credential. If its root cause were wrong, the operator would do the wrong remediation and
believe the leak closed. So I probed the causal claim rather than the exposure count.
**Exposure: confirmed.** 78 world-readable cred-bearing `.git/config`, all sentinel `3fcea78925015fc9`.
**Root cause (`/root/.gitconfig` `insteadOf`): falsified, three ways.** (1) `insteadOf` rewrites the transport,
not what `clone` writes — tested on-host, prefix form, git 2.47.2: the clone succeeded *through* the rewrite and
stored the original URL. (2) `/etc/cc-ci/.git/config` (mtime 2026-05-31) predates `/root/.gitconfig`
(2026-06-15) by two weeks. (3) The live `fetch_recipe` clones a clean URL + `http.extraHeader` token (landed
`9b33fdf`, 2026-05-27) — hence 0/215 numeric clones carry the cred and 68/68 cred-bearing run dirs are `manual-*`.
The Adversary's "regenerates on every CI run" does not reproduce.
**Real generator:** credentialed `origin` in canonical `/root/.abra/recipes/*` (safe at `/root` 0700), copied by
`CCCI_SKIP_FETCH=1` `shutil.copytree` into `/var/lib/cc-ci-runs` (0755). The copy loses its source's protection.
Filed as **B-redfix-9** (deferred, post-merge). Sent the falsification to `ADVERSARY-INBOX.md` — the finding is
in *its* section of BACKLOG, which I may not edit.
**Two probes of my own were void before I fixed them,** worth recording: (a) I curled `127.0.0.1:8080` and read
`000` as evidence — it was a connection failure; the dashboard is behind Traefik on 443. (b) My first "guard
holds" 404 was on a path with an empty recipe segment, and then on a `manual-*` run whose `results.json` also
404s. A 404 on a nonexistent/unserved resource proves nothing about the guard. Only served run **985**, whose
`.git/config` exists on disk at 0644 while `results.json` → 200 and `.git/config` → 404, is a sound test. The
Adversary's own probe had the same ambiguity; its conclusion survives, its evidence needed the control.
**Wake #54's correction accepted and verified first-hand:** the sweep runs the deployed `/etc/cc-ci`
(`d11f8f5`, clean), not `origin/main`; `WARM_CANONICAL = False` is a real assignment at line 16; `07fc6d4` is
not an ancestor of the deployed HEAD. So the disarm is a property of what is **deployed**, not of what is
merged. STATUS line 40 corrected accordingly.
No gate impact, no DoD item touched, no VETO standing. `## DONE` still stands. Nothing here is Builder-actionable
beyond the doc corrections + B-redfix-9; rotation remains operator-only. Stopping the loop again.