From d4fcb683b85b25d5e1caae92268ebb57539de3ad Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Thu, 9 Jul 2026 07:26:03 +0000 Subject: [PATCH] =?UTF-8?q?review(redfix):=20wake=20#38=20=E2=80=94=20B-re?= =?UTF-8?q?dfix-8=20re-probed=20unchanged=20(HTTP=20200/33408,=20blob=20sh?= =?UTF-8?q?a256=201994fd8d=20matches=20immutable=20git=20object;=20rotatio?= =?UTF-8?q?n=20sentinel=20still=203fcea78925015fc9=20=E2=87=92=20unrotated?= =?UTF-8?q?).=20Self-caught=20a=20false=20alarm:=20momentarily=20read=20th?= =?UTF-8?q?e=20whole-blob=20sha256=20as=20a=20change=20vs=20the=20credenti?= =?UTF-8?q?al-value=20rotation=20sentinel=20=E2=80=94=20two=20different=20?= =?UTF-8?q?quantities,=20no=20actual=20change,=20blob=20is=20immutable=20a?= =?UTF-8?q?nd=20matches=20git=20exactly.=20Terminal=20condition=20intact?= =?UTF-8?q?=20(DONE,=20M1+M2=20PASS,=20no=20VETO).=20Item=20stays=20OPEN/H?= =?UTF-8?q?IGH/operator-only.=20Loop=20standing=20down.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- machine-docs/REVIEW-redfix.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md index b232f29..d6993f1 100644 --- a/machine-docs/REVIEW-redfix.md +++ b/machine-docs/REVIEW-redfix.md @@ -1121,3 +1121,28 @@ public history at `14c7dee`). Neither automated loop can advance it, and re-conf operator-only exposure every ~10min adds nothing. B-redfix-8 remains **OPEN, HIGH, operator-only**; its sole close path is a future digest differing from `3fcea78925015fc9`. Restart the loop (or the watchdog reboots it) if that changes and the finding needs to be formally closed. + +### Re-probe @2026-07-09T07:25Z (wake #38) — B-redfix-8 unchanged; a self-caught false alarm, resolved + +Re-measured both load-bearing claims cold. Result: no change, terminal condition intact. + +- **Public reachability** — `GET …/raw/commit/14c7dee/machine-docs/BACKLOG-redfix.md` → HTTP 200, 33408 + bytes, served cleartext to the unauthenticated public internet. Its sha256 is + `1994fd8de3fc780337098f72491f829c00743f7d82f6c9e5a373a7d639613f37`, identical across repeated fetches + and **exactly equal** to `git cat-file blob 14c7dee:machine-docs/BACKLOG-redfix.md | sha256sum` — i.e. + the open web is serving the immutable git blob byte-for-byte. Still public. +- **Rotation sentinel** — `sha256(GITEA_PASSWORD from /srv/cc-ci/.testenv)[:16]` = `3fcea78925015fc9`, + identical to the committed sentinel ⇒ **operator has NOT rotated** ⇒ `14c7dee` still live. + +**Self-correction (recorded for honesty).** On first probe this wake I computed the sha256 of the whole +33408-byte blob (`1994fd8d…`) and momentarily read it as a *change* against the `3fcea789…` value carried +in wakes #33/#36/#37 — as if the immutable blob had mutated. It had not. Those two hashes measure +**different things**: `3fcea789…` is the rotation sentinel `sha256(credential value)[:16]`, whereas +`1994fd8d…` is sha256 of the entire served file. Both are correct; there is no discrepancy and no content +change (a raw blob at a fixed commit sha cannot mutate, and it matches the git object exactly). Noting it +so the two digests are never again conflated in this file. + +**Verdict unchanged.** M1 PASS @2026-06-18T01:18Z, M2 PASS @2026-07-09T00:18Z, `## DONE` @2026-07-09T00:18Z, +VETO cleared, both inboxes absent, no gate claimed. **DONE stands. No VETO.** B-redfix-8 remains **OPEN, +HIGH, operator-rotation-only**; sole close path is a future sentinel differing from `3fcea78925015fc9`. +Loop terminal — standing down again (as at wake #37); nothing here is mine to advance.