recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

review(redfix): wake #38 — B-redfix-8 re-probed unchanged (HTTP 200/33408, blob sha256 1994fd8d matches immutable git object; rotation sentinel still 3fcea78925015fc9 ⇒ unrotated). Self-caught a false alarm: momentarily read the whole-blob sha256 as a change vs the credential-value rotation sentinel — two different quantities, no actual change, blob is immutable and matches git exactly. Terminal condition intact (DONE, M1+M2 PASS, no VETO). Item stays OPEN/HIGH/operator-only. Loop standing down.

Browse Source
This commit is contained in:
autonomic-bot
2026-07-09 07:26:03 +00:00
parent 6cb6ddd5ec
commit d4fcb683b8
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
machine-docs/REVIEW-redfix.md
View File

@ -1121,3 +1121,28 @@ public history at `14c7dee`). Neither automated loop can advance it, and re-conf
operator-only exposure every ~10min adds nothing. B-redfix-8 remains **OPEN, HIGH, operator-only**; its operator-only exposure every ~10min adds nothing. B-redfix-8 remains **OPEN, HIGH, operator-only**; its
sole close path is a future digest differing from `3fcea78925015fc9`. Restart the loop (or the watchdog sole close path is a future digest differing from `3fcea78925015fc9`. Restart the loop (or the watchdog
reboots it) if that changes and the finding needs to be formally closed. reboots it) if that changes and the finding needs to be formally closed.
### Re-probe @2026-07-09T07:25Z (wake #38) — B-redfix-8 unchanged; a self-caught false alarm, resolved
Re-measured both load-bearing claims cold. Result: no change, terminal condition intact.
- **Public reachability** — `GET …/raw/commit/14c7dee/machine-docs/BACKLOG-redfix.md` → HTTP 200, 33408
bytes, served cleartext to the unauthenticated public internet. Its sha256 is
`1994fd8de3fc780337098f72491f829c00743f7d82f6c9e5a373a7d639613f37`, identical across repeated fetches
and **exactly equal** to `git cat-file blob 14c7dee:machine-docs/BACKLOG-redfix.md | sha256sum` — i.e.
the open web is serving the immutable git blob byte-for-byte. Still public.
- **Rotation sentinel** — `sha256(GITEA_PASSWORD from /srv/cc-ci/.testenv)[:16]` = `3fcea78925015fc9`,
identical to the committed sentinel ⇒ **operator has NOT rotated** ⇒ `14c7dee` still live.
**Self-correction (recorded for honesty).** On first probe this wake I computed the sha256 of the whole
33408-byte blob (`1994fd8d…`) and momentarily read it as a *change* against the `3fcea789…` value carried
in wakes #33/#36/#37 — as if the immutable blob had mutated. It had not. Those two hashes measure
**different things**: `3fcea789…` is the rotation sentinel `sha256(credential value)[:16]`, whereas
`1994fd8d…` is sha256 of the entire served file. Both are correct; there is no discrepancy and no content
change (a raw blob at a fixed commit sha cannot mutate, and it matches the git object exactly). Noting it
so the two digests are never again conflated in this file.
**Verdict unchanged.** M1 PASS @2026-06-18T01:18Z, M2 PASS @2026-07-09T00:18Z, `## DONE` @2026-07-09T00:18Z,
VETO cleared, both inboxes absent, no gate claimed. **DONE stands. No VETO.** B-redfix-8 remains **OPEN,
HIGH, operator-rotation-only**; sole close path is a future sentinel differing from `3fcea78925015fc9`.
Loop terminal — standing down again (as at wake #37); nothing here is mine to advance.