From de126b302faf0486302419eece2ac3797290422d Mon Sep 17 00:00:00 2001
From: autonomic-bot <autonomic-bot@git.autonomic.zone>
Date: Thu, 9 Jul 2026 02:37:02 +0000
Subject: [PATCH] =?UTF-8?q?review(redfix):=20CONFIRM=20Builder's=20"still?=
 =?UTF-8?q?=20LIVE=20not=20merely=20served"=20strengthening=20(27d6a5a)=20?=
 =?UTF-8?q?=E2=80=94=20independently=20re-derived=20from=20artifacts,=20se?=
 =?UTF-8?q?cret=20never=20materialized:=20live=20GITEA=5FPASSWORD=20from?=
 =?UTF-8?q?=20.testenv=20is=20verbatim=20in=20the=20public=2014c7dee=20blo?=
 =?UTF-8?q?b=20(True),=20sha256[:16]=20=3D=3D=20committed=203fcea78925015f?=
 =?UTF-8?q?c9,=20and=20the=20documented=20operator=20re-check=20one-liner?=
 =?UTF-8?q?=20runs=20verbatim=20and=20prints=20that=20digest.=20Real=20dis?=
 =?UTF-8?q?tinction=20(reachable=20!=3D=20live;=20"unrotated"=20had=20been?=
 =?UTF-8?q?=20true-by-repetition)=20and=20it's=20the=20basis=20of=20the=20?=
 =?UTF-8?q?HIGH=20rating.=20Verdict=20strength=20up,=20verdict=20unchanged?=
 =?UTF-8?q?:=20DONE=20stands,=20no=20VETO,=20B-redfix-8=20OPEN=20on=20oper?=
 =?UTF-8?q?ator=20rotation.=20Loop=20stopping.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 machine-docs/REVIEW-redfix.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md
index a224526..40aca29 100644
--- a/machine-docs/REVIEW-redfix.md
+++ b/machine-docs/REVIEW-redfix.md
@@ -1020,3 +1020,22 @@ VETO cleared, both inboxes empty, no gate claimed. **DONE stands. No VETO.** The
 **B-redfix-8 — a live, world-readable, push-capable `autonomic-bot` Gitea credential at `14c7dee` (re-probed
 HTTP 200 this wake, still unrotated)** — is HIGH, urgent, and closable only by operator rotation. Adversary
 loop stopping: nothing remains that is mine to advance.
+
+### Re-test @2026-07-09T02:36Z — Builder's "still LIVE" strengthening (27d6a5a) INDEPENDENTLY CONFIRMED
+
+The Builder drew a distinction my own probes had glossed: public *reachability* (HTTP 200) and the served
+value being the *current live credential* are two claims, and until now only reachability was ever measured —
+"unrotated" was carried by repetition. Correct catch, and it is the whole basis of the HIGH rating, so I
+re-derived it myself from the artifacts (not from 27d6a5a's message), without materializing the secret:
+
+- `GITEA_PASSWORD` from `/srv/cc-ci/.testenv` (the value the harness authenticates with **today**) is present
+  **verbatim** in the public `14c7dee` blob → `True`.
+- `sha256(live password)[:16]` = **`3fcea78925015fc9`**, matching the Builder's committed digest exactly.
+- The documented operator re-check one-liner runs verbatim (no SyntaxError) and prints `3fcea78925015fc9`.
+
+So the bytes the open internet serves ARE the password in live use — the exposure is not inert. The digest
+commitment is a good move: it lets the operator confirm rotation later (any other digest ⇒ rotated ⇒ inert)
+without either loop reprinting the secret. Confirmed reproducible.
+
+**Nothing changes in the verdict**, only its evidentiary strength: B-redfix-8 is now proven live, not merely
+reachable. M1+M2 PASS, `## DONE`, no VETO. B-redfix-8 stays OPEN, HIGH, operator-rotation-only. Loop stopping.