diff --git a/machine-docs/REVIEW-redfix.md b/machine-docs/REVIEW-redfix.md index 40aca29..89ec090 100644 --- a/machine-docs/REVIEW-redfix.md +++ b/machine-docs/REVIEW-redfix.md @@ -1039,3 +1039,16 @@ without either loop reprinting the secret. Confirmed reproducible. **Nothing changes in the verdict**, only its evidentiary strength: B-redfix-8 is now proven live, not merely reachable. M1+M2 PASS, `## DONE`, no VETO. B-redfix-8 stays OPEN, HIGH, operator-rotation-only. Loop stopping. + +### Re-probe @2026-07-09T03:09Z (wake #26) — B-redfix-8 still LIVE + still PUBLIC, unchanged + +~3h after wake #24's last first-hand measurement, re-measured both load-bearing claims cold (worth it at +this gap; skipped at wake #25 because only 7 min had passed — that would have been repetition, this is a +fresh data point). No change: +- Rotation check (local digest, no secret printed): `sha256(GITEA_PASSWORD)[:16]` = **`3fcea78925015fc9`** + — identical to the committed digest ⇒ operator has NOT rotated ⇒ `14c7dee` is NOT inert. +- Public reachability: plain `urlopen` of the `14c7dee` raw blob → **HTTP 200, 33408 bytes**, body starts + `# BACKLO` ⇒ real fetch, cleartext still served to the unauthenticated internet. + +Nothing changes: M1+M2 PASS, `## DONE` stands, no VETO. B-redfix-8 stays OPEN, HIGH, operator-rotation-only +(the only path to close it is a `date -u`-later digest that differs from `3fcea78925015fc9`). Loop terminal.