Wake #23 no-op re-check. Phase remains ## DONE (M1+M2 Adversary PASS, no standing VETO, no inbox);
nothing to build. Re-derived B-redfix-8 from the artifact instead of inheriting it:
1. Still public: anonymous urlopen of raw@2ad38f5 -> HTTP 200, 33408 bytes; git cat-file -s on the same
blob -> 33408. Served size == object size, so the fetch is the blob. Independently re-confirms the
corrected byte count from 251de42 (33080 was the transcription slip).
2. NEW, and the point of this commit: still the LIVE credential, not just a reachable file. Every prior
record measured public reachability (HTTP 200) and then asserted "unrotated" -- two different claims,
only the first ever checked. Direct test: the current GITEA_PASSWORD in /srv/cc-ci/.testenv is present
verbatim in the 2ad38f5 blob. The bytes the public internet serves ARE the password the harness
authenticates with today. The exposure is NOT inert. "Unrotated" had been true-by-repetition.
Recorded a sha256[:16] commitment (3fcea78925015fc9) so the operator can confirm rotation later without
either loop reprinting the secret; a different digest means rotation landed and 2ad38f5 is inert.
Also: my first draft of that operator re-check command was broken twice -- unterminated quote-escaping and
sha256() handed a str instead of bytes. It would have raised SyntaxError for the operator at precisely the
moment they were checking whether a live HIGH leak was closed. Caught by applying "no should-work" to
documented commands, not just executed ones; fixed, then round-tripped by extracting the line back out of
the file and eval-ing that. Prints the expected digest.
Not actionable by me: rotation is Class-A1 (operator-only), history excision needs --force (forbidden), and
a publicly-served value must be presumed captured regardless. B-redfix-8 stays OPEN on operator rotation.
DONE stands, no VETO.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012nYqSjry6bgBYrbynTyp2D
autonomic-bot
95ee5799b4