fixes 2026-10-21: evidence so far (R-1176 live proof, R-1192 freeze measured, R-1191 on 9202); design notes 03 §8a / 07 §7.0, §8.2a (D25) / 05 §16.5 (DST)

documentation/audits/fixes-2026-10-21/tools/bind_curl.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+# bind_curl.sh — the household's bind page, endpoint-level (no browser on DooPlex): GET the page, then the same POST its
+# form sends. Env (from `sec run`, names passed as args): TOKEN_ENV PAIR_ENV PASS_ENV. Secrets go through 0600 files,
+# never a command line; prints status lines and the page's visible text only.
+set -euo pipefail
+TOK=${!1}; T=$(mktemp -d); chmod 700 "$T"; trap 'rm -rf "$T"' EXIT
+printf '%s' "${!2}" > "$T/pc"; printf '%s' "${!3}" > "$T/pp"
+U="https://hub.felhom.eu/bind/$TOK"
+curl -s -o "$T/g" -w "GET %{http_code}\n" "$U"
+curl -s -o "$T/p" -w "POST %{http_code}\n" --data-urlencode "pairing_code@$T/pc" --data-urlencode "passphrase@$T/pp" "$U"
+python3 - "$T/p" <<'PY'
+import re,sys,html
+t=open(sys.argv[1],encoding="utf-8").read()
+t=re.sub(r"<(script|style)[^>]*>.*?</\1>","",t,flags=re.S)
+print("answer:", re.sub(r"\s+"," ",html.unescape(re.sub(r"<[^>]+>"," ",t))).strip()[:400])
+PY