R-410. golden_currency_gate.py matched EVIDENCE_RE against os.listdir and read nothing
inside, so `mkdir documentation/tests/golden-9.9.9-2026-01-01` turned it green with no bake
behind it - noticed while the 0.230.0 bake was running, when the evidence directory existed
before the bake finished. It now reads the GOLDEN_SHA256= line out of that directory's bake
log: a directory name is a label, that line is a fact only a completed publish produces.
Still offline, still --fast, one file read. Directories that look right and hold nothing are
printed by name rather than silently ignored, so a half-finished bake is visible.
test_golden_currency_gate.py ships the red-proof with a POSITIVE CONTROL, without which
"it fails on an empty directory" would be satisfied by a gate that fails on everything:
CASE 1 empty directory -> rejected and named
CASE 2 log with no GOLDEN_SHA256 -> rejected
CASE 3 real bake log -> counted, and its sha read <- the control
CASE 4 the tree is left byte-identical
Red-proofed: reverting the gate to name-matching fails cases 1, 2 and 3.
R-406. Citations MEASURED before choosing, which is what the row asked for: hub-uniqueness
had 3 references (all inside one audit doc), plaintext-break-glass had 5 (CONTEXT.md,
break-glass.md, hub/CHANGELOG.md, the capability map, a spike). The FEWER-cited one moved -
hub uniqueness is now R-415 - and all three citations were rewritten to "R-415 (was R-133)"
rather than silently swapped.
THIS IS THE OPPOSITE OF THE TASK'S LITERAL INSTRUCTION, which said renumber the second row on
the stated ground that "the older number has the longer reference trail". Measured, that
ground points the other way. The principle was followed and the letter was not, and the row
says so rather than leaving an unexplained diff.
R-416 filed: the within-register duplicate rule was deliberately NOT added in the same commit
that removed its only subject - a guard whose red-proof can only be a planted fixture is not
this project's standard. Now that the register is clean it can ship with the next real
duplicate as its first subject.
Question A: YES, no code change. customer.domain is a trimmed string with no
UNIQUE, no CHECK, no format rule (store.go:114, configs.go:673), copied verbatim
into controller.yaml (configgen.go:48), and every one of its 30 consumers on the
box interpolates it without parsing. Zero hits for registrable/eTLD/publicsuffix
across both repos. Nothing creates DNS records (zero hits for dns_records) — the
two Cloudflare clients are WAF-only. And the zone-ownership assumption is a
SWITCH, not a requirement: traefik.yml.tmpl selects DNS-01 when cf_api_token is
set and HTTP-01 when it is empty.
The real blocker is Cloudflare, proven live: the edge certificate covers exactly
one wildcard level (SAN = demo-felhom.eu, *.demo-felhom.eu), so a two-label
hostname — which a per-tester subdomain forces — gets "tls alert handshake
failure" and no peer certificate at all. That makes Advanced Certificate Manager
a prerequisite of the separate-domain plan, not an optional extra. Whether ACM is
available on the account could not be established read-only: the only Cloudflare
tokens in reach are the Zone:DNS:Edit tokens on the demo boxes, which the fence
forbids using.
Question C, measured rather than reasoned: r.Cookie returns the FIRST match and
never tries the others (BOGUS+real = 302, real+BOGUS = 200), so a tossed cookie
wins outright — DoS and confusion, not takeover, since it fails closed on
mutations. CSRF is a single choke point (server.go:256) and the token carries the
whole load against a same-registrable-domain attacker. But it is SKIPPED entirely
when no session cookie is present, which with browser-cached Basic auth is
cross-origin CSRF on every mutating route (R-135).
Agreeing with the separate-domain recommendation, with the caveat the brief asked
for: it is necessary but not sufficient. It does not solve Question D, because
that is a shared-zone problem and the new domain is a shared zone.
Filed R-133..R-138: duplicate domains accepted; hub/controller zone-resolvers
disagree on depth; CSRF skipped on the no-cookie path; __Host- rename (one line,
preconditions verified met); geo-WAF rules zone-scoped and non-namespaced (four
cross-tenant faults, blocks shared-zone onboarding); shared-zone cf_api_token is
a zone-wide DNS-write capability on a customer's box.
Nothing created: no customer, DNS record, tunnel, route or code change.
admin