From 6b182d13ff713a86a7c125ae4234530cd910cf50 Mon Sep 17 00:00:00 2001 From: artale Date: Sun, 5 Jul 2026 14:17:08 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20upgrade=20claim=207=20from=20dangerous?= =?UTF-8?q?=20to=20advisory=20=E2=80=94=20git-proxy=20HAS=20POST=20/deploy?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Live SSH read of /home/goku/bin/git-proxy.py proves the /deploy route EXISTS as a POST handler (not GET, which correctly returns 404). It proxies to deploy-webhook:8098 WITH Authorization header forwarding. Auth-gated, not autonomous. Claim 7 updated to advisory with correct evidence. --- docs/receipts/stale-memory-quarantine-20260702.json | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docs/receipts/stale-memory-quarantine-20260702.json b/docs/receipts/stale-memory-quarantine-20260702.json index a038c5d..c7fea72 100644 --- a/docs/receipts/stale-memory-quarantine-20260702.json +++ b/docs/receipts/stale-memory-quarantine-20260702.json @@ -48,10 +48,11 @@ }, { "claim": "memory-only Phase 4 close loop: git-proxy /deploy to deploy-webhook, agents POST auth token, autonomous cycle without human intervention", - "severity": "dangerous", + "severity": "advisory", "location": "memory/gov-eric/Phase 4 close loop", - "evidence": "GET localhost:8099/deploy returns 404. auto_patch_proven=false. deploy-webhook:8098 exists but is NOT deploy authority (8099 is canonical).", - "verification": "SSH curl localhost:8099/deploy returns 404. curl localhost:8098 returns 200 but policy says 8098 is legacy." + "evidence": "Live git-proxy source code read via SSH: /deploy EXISTS as POST handler that proxies to deploy-webhook:8098 WITH Authorization header forwarding. GET /deploy returns 404 (correct). The route is POST-only and auth-gated. NOT autonomous -- requires Authorization header.", + "verification": "cat /home/goku/bin/git-proxy.py confirms do_POST /deploy routes to DEPLOY=http://127.0.0.1:8098 with Authorization forwarded. auto_patch_proven=false. The endpoint exists but is gated.", + "replacementTruth": "Phase 4 close loop EXISTS as POST-only /deploy on 8099 proxying to 8098 deploy-webhook with auth. NOT autonomous. auto_patch_proven=false until signed action payload test passes." }, { "claim": "memory-only port assignments for hermes-voice (18790) and openhands (3003)",