session-report · RPT-B3A28635E86E
R5 diagnostic CSRF repair — validation
Source identity
- Record
RPT-B3A28635E86E- Original file
- Concresca-FULL-ROOT-r5-test-results.md
- Original SHA-256
dcf380690135c3a6294bfa4ff2392e915757e5a1c29672bb5e1899304b87cf1e- Source family
- repair-conversation
- Public copy SHA-256
dcf380690135c3a6294bfa4ff2392e915757e5a1c29672bb5e1899304b87cf1e- Original custody
- Exact bytes retained in the private project package under
docs/_evidence/; not a public download.
Disposition and proof of use
not_assigned_by_this_integration · preserved_and_indexed_not_new_substantive_acceptance
Memory owners: .uai/architecture.uai, .uai/file-handoff.uai, .uai/operations.uai, .uai/report-synthesis.uai, .uai/research-review.uai, .uai/test-plan.uai. These are private repository records, not public web routes.
Jump to a report section
Report body
R5 diagnostic CSRF repair — validation
Reproduced failure
Using the unchanged r4 PHP file on native local Apache/PHP over HTTPS, the correct
local test code, matching cookie and matching form token were submitted with
Origin: null. The server returned HTTP 403 and {"error":"CSRF_REJECTED"}.
This is the header behavior described for native HTML form submissions under
Referrer-Policy: no-referrer. See CSRF-REPRODUCTION.json for the redacted record.
The test client supplied this header; no successful browser-navigation test is claimed.
Executed regression suites
| Suite | Passed |
|---|---|
| Repair/root/host tests, including new diagnostic HTTPS tests | 169 Python tests |
| Owned root runtime integration | 20 Python tests |
| Receipt publication and evidence validation | 39 Python tests |
| Private environment | 31 Python tests |
| Python total | 259 tests |
| Existing status client, synthetic Node fixtures | 78 assertions |
| New diagnostic client recovery, synthetic Node fixtures | 8 assertions |
| PHP diagnostic functions, including r5 recognition | 20 assertions |
| PHP CSRF validation and safe recovery | 26 assertions |
Nineteen new native Apache/mod_php HTTPS tests cover emitted referrer policy, page policy, inherited cookie domain reset, login with session/token rotation, redacted snapshot readback, wrong codes, opaque/foreign/sibling origins, cross-site metadata, missing tokens, stale forms, missing cookies, unauthenticated access, protected logout, successful logout, code rotation and other-session revocation, private-file permissions, generated JavaScript syntax and the existing synchronized-token path for clients that omit the Origin header. All requests in this suite connect only to 127.0.0.1 and use private temporary fixture codes. Diagnostic public-network probes are not exercised by this suite.
The pre-existing missing-private-file test initially reported unsafe parent permissions rather than missing-file status: its fixture created a nominally private directory using the ambient umask. The fixture now explicitly creates that directory with mode 0700 so it tests the intended missing-file condition. The production loader was not changed or weakened. The full suite passed again.
Packaging and boundaries
R5 is assembled from the complete r4 root release, not an overlay. The changed runtime-facing functionality is confined to diagnostics. Host activation files are updated for release identification; production Python runtime files are unchanged. The complete manifest is regenerated, and final ZIP extraction and checks are recorded in the external validation file. Archive file integrity is not source provenance, host activation or autonomous acceptance.
The native HTTPS tests use supplied Origin headers. An attempted Chromium navigation test could not run under the browser restrictions in this environment. No successful automated browser navigation is claimed. Synthetic JavaScript checks test error handling and redaction but are not a substitute for a real browser or the user's host session.
MySQL/MariaDB, Passenger, LiteSpeed and the live production host have not been executed or authenticated in this session. No host deployment, production state mutation, security bypass, or manufactured verification receipt occurred. The original live readiness incident remains unverified.