Concresca — locked diagnostic page

Report body

Concresca — locked diagnostic page

Build: concresca-locked-diagnostics-20260927-v1

This is a separate, read-only troubleshooting page. It is not another site replacement, an autonomous-verification approval gate, or a claim that the production fault is fixed.

Install: upload two new files, no installer command

Extract Concresca-locked-diagnostics-20260927.zip into the actual website document root: the directory serving the existing status/ page. The two files must be directly in that directory, not in concresca-repair/, an extra ZIP-named subdirectory, or a separate application directory that the website does not serve.

The ZIP contains only:

concresca-diagnostics.php
concresca-diagnostics-check.txt

It contains no .htaccess, application replacements, database files, credentials, receipts, or passing readiness snapshots. Both public files are packaged with Unix mode 0644. Do not overwrite unrelated hosting configuration or broadly change file permissions.

Open:

https://concresca.com/concresca-diagnostics.php

On its first successful HTTPS request, PHP generates a random 64-character access code and stores it in an owner-only file outside the website directory. No access code is included in the download.

In the hosting File Manager, go to the account home, turn on Show hidden files, and open:

.concresca-diagnostics/access-code.txt

Copy the code into the page's Server-generated access code field. Click Unlock diagnostics, then Run diagnostics. When the checks finish, click Download redacted report. Share that JSON report, not the access code or private files.

A typical arrangement is:

hosting-account-home/
├── .concresca-diagnostics/          generated on the host, not public
│   ├── access-code.txt             owner-readable code; mode 0600
│   ├── attempts.json               bounded login-attempt counters
│   ├── lock
│   └── sessions/                   private diagnostic sessions
└── public_html/                    or the domain's actual document root
    ├── concresca-diagnostics.php    new public PHP entry point
    ├── concresca-diagnostics-check.txt
    └── status/                     existing website files, unchanged

The page discovers an account home from the PHP process's home or recognized public-directory layouts, checking ownership and boundaries. It deliberately refuses to create a code in the public website. If it cannot establish a safe location, it shows a setup error rather than silently falling back to public storage.

What the report contains

The report separates local disk observations, historical installation records, and fresh HTTPS responses. It includes:

• Whether PHP is executing, its server API, reported web-server family, and available HTTPS client mechanisms.
• Whether the local .htaccess declares a Passenger application root, interpreter, or private environment pointer. Values and full paths are not exported; declarations do not prove the effective server configuration.
• Up to four application candidates found in a bounded set of locations, file visibility, permissions, modification times, and hashes for selected nonsecret source/client files. Hash matches identify bytes from the uploaded source or previous repair packages, not a successful deployment or loaded-code identity.
• Whether a static status placeholder exists locally, and whether the current HTTP endpoint returns it.
• The presence and selected safe fields of the previous installer's receipt, verifier heartbeat, and stored acceptance receipt. Historical installation booleans are explicitly labeled as historical. Receipt validity is not independently established by this PHP page.
• Fixed error-pattern names from the last 64 KiB of two known logs. No raw log lines are returned, and old log signatures are not presented as proof of the present fault.
• Fixed, unauthenticated GET requests to seven public endpoints: the installation marker, canonical status, readiness, health, autonomous health, capabilities, and status JavaScript.

Each HTTPS probe records its observation time, status code, a bounded body fingerprint, and an allowlisted interpretation. It never echoes arbitrary response bodies. A 200 status is not interpreted as a readiness pass. A placeholder is labeled static_pointer_not_runtime.

Security boundaries

The code is generated using 32 cryptographically random bytes, encoded as hexadecimal. It is readable in the protected file because this is the requested file-based unlock mechanism. It is never returned by the page, exported report, or public marker.

The diagnostic directory is mode 0700 and private files are 0600. Unsafe symlinks, hardlinks, owners, and public code-file permissions are rejected. The package does not rely on .htaccess to hide the access code: the code is outside the website root. The account home must also be outside any other publicly served root or alias on that account; this page cannot enumerate hidden provider-level aliases.

The code is renewed on the next visit after 24 hours. An unlocked session expires after at most 15 minutes, or sooner when the code changes. Rotate diagnostic code and lock replaces only the diagnostic code and invalidates diagnostic sessions. It does not change any Concresca participant credential.

The login uses POST over HTTPS, constant-time code comparison, strict session IDs, session-ID regeneration after login, Secure/HttpOnly/SameSite=Strict cookies, CSRF tokens, and bounded shared login throttling. The code is not accepted in a URL. Client-supplied forwarded-HTTPS headers are not trusted. Diagnostic responses have no-store, no-referrer, anti-framing, and restrictive content-security headers.

Authenticated checks are rate-limited. Public probes use a fixed compiled-in HTTPS origin and seven exact paths, do not follow redirects, send no credentials, impose response-size/read-time bounds, and do not disable certificate verification. There is no arbitrary-URL, arbitrary-file, upload, shell, command-execution, installer, database-login, restart, or configuration-editing action.

The diagnostic page writes only its own code, session, lock, and rate-limit files. It issues GET requests to the existing public endpoints; those endpoints' own internal behavior remains the application's responsibility. It neither creates nor changes autonomous-acceptance evidence.

The export uses allowlisted data rather than attempting to scrub and publish full logs or environment dumps. It excludes access codes, session identifiers, environment values, participant records, database credentials, account usernames and full filesystem paths. PHP errors are not echoed into the response.

When the diagnostic page itself does not open

PHP must be enabled for this domain and the web server must be able to serve this directory. The page is independent of the Python application, not independent of all web-server configuration. A parent .htaccess rejection, provider-level routing error, or disabled PHP handler can prevent this page from executing too.

Check the separate, nonsecret static marker:

https://concresca.com/concresca-diagnostics-check.txt

Expected content:

concresca-diagnostics-static-20260927-v1-725e438cd970

A minimal, unauthenticated execution check is also available at /concresca-diagnostics.php?action=ping. It reveals only this diagnostic build, whether PHP executed, and whether private code custody was initialized. It never returns the code or application diagnostics.

For an unusual host layout only, the top of the PHP file offers the server-local constants CD_PRIVATE_HOME and CD_APP_ROOT. They are never accepted through HTTP. The normal setup does not require editing them. Do not weaken the privacy/HTTPS checks to force a successful setup.

Limitations and removal

The page does not execute Python, connect to the database using credentials, inspect the live crontab, read arbitrary files, or attest which conditional web-server directives are active. A private environment file's presence does not establish that Python loaded it. File readability is observed from PHP, not from Passenger. The checks are intended to identify the next specific repair from evidence, not certify the entire host.

PHP 7.4-compatible syntax is used; use a maintained PHP release on the server. PHP 8.4 was tested here. The live hosting provider's PHP availability, ownership model, filesystem restrictions, and parent configuration have not been established in this session.

Remove the two uploaded public files to disable the page and marker. The .concresca-diagnostics directory may then be removed from the account home. Do not remove the application's separate runtime/ or private environment directories. No service operation depends on the diagnostic code or a person unlocking this page.

Primary implementation references

PHP random byte generation: https://www.php.net/manual/en/function.random-bytes.php

PHP session cookie attributes: https://www.php.net/manual/en/function.session-set-cookie-params.php

PHP HTTPS certificate verification: https://www.php.net/manual/en/context.ssl.php

PHP HTTP redirect options: https://www.php.net/manual/en/context.http.php

OWASP authentication guidance: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html

These references explain the mechanisms, not proof of correct configuration on the production host. See the separate validation report for the tests actually performed.