Locked diagnostics — validation results

Report body

Locked diagnostics — validation results

Build: concresca-locked-diagnostics-20260927-v1
Date: September 27, 2026

Results

41 automated PHP/function and HTTPS integration tests passed. The tests use isolated temporary files and a local TLS fixture, not production credentials or production service changes.

A separate real Apache + mod_php + TLS check passed with the unmodified production PHP file. No Passenger or Python dispatcher was loaded. With the original uploaded source's .htaccess in place, the new page returned HTTP 200, generated the private code, accepted a valid unlock, and returned a redacted local diagnostic report. In the same fixture, the missing Python readiness route returned HTTP 404 while the static status pointer remained HTTP 200. This establishes the key independence from a working Python route for the tested Apache configuration.

Chromium rendering and JavaScript checks passed. Locked and unlocked views rendered, the UI displayed all seven fixed probe results, recognized a placeholder and a 404, and constructed the redacted JSON export without JavaScript errors. Browser network navigation is blocked by this environment's managed policy. The policy was not changed: these UI checks used mocked fetch calls populated from actual PHP fixture responses. They are not an end-to-end browser network/cookie test; HTTP authentication and cookie attributes were tested separately.

Coverage

The automated cases cover server-generated code location and mode, code renewal, private directory permissions, secure-cookie headers, anti-framing/no-cache headers, HTTPS enforcement, rejection of spoofed forwarded-HTTPS headers and wrong hosts, POST-only code handling, CSRF and origin checks, wrong-code throttling, authentication and session regeneration, 15-minute session expiry, logout, code rotation invalidating other sessions, read-only application-file hashes, fixed request paths, rejected arbitrary URLs/commands, no credentials in public probes, redirect refusal, response-size limits, certificate-chain and peer-name rejection, static-marker matching, field allowlisting, redaction canaries, unsafe symlink/hardlink rejection, and rejection of publicly readable code custody.

All code-generation credentials used in tests were temporary. None is in the deployable ZIP. The deployable ZIP contains exactly two public files and no root .htaccess or private files. Both ZIP file entries carry mode 0644 and their hashes were checked against the tested source.

Boundaries

These tests do not establish that the production site's PHP handler is enabled, the live page has been deployed, a provider-level routing fault is repaired, Passenger/LiteSpeed/MySQL/cron is working, or autonomous acceptance has passed.

The tested PHP version was 8.4.23. Other PHP versions and the native cURL extension transport branch were not executed here; the PHP HTTPS-stream branch was exercised with certificate verification enabled, including rejection tests. A shared host may restrict access outside the document root; the page intentionally stops rather than storing the code publicly.

A matching file hash identifies those bytes, not effective configuration, loaded Python code, or a completed installer. A recorded installation receipt is historical evidence. The page explicitly labels these boundaries in its export.

The machine-readable validation is in Concresca-locked-diagnostics-validation.json. Reproducible test sources and local logs are in Concresca-locked-diagnostics-source-and-tests.zip; that archive is for local testing, not for uploading over the website. The deployment archive is only Concresca-locked-diagnostics-20260927.zip.