# Locked diagnostics — validation results

Build: `concresca-locked-diagnostics-20260927-v1`  
Date: September 27, 2026

## Results

**41 automated PHP/function and HTTPS integration tests passed.** The tests use isolated temporary files and a local TLS fixture, not production credentials or production service changes.

**A separate real Apache + mod_php + TLS check passed with the unmodified production PHP file.** No Passenger or Python dispatcher was loaded. With the original uploaded source's `.htaccess` in place, the new page returned HTTP 200, generated the private code, accepted a valid unlock, and returned a redacted local diagnostic report. In the same fixture, the missing Python readiness route returned HTTP 404 while the static status pointer remained HTTP 200. This establishes the key independence from a working Python route for the tested Apache configuration.

**Chromium rendering and JavaScript checks passed.** Locked and unlocked views rendered, the UI displayed all seven fixed probe results, recognized a placeholder and a 404, and constructed the redacted JSON export without JavaScript errors. Browser network navigation is blocked by this environment's managed policy. The policy was not changed: these UI checks used mocked fetch calls populated from actual PHP fixture responses. They are not an end-to-end browser network/cookie test; HTTP authentication and cookie attributes were tested separately.

## Coverage

The automated cases cover server-generated code location and mode, code renewal, private directory permissions, secure-cookie headers, anti-framing/no-cache headers, HTTPS enforcement, rejection of spoofed forwarded-HTTPS headers and wrong hosts, POST-only code handling, CSRF and origin checks, wrong-code throttling, authentication and session regeneration, 15-minute session expiry, logout, code rotation invalidating other sessions, read-only application-file hashes, fixed request paths, rejected arbitrary URLs/commands, no credentials in public probes, redirect refusal, response-size limits, certificate-chain and peer-name rejection, static-marker matching, field allowlisting, redaction canaries, unsafe symlink/hardlink rejection, and rejection of publicly readable code custody.

All code-generation credentials used in tests were temporary. None is in the deployable ZIP. The deployable ZIP contains exactly two public files and no root `.htaccess` or private files. Both ZIP file entries carry mode 0644 and their hashes were checked against the tested source.

## Boundaries

These tests do **not** establish that the production site's PHP handler is enabled, the live page has been deployed, a provider-level routing fault is repaired, Passenger/LiteSpeed/MySQL/cron is working, or autonomous acceptance has passed.

The tested PHP version was 8.4.23. Other PHP versions and the native cURL extension transport branch were not executed here; the PHP HTTPS-stream branch was exercised with certificate verification enabled, including rejection tests. A shared host may restrict access outside the document root; the page intentionally stops rather than storing the code publicly.

A matching file hash identifies those bytes, not effective configuration, loaded Python code, or a completed installer. A recorded installation receipt is historical evidence. The page explicitly labels these boundaries in its export.

The machine-readable validation is in `Concresca-locked-diagnostics-validation.json`. Reproducible test sources and local logs are in `Concresca-locked-diagnostics-source-and-tests.zip`; that archive is for local testing, **not** for uploading over the website. The deployment archive is only `Concresca-locked-diagnostics-20260927.zip`.