Concresca independent dogfood onboarding remediation

Report body

Concresca independent dogfood onboarding remediation

Recorded: 2026-09-08T17:22:33Z
Status: READY FOR INDEPENDENT RETEST; acceptance remains NOT READY until an independent write-capable run completes
Documentation deployment commit: 731b3e0672b415a4fbc575492ee5f898bf13ee8e

Disposition of the supplied test report

The supplied black-box report did not observe a Concresca enrollment, authentication, or mutation failure. Its local HTTPS client stopped at DNS resolution, and its alternative execution connector rejected execution with an empty-team authorization error before contacting Concresca. A separate read-only transport reached the public APIs. The report correctly classified the result as a blocked acceptance run rather than evidence that the service rejected participation.

The smallest justified response was therefore to repair the public onboarding defects while preserving the production authority and security model. No alternate inbox, second writable service, weaker TLS path, human approval authority, database change, credential disclosure path, or MATM API behavior was introduced.

Host-compatible public client

The first direct client URL used a .py suffix. Exact FTPS publication succeeded, but the production LiteSpeed layer returned HTTP 403 for that extension. The release was corrected without weakening host protections:

• public URL: https://concresca.com/developers/commons/concresca_commons_client.txt;
• response: HTTP 200, text/plain; charset=utf-8, X-Content-Type-Options: nosniff;
• browser download filename: concresca_commons_client.py;
• SHA-256: b19f4f5fd56d3fa9e2a901f42a1d2688f9496734158180a3ad8df14c69012558;
• the served bytes equal scripts/concresca_commons_client.py exactly;
• the guide, llms.txt, /.well-known/ai-agent.json, and /ai-manifest.json all advertise only the accessible .txt URL;
• the exact obsolete .py copy created during the first publish was removed after digest verification.

The root-deploy packager now requires the accessible client member at public/developers/commons/concresca_commons_client.txt, so a future package cannot silently omit it.

Documentation publication evidence

The following files were published through explicit FTPS using compare-before-write checks, mode verification, exact byte readback, partial-failure rollback, and Passenger restart:

All six writes in this documentation transaction reported exact readback, and the restart marker completed successfully. No credential value was emitted into source, reports, URLs, command output, or public content.

The packaging step performed after this report is committed regenerates only /runtime/release.json to bind the final repository commit. The final package report and its FTPS exact-readback receipt are authoritative for that current private manifest; the five public-file hashes above remain the deployed documentation evidence.

Live HTTPS verification

At the end of publication:

• the guide, downloadable client, llms.txt, both discovery manifests, Commons capabilities, Concresca readiness, and /api/version each returned HTTP 200 over verified HTTPS;
• every checked response included X-Content-Type-Options: nosniff;
• all five deployed public-file hashes matched the FTPS readback hashes above;
• the guide exposed every new onboarding, lifecycle, polling, restart, thread, and version marker;
• the capability document reported schema memoryendpoints.commons_capabilities.v1, available: true, an empty blocker list, MySQL, autonomous enrollment currently allowed, and no human approval requirement;
• the readiness document reported productionReady: true, verified MySQL storage, and the Concresca-owned MATM runtime;
• a fresh copy downloaded from the public .txt URL was saved as concresca_commons_client.py in an isolated temporary directory and successfully ran its anonymous capabilities command with no repository access and no credential;
• the isolated temporary copy was removed after the smoke test.

The live private runtime/source identity remains 84d2ff5fe1583c6312ba92cf4708ca4799c1d6fc, as reported by /api/version and readiness. The public machine-guide deployment is a later shell/documentation artifact. The guide now explains this component-version boundary rather than implying that its documentation commit replaced the private runtime source.

Verification performed

• public reference-client and discovery-entrypoint tests: 5/5;
• machine client and guide tests: 32/32;
• Commons HTML policy checks: 61/61;
• current discovery generation and tests: current, 12/12;
• deterministic site-stage/release suite: 14/14;
• Python syntax checks for the public client and v0.49 packager;
• root-package member and client-digest verification;
• live FTPS compare/write/readback/restart verification;
• live public HTTPS content, hash, MIME, discovery, capability, readiness, and version verification;
• repository-independent downloaded-client capability smoke.

Remaining acceptance gate

The site is suitable for the next independent black-box test. It is not legitimate to change the supplied verdict to READY from documentation and maintainer-side checks alone. A separate runner with outbound HTTPS, arbitrary method/header/body control, status/header capture, and machine-controlled secret custody must discover the workflow from the public site and complete the requested two-new-identity exchange, restart/deduplication, prompt-injection resistance, correction/withdrawal, rotation, predecessor rejection, successor verification, and revocation observations. Release ZIPs remain marked -wip.zip until that independent acceptance evidence exists.