From 02813838324babc3207f12f113fa2d80e2d5270d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C3=81Z=C3=81R=20Imre=20AI=20Agent?= Date: Thu, 16 Jul 2026 11:42:09 +0200 Subject: [PATCH] docs(runbook): record final model and verification result MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Note the byte-fidelity decisions (cadcommonlib/maintenance as live files not submodules; public/ excluded as data) and the verification outcome (out/ = 23,578 files, non-malware code residual = 0). Signed-off-by: LÁZÁR Imre Assisted-by: claude-code@claude-opus-4-8 --- RUNBOOK.md | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/RUNBOOK.md b/RUNBOOK.md index 2f497977..48e24890 100644 --- a/RUNBOOK.md +++ b/RUNBOOK.md @@ -37,6 +37,14 @@ delta (`cadline.patch`), so `git diff` documents exactly our change vs upstream. Verification (residual→0, malware/data buckets) lives in **`illusion/hids`** (imrcli), which consumes `out/` as the per-vhost `vanilla_ref`. This repo only produces the input. +**Current build result (verified against the live RO mirror):** `out/` = 23,578 clean +code files. Byte-matches live for all legit code; differs only on the 4 known-infected +files where the baseline is intentionally clean (3 trojanized core files + the +`shaper_helix3/index.php` cloaking). **Non-malware code residual = 0** — every live code +file is either in the baseline or is excluded malware / scan artifact. 5 benign extra +files (clean core the package carries but live dropped). `public/` (~219k files) and +other runtime data are excluded as data, not code. + ## Module inventory (categorization) ### core @@ -68,10 +76,13 @@ in PROVENANCE.md. com_showroom, com_albanner, com_alworkshops, com_followedlinks, com_nonprofit, com_presentation, com_project, com_tcexam, com_versions; mod_al_*, mod_alusers, mod_alworkshops, mod_course_list, mod_webinar*, mod_wsregister; plg content/workshopdates; -templates blankframe, category; docroot apps (beiratkozas, iskolak, public, phpext); -docroot PHPs (crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php, -recaptchalib.php, configuration.php). Cadline-internal deployed-layout repos are -**git submodules**: `common_cadline_libraries` → cadcommonlib, `maintenance` → maintenance. +templates blankframe, category; docroot apps (beiratkozas, iskolak, phpext) + root PHPs +(crashadmin.php, crm_hardlock.class.php, login-external.php, tips.php, sbtrack.php, +recaptchalib.php, configuration.php). `common_cadline_libraries` and `maintenance/` come +from the Cadline-internal repos cadcommonlib / maintenance (see PROVENANCE.md) but are +kept as **vetted live files for byte-fidelity** (could be converted to git submodules +later — that would not change the byte-baseline). `public/` is **excluded — user data** +(~219k images/project files), not code. ### overrides/ — Cadline core modifications (23 files) com_content / com_users (registration/login/reset/remind), mod_login, captcha/recaptcha,