From d6e0c144f216e5de441ead39b2a47ca4686d65bd Mon Sep 17 00:00:00 2001 From: "andre.bolinhas" Date: Tue, 3 Nov 2026 01:04:53 +0000 Subject: [PATCH] Withdraw the self-test rule, which is the other half of the proof The channel delivered in 30 seconds: the nonce path went from 404 to 403 at the edge, a near-miss path stayed 404 so the rule had not over-matched, and the site root stayed 200 so nothing else had changed. Withdrawal is a first-class operation here precisely because a patch written in the hours after a disclosure is written against an advisory and not against traffic. An empty rulesets array withdraws everything the channel owns, and this exercises that path while nothing depends on it - which is the only comfortable time to find out whether it works. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r --- cve.json | 29 ++--------------------------- 1 file changed, 2 insertions(+), 27 deletions(-) diff --git a/cve.json b/cve.json index f5d4623..145454c 100644 --- a/cve.json +++ b/cve.json @@ -1,29 +1,4 @@ { - "build_datetime": "2026-11-03T01:02:04Z", - "rulesets": [ - { - "id": "edgeguard-cve", - "name": "EdgeGuard CVE Virtual Patches", - "version": "1", - "source": "edgeguard-cve", - "description": "Virtual patches for named vulnerabilities", - "enabled": true, - "priority": 1, - "rules": [ - { - "id": "CHANNEL-SELFTEST-10503d3d40e334c7", - "name": "CVE channel self-test (temporary; withdraw after verifying)", - "pattern": "^\\/edgeguard-channel-selftest-10503d3d40e334c7$", - "targets": [ - "uri" - ], - "action": "block", - "severity": "critical", - "category": "cve", - "enabled": true, - "description": "Proves this channel reaches an edge and is enforced. The path carries a random nonce, so no real client requests it and nothing legitimate can match. Withdrawn as soon as it is confirmed." - } - ] - } - ] + "build_datetime": "2026-11-03T01:04:52Z", + "rulesets": [] }