# CT100 Live Verification + Key Resolution — 2026-05-28/29

Live ground truth from CT100 (`root@192.0.2.100` → `pct exec 100`, repo `/opt/donjon-platform`). Corrects the frozen Windows-mirror audit.

## License keys — RESOLVED (P0 #1 is NOT a blocker)

- Private signing keys present at `C:/Users/Cris/donjonsec-infrastructure/keys/` (classical `.pem`, PQC `.bin`) and backed up on CT100 `/opt/donjonsec-keys/` (600, root-only).
- **Cryptographic match confirmed:** Ed25519 public key derived from `donjon-private-classical.pem` == `_PUBLIC_KEY_CLASSICAL_B64` embedded in `lib/licensing.py`. → embedded keys are REAL production keys; the "Placeholder values" comment is stale/misleading.
- Signing pipeline: offline CLI `donjon-license-admin.py` (per reference_license_keys memory) + admin portal `admin.donjonsec.com`. CF worker = storage/distribution only (does not sign).
- **Residual (not blocker):** fix misleading comment in `lib/licensing.py:77`; add end-to-end sign→validate test (AC7).

## Intel freshness automation — HEALTHY, narrow bug (P0 #4 downgraded)

- Cron installed: `0 2 * * 0 /opt/donjon-platform/tools/weekly-intel-update.sh` (Sun 02:00 UTC).
- Script `-rwxr-xr-x`, post-fix version (mtime May 1).
- Heartbeats present + recent: `.intel-heartbeat-start` May 24 02:00, `.intel-heartbeat-ok` May 24 06:58 → last weekly run completed cleanly.
- Log: May 24 run built 125M diff bundle, published to Forgejo (release `intel-2026-05-24`, ID=17).
- Data age (as of May 29 00:59 UTC): ~5 days; KEV 116h, feeds 114h.
- **BUG (confirmed live):** `bin/update-intel.py --check` prints "STALE DATA DETECTED" (KEV >48h, feeds >72h) but returns **EXIT=0**. Freshness gate is false-green — any exit-code-based automation/watchdog sees green while data is stale.
- **Cadence mismatch:** weekly cron vs KEV's 48h threshold — KEV will routinely exceed threshold between runs. Consider more frequent KEV-only refresh.
- `sqlite3` CLI not installed on CT100 (couldn't dump update_log directly; --check sufficed).

## Revised P0 launch-blockers

| P0 | Status |
|---|---|
| #1 license keys | ✅ RESOLVED (keys real, verified) |
| #2 trial self-grants infinite Pro | ❌ stands |
| #3 framework cap (3) unenforced | ❌ stands |
| #4 freshness | ⬇️ DOWNGRADED — automation healthy; fix `--check` exit code, KEV cadence, dashboard staleness stub (`web/api_intel.py:27-49`) |
