Joseph R. Goydish II
80 KiB
INTAKE LEDGER — JGoyd Evidence System
Auto-generated by drop-intake workflow
Maintainer: Joseph R. Goydish II (josephgoyd@proton.me)
Canonical PGP fingerprint: 4A04 1F50 6D89 4F5E E391 7438 6487 8B56 A2EB 2D11
This ledger is the single source of truth for raw materials staged into the evidence system. Every file dropped by the maintainer is hashed (SHA-256), classified (Track A / Track B), assigned to a case folder, and given an OpenTimestamps anchor target before it is referenced in any public artifact.
Domain separation rule (mandatory): Track A (regulatory/whistleblower) and Track B (cybersecurity) MUST NEVER be mixed in a single claim, README, or anchor line. This ledger enforces that boundary at the row level.
Drop batch — 2025-05-18 (9 files)
| # | Source filename | SHA-256 (12) | Size | MIME | Track | Case folder | Role |
|---|---|---|---|---|---|---|---|
| 1 | CERT_CC-email-thread.eml |
1b8ef561265c |
4,745 B | message/rfc822 | B | TRACK-B-CVE-2025-31200-31201 |
CERT/CC reply (2025-03-03) — DKIM cert.org/amazonses.com pass |
| 2 | gen-41698-Re_-VRF-25-01-MPVDT-2025-03-03T10_08_46-05_00-2.eml |
1b8ef561265c |
4,745 B | message/rfc822 | B | TRACK-B-CVE-2025-31200-31201 |
DUPLICATE of #1 (byte-identical) — keep for chain-of-custody |
| 3 | 01_21_2025-_-VRF-25-01-MPVDT-iOS-Critical-Vulnerability-_-Audio-Message-3 |
dbf4a7eee33e |
10,594 B | text/markdown* | B | TRACK-B-CVE-2025-31200-31201 |
Original 2025-01-21 VRF submission to CERT/CC (AudioConverterService / iOS 18.3 Beta / 18.2.1) |
| 4 | iOS-Critical-Vulnerability-_-Audio-Message-VRF-25-01-MPVDT-6.md |
dbf4a7eee33e |
10,594 B | text/markdown | B | TRACK-B-CVE-2025-31200-31201 |
DUPLICATE of #3 (byte-identical) |
| 5 | Google-Mandiant-email-submission-thread-4.eml |
41d3087c6dfe |
25,803 B | message/rfc822 | B | TRACK-B-CVE-2025-31200-31201 |
2025-05-03 Yahoo self-forward "Fw: Iphone Hardware Flaw" — DKIM yahoo.com pass |
| 6 | April-11-Google-Mandiant-Report-Hardware-Flaw-5.md |
9ec55975159b |
9,054 B | text/markdown | B | TRACK-B-CVE-2025-31200-31201 |
2025-04-11 PME-enforcement / malformed-MP4 hardware-flaw report draft |
| 7 | VINCE-Portal-VU-395558.1.jpg |
36034d649132 |
263,662 B | image/jpeg | B | TRACK-B-CVE-2025-24085-24201-43300 |
VINCE portal screenshot for VU#395558 (case 2162) |
| 8 | VINCE-Invite-Email-2.pdf |
3c679088008a |
114,564 B | application/pdf | B | TRACK-B-CVE-2025-24085-24201-43300 |
VINCE invitation rendered as PDF (companion to #9) |
| 9 | VU-395558_-Invitation-to-Participate-in-Vulnerability-Coordination-2025-01-09T11_36_03-08_00-3.eml |
aabfb24758678 |
27,274 B | message/rfc822 | B | TRACK-B-CVE-2025-24085-24201-43300 |
2025-01-09 CERT/CC invitation to VINCE VU#395558 — DKIM cert.org/amazonses.com pass |
* File extension is absent on #3; magic detector reported text/x-script.python but content is the markdown VRF report (byte-identical to #4).
Full SHA-256 (long form)
1b8ef561265cdde6908fe0b3c3975f505b71d35772f4b63026be1ac74a09f4c7 CERT_CC-email-thread.eml
1b8ef561265cdde6908fe0b3c3975f505b71d35772f4b63026be1ac74a09f4c7 gen-41698-Re_-VRF-25-01-MPVDT-2025-03-03T10_08_46-05_00-2.eml
dbf4a7eee33ed223ea048fc08ef831a1d643ffad6da7184f0f509e493d5ae31f 01_21_2025-_-VRF-25-01-MPVDT-iOS-Critical-Vulnerability-_-Audio-Message-3
dbf4a7eee33ed223ea048fc08ef831a1d643ffad6da7184f0f509e493d5ae31f iOS-Critical-Vulnerability-_-Audio-Message-VRF-25-01-MPVDT-6.md
41d3087c6dfe3595aa66b31c44a37b409e360e43099ae76af66584e1afa79c51 Google-Mandiant-email-submission-thread-4.eml
9ec55975159b7e7d7aae1b3308c844fec231a5616251cd4eb80bae175ca4e901 April-11-Google-Mandiant-Report-Hardware-Flaw-5.md
36034d64913277f6bfed785c5208c29726fdb39252a4c8f38a6cd8e77423a083 VINCE-Portal-VU-395558.1.jpg
3c679088008a51298ab352a1dc847847ea1a65af4164f4b10336690d1577fdf0 VINCE-Invite-Email-2.pdf
aabfb24758678f16936d70598ba8b87a33d78e52e5fa5c8e87573c26394361cc VU-395558_-Invitation-to-Participate-in-Vulnerability-Coordination-2025-01-09T11_36_03-08_00-3.eml
DKIM authentication summary (extracted from headers)
| File | Authenticated domain | Selector | Result |
|---|---|---|---|
| #1 / #2 | cert.org |
zr2q7qzk2bw3mfxafkttrbx3dstyubyk |
dkim=pass (1024-bit key) |
| #1 / #2 | amazonses.com |
ug7nbtf4gccmlpwj322ax3p6ow6yfsug |
dkim=pass (1024-bit key) |
| #5 | yahoo.com |
s2048 |
dkim=pass (2048-bit key) |
| #9 | cert.org |
zr2q7qzk2bw3mfxafkttrbx3dstyubyk |
dkim=pass (1024-bit key) |
| #9 | amazonses.com |
ug7nbtf4gccmlpwj322ax3p6ow6yfsug |
dkim=pass (1024-bit key) |
Each dkim=pass is verifiable independently by anyone with the raw .eml — these are the external anchors that ground every other claim downstream.
Track classification rationale
- All 9 files = Track B. Each one concerns iOS vulnerabilities (CoreAudio / RPAC / BlastDoor / ImageIO) handled through cybersecurity coordination channels (CERT/CC VINCE, Mandiant). None of them touch the regulatory/whistleblower filings that belong to Track A (LT, SK, JP-ISA, OLAF, SEC-TCR, IRS-211, MA-AGO, FCA, FARA, CPIB, TW-NCC).
Anchor plan (next step — commands generated separately, run locally)
For each of the 7 unique-content files (4 distinct hashes for case 31200/31201, 3 for case 24085/24201/43300):
# Run locally — do NOT run from this build environment
ots stamp <file> # creates <file>.ots
gpg --default-key 4A041F506D894F5EE39174386487 8B56A2EB2D11 \
--armor --detach-sign <file> # creates <file>.asc
Both .ots and .asc are committed to the case folder alongside the source file. The result is: timestamp-anchored + author-signed, with the original DKIM signature still embedded in the .eml.
Drop batch — 2026-05-18 (7 files, all Track A)
| # | Source filename | SHA-256 (12) | Size | MIME | Track | Case folder | Role |
|---|---|---|---|---|---|---|---|
| 10 | SEC_Referral_17780-976-067-126-3.pdf |
703f5daadda9 |
139,629 B | application/pdf | A | TRACK-A-SEC-TCR-17780-976-067-126 |
SEC TCR submission confirmation (2026-05-06) — Submission #17780-976-067-126 |
| 11 | SEC_Referral_17780-976-067-126_Evidence_Packet-4.pdf |
f5421ab03106 |
17,930 B | application/pdf | A | TRACK-A-SEC-TCR-17780-976-067-126 |
Bates evidence packet (§206 Investment Advisers Act, Joi Ito subject), sourced to DOJ public-release Epstein corpus |
| 12 | SEC_TCR_ITO_SUPPLEMENT_01-5.pdf |
1003cfc2ecf7 |
242,981 B | application/pdf | A | TRACK-A-SEC-TCR-17780-976-067-126 |
Supplement 01 to TCR (2026-05-13) — targeted-lead expansion |
| 13 | SEC-Ombuds-Matter-Management-System-OMMS-Submission-Matter-ID-Number-20260513-00019687-2026-05-14T11_04_55-07_00-6.eml |
bff7f3b7aa44 |
16,692 B | message/rfc822 | A | TRACK-A-SEC-TCR-17780-976-067-126 |
SEC Ombuds reply (Matter ID 20260513-00019687) — DKIM-pass on sec.gov (2048-bit, selector secomms) |
| 14 | SEC-Ombuds-Matter-Management-System-OMMS-Submission-Update-to-case-7.pdf |
4a64bdb41679 |
840,391 B | application/pdf | A | TRACK-A-SEC-TCR-17780-976-067-126 |
Proton-Mail print-to-PDF of #13 (image-only; the .eml is the cryptographic anchor) |
| 15 | Re_-Bank-of-China-UK-Limited-and-Standard-Chartered-ref_-00Db00K8yP.-500Sk019RuGn_ref-2026-05-11T08_09_57-07_00.eml |
207fa35b8c57 |
25,155 B | message/rfc822 | A | TRACK-A-FCA-BoC-StanChart |
OUTBOUND reply to FCA (consumer.queries@fca.org.uk) on FCA reference 00Db00K8yP.500Sk019RuGn (2026-05-11) — supplements original BoC/StanChart conduct/AML report |
| 16 | RefNo-69f824dfe5ef7daf3b78ccee-3.pdf |
b0f4d9eed94b |
102,555 B | application/pdf | A | TRACK-A-CPIB-69f824dfe5ef7daf3b78ccee |
Singapore CPIB Corruption Reporting Form submission receipt (Response ID 69f824dfe5ef7daf3b78ccee, submitted 2026-05-04) |
Full SHA-256 (long form, this batch)
703f5daadda9460ae3aba92f166408db42e467951d40255fc051240513fb31b6 SEC_Referral_17780-976-067-126-3.pdf
f5421ab031066b9d8187db810d178f6f49ad71e5f2b0829bb490272222e39ac6 SEC_Referral_17780-976-067-126_Evidence_Packet-4.pdf
1003cfc2ecf7f591a98f60c77d95e85b2ec7835c8756c9f7e29b22069ed8ba0f SEC_TCR_ITO_SUPPLEMENT_01-5.pdf
bff7f3b7aa44e1442cad49a959bd04a90ce750f2883e6edd83546363d5525a78 SEC-Ombuds-Matter-Management-System-OMMS-Submission-Matter-ID-Number-20260513-00019687-2026-05-14T11_04_55-07_00-6.eml
4a64bdb4167996bc61934f545d901a7e6261df9624e4bda93aa6e3908703dda3 SEC-Ombuds-Matter-Management-System-OMMS-Submission-Update-to-case-7.pdf
207fa35b8c57f8d4262442a0b497f9a2509170ce67c070c314d06e706c9b7e77 Re_-Bank-of-China-UK-Limited-and-Standard-Chartered-ref_-00Db00K8yP.-500Sk019RuGn_ref-2026-05-11T08_09_57-07_00.eml
b0f4d9eed94bdc6d5c351296cc1949ca7d7106e0e8cffa5b97db54727608b137 RefNo-69f824dfe5ef7daf3b78ccee-3.pdf
DKIM authentication (new external anchor)
| File | Domain | Selector | Result |
|---|---|---|---|
| #13 SEC Ombuds reply | sec.gov |
secomms |
dkim=pass (2048-bit key) — first U.S. federal-agency DKIM-signed receipt in the system |
Track A standing disclaimer (must accompany all #10–#16 references)
“Filing and agency acknowledgement does not constitute adjudication of the underlying claims.”
The SEC Ombuds reply explicitly states: “Our Office is generally unable to comment on SEC action or inaction with respect to a tip or complaint.” Receipt ≠ validation. Receipt ≠ investigation.
Reconciled case-folder count
- Existing CPIB folder
TRACK-A-CPIB-69f824dfe5ef7daf3b78ccee— now has its source receipt PDF - Existing SEC-TCR folder
TRACK-A-SEC-TCR-17780-976-067-126— now has 5 supporting files including a DKIM-signed agency reply - New folder
TRACK-A-FCA-BoC-StanChart— created this batch; needs README
Drop batch — 2026-05-18 (supplementary, 2 files)
Two additional files dropped after the main batch. Both byte-identical duplicates of files already cataloged — different filenames, same SHA-256. Kept in the ledger for chain-of-custody completeness; not re-staged into case folders.
| # | Source filename | SHA-256 (12) | Size | MIME | Duplicate-of |
|---|---|---|---|---|---|
| 17 | SEC_TCR__2026-05-06__submission_confirmation_17780-976-067-126-2.pdf |
703f5daadda9 |
139,629 B | application/pdf | DUPLICATE of #10 (SEC_Referral_17780-976-067-126-3.pdf) — cleaner filename; same TCR confirmation |
| 18 | SEC-TCR-ITO__2026-05-06__bates_evidence_packet.pdf |
f5421ab03106 |
17,930 B | application/pdf | DUPLICATE of #11 (SEC_Referral_17780-976-067-126_Evidence_Packet-4.pdf) — cleaner filename; same Bates evidence packet |
Implication for downstream consumers: the canonical filenames inside evidence/TRACK-A-SEC-TCR-17780-976-067-126/evidence/ remain the originals from batch #10–#11. Anyone who receives a copy under the cleaner names #17 / #18 can verify byte-equivalence by SHA-256 — the cryptographic anchor doesn't care about filename, only content.
Drop batch — 2026-05-18 (big package, 11 files spanning 5 cases)
Mixed Track A + Track B batch covering Slovakia, Lithuania, Japan, Taiwan, and NASA JPL. Two new federal-agency DKIM anchors acquired in this batch.
| # | Source filename | SHA-256 (12) | Size | MIME | Track | Case folder |
|---|---|---|---|---|---|---|
| 19 | 260428070422263-Potvrdenka-po-uplnom-overeni-2026-04-28T05_44_31-00_00-2.eml |
84c410150fa8 |
111,023 B | message/rfc822 | A | TRACK-A-SK-260428070422263 |
| 20 | DEL_PATEIKTOS_INFORMACIJOS.pdf |
603409f4b01b |
140,917 B | application/pdf | A | TRACK-A-LT-CASE-01-1-03450-26 |
| 21 | RefNo-69f824dfe5ef7daf3b78ccee-3.pdf |
b0f4d9eed94b |
102,555 B | application/pdf | A | (CPIB) DUPLICATE of #16 — already cataloged in batch 2 |
| 22 | NASA-Certificate-Misconfig-4.pdf |
c8492464bed9 |
299,321 B | application/pdf | B | TRACK-B-NASA-JPL-TLS |
| 23 | TLS-Certificate-Chain-Misconfiguration-...-1-5.eml |
c3ededb6e861 |
349,164 B | message/rfc822 | B | TRACK-B-NASA-JPL-TLS |
| 24 | m3umMaucNG6guqJ8_...-6.pdf |
5089465bca4b |
75,998 B | application/pdf | A | TRACK-A-Japan-ISA-ICRRA70-1 |
| 25 | TLS-Certificate-Chain-Misconfiguration-...-1-7.eml |
c3ededb6e861 |
349,164 B | message/rfc822 | B | DUPLICATE of #23 (byte-identical, different filename suffix) |
| 26 | TaiwanMobile-NCC_response-8.pdf |
1f2d5c0fbf20 |
1,193,986 B | application/pdf | A | TRACK-A-TW-NCC-11500091980 |
| 27 | reference-Tong-Chuan-Ji-Chu-Jue-Zi-Di-11500091980Hao-... (untyped) |
8d34af379a5e |
37,325 B | message/rfc822 | A | TRACK-A-TW-NCC-11500091980 |
| 28 | NCC-Taiwan-initial-kick-off-10.pdf |
0f0f87bd3ac1 |
162,833 B | application/pdf | A | TRACK-A-TW-NCC-11500091980 |
| 29 | NCC-1156500716-2026-03-25T00_35_03-07_00-11.eml |
d8509c9b80a4 |
311,715 B | message/rfc822 | A | TRACK-A-TW-NCC-11500091980 |
DKIM authentication (new external anchors)
| File | Domain | Selector | Result |
|---|---|---|---|
| #19 SK General Prosecutor confirmation | genpro.gov.sk |
genprogovsk |
dkim=pass (2048-bit key) — second federal-agency DKIM anchor; first non-U.S. agency anchor |
| #29 NCC Taiwan initial kick-off | ncc.gov.tw |
google |
dkim=pass (2048-bit key) — third federal-agency DKIM anchor; first APAC anchor |
The Lithuanian prosecutor letter (#20) is a signed PDF document; verification posture is via document signature + the named issuing prosecutor (Aurelijus Navickas, Panežíys Regional Prosecutor's Office, Organised Crime and Corruption Investigation Division) rather than DKIM. The Japan ISA outbound (#24) and NASA outbound (#23) are sender-side artifacts — their DKIM-signed inbound responses, when they arrive, become Tier 1 anchors.
Track classification rationale
- #19, #20, #24, #26, #27, #28, #29 = Track A (regulatory / whistleblower coordination)
- #22, #23 = Track B (cybersecurity — NASA JPL TLS misconfiguration disclosure)
- #21 = duplicate of CPIB receipt previously cataloged
- #25 = duplicate of #23 (identical .eml under different filename)
Domain separation is preserved: no single artifact in this batch mixes Track A and Track B subject matter.
Case-specific notes
TRACK-A-SK-260428070422263: Slovak General Prosecutor's Office (Generálna prokuratúra Slovenskej republiky) confirmation of full verification, dated 2026-04-28 07:44:31 +0200. SPF-pass ongenpro.gov.sk, DMARC-pass.TRACK-A-LT-CASE-01-1-03450-26: Letter from Panežíys Regional Prosecutor's Office stating the submitter's information "has been attached to the criminal case materials and forwarded for evaluation to the pre-trial investigation authority conducting the pre-trial investigation." Dated 2026-04-30; signed by Prosecutor Aurelijus Navickas. This is prosecutor-level routing, materially stronger than mere intake acknowledgement.TRACK-B-NASA-JPL-TLS: TLS certificate chain misconfiguration onwebhosting-external.jpl.nasa.gov(Entrust intermediate → SSL.com root chain mismatch). Reported tosoc@nasa.gov2025-04-22. Outbound only at this stage.TRACK-A-Japan-ISA-ICRRA70-1: Outbound whistleblower referral to Japan Ministry of Justice (koueki-tuuhou@moj.go.jp/info-tokyo@i.moj.go.jp) alleging Immigration Control and Refugee Recognition Act Article 70-1 violations re: Epstein / Joi Ito / Loftwork visa-acquisition channel.TRACK-A-TW-NCC-11500091980: Taiwan NCC referral通傳基礎決字第11500091980號(Tong Chuan Ji Chu Jue Zi Di No. 11500091980 / NCC-1156500716) re: OHTTP relay abuse / surveillance exfiltration via Apple's privacy infrastructure (osb.twmsolution.com,osbstage.twmsolution.comregistered as ObliviousHop proxy agents). NCC's initial DKIM-signed kick-off (#29) + maintainer's reply restoring NCC on the thread (#27) + Taiwan Mobile rebuttal as PDF (#26) + kick-off rendered as PDF (#28).
Track A standing disclaimer (must accompany all #19, #20, #24, #26–29 references)
“Filing and agency acknowledgement does not constitute adjudication of the underlying claims.”
The Lithuanian letter (#20) is a marginal case: "attached to the criminal case materials" is stronger than pure receipt language, but still does not constitute adjudication. The wording in published artifacts should track the letter's actual language, not paraphrase it upward.
Drop batch — 2026-05-18 (batch 4, messy dump, 12 files non-Microsoft)
User instruction (verbatim): "anither dump messy dump . focus on all of the fiel dexcept for th elast 3 microdift ones..we can tak ethat ncie and slow."
Deferred (NOT processed this batch — awaiting user guidance):
MSRC_Case_112639_Update_1-13.zip(295,304 B)bin-14.zip(85,268 B)m365-mime-type-confusion-main-15.zip(3,549 B)
Processed (12 files → 9 unique-content):
| # | Source filename | SHA-256 (12) | Size | MIME | Track | Case folder | Notes |
|---|---|---|---|---|---|---|---|
| 30 | Thank-you-your-query-has-been-received.eml |
b9f0e77b7d76 |
— | message/rfc822 | A | TRACK-A-FCA-BoC-StanChart |
FCA inbound acknowledgement — DKIM-pass on fca.org.uk (2048-bit, selector intactfcaorguk2). First UK fed-agency DKIM anchor in the system. Exposes Salesforce-internal X-Sfdc-Lk: 00Db0000000K8yP + X-Sfdc-Entityid: 500Sk000019RuGn — confirms 00Db.../500Sk... is FCA Salesforce Org-Link + Entity-ID, not an OLAF case number. |
| 31 | Confirmation-of-complaint-submission-2026-05-04.eml |
4fce01dec56c |
— | message/rfc822 | A | TRACK-A-CPIB-69f824dfe5ef7daf3b78ccee |
CPIB inbound acknowledgement — double DKIM-pass: form.gov.sg selector y7posmki4a5gkzqgrtnwseuajsr5wg4m (2048-bit) + amazonses.com selector pd64dbxfdcqqbvadj6zks7h7qe3c33ao (1024-bit). First Singapore-Gov DKIM anchor; pairs with PDF receipt (#16) already on file. |
| 32 | OLAF-Disclosure-Mandelson-Carbyne-2026-04-27-5.eml |
9b6f482e1186 |
— | message/rfc822 | A | TRACK-A-OLAF-Mandelson-Carbyne |
NEW Track-A case folder. Outbound reply quoting OLAF inbound. PGP issue: ships secondary 6DCB key, NOT canonical 4A04. |
| 33 | Referral_-Unregistered-nuclear-policy-brokering-...-4.eml |
907c771089b0 |
— | message/rfc822 | A | TRACK-A-DOE-NE-2026-05-02 |
NEW Track-A case folder. Single outbound to 3 mailboxes: NECommunications@Nuclear.Energy.gov, CFIUS.tips@treasury.gov, FINCEN.Tips@fincen.gov. DOMAIN-SEPARATION RULE per user: "these 3 things do not mix" — if no inbound from any one of the three is captured, do NOT mix CFIUS / DOE-NE / FinCEN as a unified anchor; each agency stands alone. No inbound from any of the 3 captured yet. |
| 34 | NCC-formal-letter-Fa-Wen-11500091980-2026-03-24.pdf (orig: Fa-Wen-11.pdf) |
4530081b986c |
— | application/pdf | A | TRACK-A-TW-NCC-11500091980 |
Official NCC formal letter (函) dated ROC 115/3/24 = 2026-03-24, filing ref 通傳基礎決字第11500091980號, contact 周金賢 jschou@ncc.gov.tw, +886-2-3343-8347. Document-level corroboration of the email kick-off (#29). |
| 35 | SK-GenPro-potvrdenka-po-overeni-260428070422263.pdf (orig: 865bd539-...-9.pdf) |
2d1d18f3450a |
— | application/pdf | A | TRACK-A-SK-260428070422263 |
SK General Prosecutor potvrdenka PDF enumerating 14 submitted docs with per-file SHA-256 hashes — paired with DKIM-signed inbound .eml (#19). |
| 36 | DOE-417-5941450-1585693-2025-12-25.pdf (orig: DOE417...-8.pdf) |
d203750ddb65 |
— | application/pdf | B | TRACK-B-DOE-417 |
NEW Track-B case folder, Layer-2 filer-claim only. DOE-417 emergency-alert filing 2025-12-25 16:50:15 UTC, Submission ID 5941450-1585693. Per user: "yes this is me i filed." Per user (org name): "Intergalactic Auditing Systems" is a working name / pseudonym, NOT a registered legal entity. Narrative claims (Broadcom BCM4388 silicon backdoor Poppy_CLPC_OS, 113GB+ exfiltration, coordinated disclosure w/ Cisco/Google/Samsung) are filer-claims only — no CVE, no vendor advisory, no third-party reproduction. |
Duplicates (cataloged, not staged):
| # | Source filename | SHA-256 (12) | Duplicate-of |
|---|---|---|---|
| 37 | Re_-Bank-of-China-...-2026-05-11T15_09_58.eml |
4b345d5a8b4f |
DUP-content of #15 (same wire message, different Proton re-export bytes). |
| 38 | RE_-Tip-submission-Mandelson...-3.eml |
ccfacc3e2bda |
DUP-content of #32 (same Message-Id, same body; different Proton serialization bytes). |
| 39 | Re_-Bank-of-China-...-2026-05-11T08_09_57-7.eml |
207fa35b8c57 |
EXACT-BYTE DUP of #15. |
| 40 | 3ac9bfd1-...-10.pdf |
603409f4b01b |
EXACT-BYTE DUP of #20 (LT Panevėžys prosecutor letter). |
| 41 | a49b1637-...-12.pdf |
d203750ddb65 |
EXACT-BYTE DUP of #36 (DOE-417). |
Full SHA-256 (long form, this batch — 9 unique-content files only)
b9f0e77b7d76… Thank-you-your-query-has-been-received.eml (FCA inbound)
4fce01dec56c… Confirmation-of-complaint-submission-2026-05-04.eml (CPIB inbound)
9b6f482e1186… OLAF-Disclosure-Mandelson-Carbyne-2026-04-27.eml (OLAF outbound w/ inbound quote)
907c771089b0… Referral_-Unregistered-nuclear-policy-brokering-2026-05-02.eml (DOE-NE/CFIUS/FinCEN outbound)
4530081b986c… NCC-formal-letter-Fa-Wen-11500091980-2026-03-24.pdf (NCC 函 letter)
2d1d18f3450a… SK-GenPro-potvrdenka-po-overeni-260428070422263.pdf (SK GenPro potvrdenka)
d203750ddb65… DOE-417-5941450-1585693-2025-12-25.pdf (DOE-417 filing)
(Full 64-char hashes recorded in each case-folder README and in ANCHOR-COMMANDS-2026-05-18-batch4.sh.)
New DKIM anchors this batch (Tier 1)
| Domain | Selector | Bits | First use | Source file |
|---|---|---|---|---|
fca.org.uk |
intactfcaorguk2 |
2048 | First UK fed-agency anchor | #30 |
form.gov.sg |
y7posmki4a5gkzqgrtnwseuajsr5wg4m |
2048 | First Singapore-Gov anchor | #31 |
amazonses.com (CPIB SES leg) |
pd64dbxfdcqqbvadj6zks7h7qe3c33ao |
1024 | (second SES anchor in system) | #31 |
Cumulative Tier-1 DKIM anchors in system: 8 (cert.org, amazonses.com ×2 selectors, yahoo.com, sec.gov, genpro.gov.sk, ncc.gov.tw, fca.org.uk, form.gov.sg).
Case-folder impact summary
- DELETED:
TRACK-A-OLAF-Ref-00Db00K8yP(mislabeled — turned out to be FCA Salesforce identifiers, not OLAF reference). - NEW:
TRACK-A-OLAF-Mandelson-Carbyne(replaces deleted folder),TRACK-A-DOE-NE-2026-05-02,TRACK-B-DOE-417. - UPDATED:
TRACK-A-FCA-BoC-StanChart(now has Tier-1 DKIM anchor),TRACK-A-CPIB-69f824dfe5ef7daf3b78ccee(now has Tier-1 double DKIM anchor),TRACK-A-SK-260428070422263(potvrdenka PDF),TRACK-A-TW-NCC-11500091980(Fa-Wen 函 letter).
Track A standing disclaimer (must accompany all #30–36 references)
“Filing and agency acknowledgement does not constitute adjudication of the underlying claims.”
The DOE-417 (#36) carries an additional Track-B-specific disclaimer in its README: filer-claims (silicon backdoor, exfiltration volumes, coordinated-disclosure assertions) are stated by the filer only; no CVE, no vendor advisory, no third-party reproduction is on file.
Last updated: drop batch 2026-05-18 (batch 4, messy dump, non-Microsoft portion) cataloged; total cataloged files = 41 across five batches; unique-content files = 33; deferred Microsoft files = 3.
Batch 5 + Batch 6 — 2026-05-18 (combined messy-dump non-Microsoft portion)
Batch 5: 12 files dropped first. Batch 6: 2 inbound counterparts (Paris Parquet inbound, Ossoff Senate inbound) dropped after ask_user_question clarified naming.
User instruction precedent reaffirmed: multi-recipient cc'd outbounds do NOT create separate case folders for non-responders. Senegal/OFNAC was cc'd on the DOJ FARA outbound but has not responded — per user "only whose resopnded ot of those if non then drop it al" — no separate OFNAC folder until/unless they respond.
Significant finding: 7 new Tier-1 DKIM-signature domains acquired in this combined batch, including the first EU-institutional anchor (ec.europa.eu), first US-DOJ executive-branch anchor (usdoj.gov), double-DKIM on DOE (doe.gov + hq.doe.gov), and first US-Senate anchor (senate.gov).
| # | Staged filename | SHA-256 (12) | Sig | MIME | Track | Case folder | Notes |
|---|---|---|---|---|---|---|---|
| 42 | SK-GenPro-potvrdenka-PP-o-prijati-260428070422263.pdf (orig: Potvrdenka_PP.pdf) |
48d513f2c7e5 |
PAdES | application/pdf | A | TRACK-A-SK-260428070422263 |
PP = Potvrdenka o prijatí (initial receipt) — distinct from #35 OP (verified). Slovak GP two-stage receipt pattern now documented in case README. |
| 43 | AGO-FRAUD-REPORT.pdf (orig: AGO-FRAUD-REPORT-PDF-3.pdf) |
a797257a9fbd |
— | application/pdf | A | TRACK-A-MA-AGO-MIT-MediaLab |
Filer-prepared complaint package companion to MA AGO OnBase acknowledgement (#45). |
| 44 | OLAF-Mandelson-Carbyne-inbound-2026-05-04.eml (orig: ..-4.eml) |
42f922168afc |
DKIM ec.europa.eu s=s2601 2048-bit |
message/rfc822 | A | TRACK-A-OLAF-Mandelson-Carbyne |
First EU-institutional DKIM anchor in the system. OLAF FNS acknowledgement from OLAF-FM-A1@ec.europa.eu. Upgrades OLAF case Provisional → Strong. |
| 45 | MA-AGO-NPC-acknowledgement-2026-05-05.eml (orig: ..-7.eml) |
52975f8bc6a4 |
DKIM onbaseonline.com s=2k20x 2048-bit |
message/rfc822 | A | TRACK-A-MA-AGO-MIT-MediaLab |
MA AGO OnBase intake acknowledgement. Body: "forwarded to the appropriate staff member… Non-Profits and Public Charities Division." Upgrades MA AGO Stub → Strong. |
| 46 | DOJ-FARA-KarimWade-MackySall-reply-2026-05-05.eml (orig: ..-5.eml) |
83ef754869d9 |
DKIM usdoj.gov s=doj 2048-bit |
message/rfc822 | A | TRACK-A-DOJ-FARA-Public |
First US-DOJ executive-branch DKIM anchor. DOJ FARA reply re: Karim Wade / Macky Sall public-registration matter. Upgrades DOJ-FARA Stub → Strong. |
| 47 | DOE-EOC-NA40-acknowledgement-2025-12-25.eml (orig: ..-6.eml) |
5a8ff29de877 |
DKIM doe.gov s=q2-2024-pp + DKIM hq.doe.gov s=selector1 (both 2048-bit) |
message/rfc822 | B | TRACK-B-DOE-417 |
Double-DKIM acknowledgement from DOE Emergency Operations Center (NA-40 / Team 3). Body: "Watch Office acknowledges your message, thank you very much." Upgrades DOE-417 receipt-anchor Layer-2 → Strong (filer-claim disclaimer on technical narrative preserved). |
| 48 | FR-Paris-Parquet-Financier-outbound-2026-05-18.eml (orig: ..-9.eml) |
04ee45db2481 |
PGP-signed (canonical 4A04 key — rare; most user outbounds use secondary 6DCB) |
message/rfc822 | A | TRACK-A-FR-TJ-Paris-Parquet-Financier |
NEW Track-A case folder. User outbound to French Parquet National Financier (PNF) at justice.fr. Per user, naming: TRACK-A-FR-TJ-Paris-Parquet-Financier. |
| 49 | FR-Paris-Parquet-Financier-inbound-2026-05-18.eml (batch 6) |
1e143b730f43 |
DKIM justice.fr s=pfai20240130 2048-bit |
message/rfc822 | A | TRACK-A-FR-TJ-Paris-Parquet-Financier |
First French Ministry-of-Justice DKIM anchor. PNF substantive reply requesting source document (NOT boilerplate). Tier-1 Strong. |
| 50 | Ossoff-Senate-staff-DOJ-redactions-outbound-2026-04-29.eml (orig: ..-10.eml) |
b671a0d11fac |
PGP-signed (secondary 6DCB) |
message/rfc822 | A | TRACK-A-Ossoff-Senate-DOJ-Redactions |
NEW Track-A case folder. User outbound to Sen. Ossoff (GA) office re: DOJ redactions. Per user, create stub. |
| 51 | Ossoff-Senate-DavidJones-inbound-2026-04-29.eml (batch 6) |
02f311c6907c |
DKIM senate.gov s=senate-pp2408 2048-bit |
message/rfc822 | A | TRACK-A-Ossoff-Senate-DOJ-Redactions |
First US-Senate DKIM anchor. Senate-staff reply from David Jones (named Senior Constituent Services Representative). Substantively stronger than boilerplate per user: includes in-person meeting attestation + explicit forward to DC office. Tier-1 Strong. |
| 52 | LT-PAIS-transmittal-inbound-2026-04-30.eml (orig: ..-11.eml) |
a46f5a154eec |
SPF-pass prokuraturos.lt (dkim=none); PAdES on PDF attachment |
message/rfc822 | A | TRACK-A-LT-CASE-01-1-03450-26 |
Tier 1.5 — agency-domain SPF + signed-PDF transmittal carrying #20 (already on file). Documents the prosecutor.lt mail-infrastructure leg. |
Duplicates (cataloged, not staged):
| # | Source filename | SHA-256 (12) | Duplicate-of |
|---|---|---|---|
| 53 | Potvrdenka_OP-2.pdf |
2d1d18f3450a |
EXACT-BYTE DUP of #35 (SK GenPro OP PDF). |
| 54 | Re_-Bank-of-China-...-8.eml |
dd3f6eae1382 |
DUP-content of #15 (same Message-Id, off-by-1s Date — Proton re-export). |
| 55 | OLAF outbound -12.eml |
108bba858fab |
DUP-content of staged 9b6f482e (same Message-Id, byte-different Proton re-export of the OLAF reply already in TRACK-A-OLAF-Mandelson-Carbyne). |
Full SHA-256 (long form, batch 5+6 — 11 unique-content files only)
48d513f2c7e553094ac07fd1bca47225bb2f540f6084cb20d4fb3a741ce3ee79 SK-GenPro-potvrdenka-PP-o-prijati-260428070422263.pdf
a797257a9fbd19efec4bda2fb023597eafabea143a4d9e9ebe8996f1b302cf62 AGO-FRAUD-REPORT.pdf
42f922168afc25fd0ab6813f3782f16c8f1da82365615b3fe8272964016371f7 OLAF-Mandelson-Carbyne-inbound-2026-05-04.eml
52975f8bc6a4ede13004a6266485a2c0bc2d31f6799f39904047b3c3e65ed652 MA-AGO-NPC-acknowledgement-2026-05-05.eml
83ef754869d953dc808130334e07719ec1210fe28eed8e6479482a0cebbdd925 DOJ-FARA-KarimWade-MackySall-reply-2026-05-05.eml
5a8ff29de877c304cf126c254a6d8d71c3f86cee16f274ae656dc2dedf82c649 DOE-EOC-NA40-acknowledgement-2025-12-25.eml
04ee45db2481dab927590339ddf6f953aea5de1fc9f2682d3bcff33324890011 FR-Paris-Parquet-Financier-outbound-2026-05-18.eml
1e143b730f43b7f8ba306abdb7b4512a175de55a809eb4ec05be06da13a14022 FR-Paris-Parquet-Financier-inbound-2026-05-18.eml
b671a0d11facc2dc1f3ff68acd5597e87b3b2ac4a5c7392fe6349a8b8ba668a6 Ossoff-Senate-staff-DOJ-redactions-outbound-2026-04-29.eml
02f311c6907c1b38b3e29c90ca3a2d4f975dabad5b7b3aa381a9dfbad029d52b Ossoff-Senate-DavidJones-inbound-2026-04-29.eml
a46f5a154eecd8f0120e37ca8bc5a854cd0bddafea6a42196093dad0b05e24c3 LT-PAIS-transmittal-inbound-2026-04-30.eml
New Tier-1 DKIM-signature domains this batch (7)
| Domain | Selector | Bits | First use | Source file |
|---|---|---|---|---|
ec.europa.eu |
s2601 |
2048 | First EU-institutional anchor | #44 (OLAF) |
usdoj.gov |
doj |
2048 | First US-DOJ executive-branch anchor | #46 (DOJ FARA) |
doe.gov |
q2-2024-pp |
2048 | DOE (jointly with hq.doe.gov) |
#47 (DOE EOC) |
hq.doe.gov |
selector1 |
2048 | DOE (jointly with doe.gov) |
#47 (DOE EOC) |
onbaseonline.com |
2k20x |
2048 | First state-AG enterprise-intake anchor (MA AGO via Hyland OnBase) | #45 (MA AGO) |
justice.fr |
pfai20240130 |
2048 | First French Ministry-of-Justice anchor | #49 (Paris PNF) |
senate.gov |
senate-pp2408 |
2048 | First US-Senate anchor | #51 (Ossoff) |
Cumulative Tier-1 DKIM-signature domains in system: 15 (prior 8 + these 7).
Case-folder impact summary (batch 5+6)
- NEW:
TRACK-A-FR-TJ-Paris-Parquet-Financier(Strong, Tier-1),TRACK-A-Ossoff-Senate-DOJ-Redactions(Strong, Tier-1). - UPGRADED Provisional/Stub → Strong:
TRACK-A-OLAF-Mandelson-Carbyne(now has standalone EU-anchored inbound),TRACK-A-DOJ-FARA-Public(was stub),TRACK-A-MA-AGO-MIT-MediaLab(was stub). - UPGRADED on receipt-anchor only (narrative remains filer-claim):
TRACK-B-DOE-417. - UPDATED with additional anchored artifact:
TRACK-A-LT-CASE-01-1-03450-26(added prokuraturos.lt SPF-pass transmittal),TRACK-A-SK-260428070422263(added PP initial-receipt PDF; case now carries both PP and OP).
Track A standing disclaimer (must accompany all #42–55 references)
"Filing and agency acknowledgement does not constitute adjudication of the underlying claims."
The DOE-417 (#36, #47) carries the additional Track-B-specific filer-claim disclaimer documented in its case README.
OFNAC / Senegal disposition (per user instruction this turn)
The DOJ FARA outbound was cc'd to OFNAC (Senegal Office National de Lutte contre la Fraude et la Corruption). OFNAC has not responded as of this batch. Per user: "only whose resopnded ot of those if non then drop it al" — no separate OFNAC case folder is created. If OFNAC responds in a later batch, create the folder then.
Batch 7 — 2026-05-18 (MSRC + Colombia)
Context (verbatim from user, typos preserved): "gret ano wlets mov eto th e micirodift/msrc files yoi can see ii already have a github repo made on the vuln too that son my github account .. i furst reprited the vuln and incidednt to vanderbilt , then esclated to mucrosift .. it wqs the same repirt /fidning and te hcolombia pdf was hand delviered today may 18"
This batch processes the three Microsoft files deferred from batch 4, plus a same-day Vanderbilt VUIT incident-comment .eml (the precursor anchor that establishes the VU → Microsoft escalation path) and a same-day hand-delivered Colombia consulate referral PDF.
User decisions taken this batch:
- VUIT structure: consolidate into a single folder
TRACK-B-MSRC-112639. No separateTRACK-B-VUITfolder. The VUIT.emlis treated as the precursor anchor inside the MSRC case. - Colombia timing: stage now as Provisional under new folder
TRACK-A-Colombia-Consulate-Atlanta. Upgrade if/when an agency reply lands.
Files cataloged this batch (5 unique-content files)
| # | File (as dropped) | SHA-256 (short) | Size | Staged path | Track | Tier |
|---|---|---|---|---|---|---|
| 56 | VUIT-Incident-Comment-Added-Suspicious-email-Signature-2026-04-01T07_27_37-07_00-1.eml |
a2bae199e6d7… |
15,689 B | TRACK-B-MSRC-112639/evidence/VUIT-ticket-86705-comment-added-2026-04-01.eml |
B | Tier 1 (DKIM vanderbilt.edu selector1 2048-bit + ARC arcselector10001 from d=microsoft.com) |
| 57 | MSRC_Case_112639_Update_1-13.zip |
274b18c9d385… |
295,304 B | TRACK-B-MSRC-112639/evidence/MSRC_Case_112639_Update_1.zip (+ unpacked tree) |
B | Tier 2 (vendor-issued case-ID 112639); inner source_message.eml carries vanderbilt.edu DKIM |
| 58 | bin-14.zip |
73ac7c7ae4f6… |
85,268 B | TRACK-B-MSRC-112639/evidence/attachment-bin-payload-decoded.zip |
B | Tier 0 (filer-prepared cross-check; byte-identical to MSRC inner attachment_as_delivered.bin SHA a36cd36e…) |
| 59 | m365-mime-type-confusion-main-15.zip |
b261ca5e825b… |
3,549 B | TRACK-B-MSRC-112639/evidence/github-snapshot/m365-mime-type-confusion-main-2026-04-13.zip |
B | Tier 1.5 (public GitHub repo JGoyd/m365-mime-type-confusion — third-party-verifiable; head c4bca665…, stego-withdrawal commit a75ce46a…) |
| 60 | COLOMBIA-CONSULATE_EPSTEIN_REFERRAL_ENGLISH-2.pdf |
a07d5b3fa8cb… |
79,957 B | TRACK-A-Colombia-Consulate-Atlanta/evidence/COLOMBIA-EPSTEIN-01-referral-packet-2026-05-14.pdf |
A | Tier 0 (filer-prepared hand-delivered referral; no agency receipt yet → Provisional) |
Full SHA-256 (long form, batch 7)
a2bae199e6d76e54fc59b4de842d45ef0577ea25a741b6a2eab9b861cf8312f8 VUIT-ticket-86705-comment-added-2026-04-01.eml
274b18c9d3851f41df33eb32691f4e8e0b46c5b68d7ac2a13d2cdcdd6c7c7722 MSRC_Case_112639_Update_1.zip
73ac7c7ae4f612e89ad377678ba0a53aa0064d4d62b34385910b4b63dc5ad329 attachment-bin-payload-decoded.zip
b261ca5e825b9aabd6561c647290d159c187d8e75256baa629de73428ecb8433 m365-mime-type-confusion-main-2026-04-13.zip
a07d5b3fa8cba93722fb14246038a637d36b919b80d203665c361da6ffd5fe43 COLOMBIA-EPSTEIN-01-referral-packet-2026-05-14.pdf
MSRC inner-manifest hashes (verbatim from MSRC_Case_112639_Update_1/MANIFEST.md)
4324c6d6006ca6b63de4fc0c53f2e86c8bbeb97102527691647d5efc7bb75b88 evidence/source_message.eml (158,760 B)
a36cd36e56057922fb2c1d80ec7a51661602d9b9eb7afefb4dfa6853acae149f evidence/attachment_as_delivered.bin (89,872 B)
a36cd36e56057922fb2c1d80ec7a51661602d9b9eb7afefb4dfa6853acae149f evidence/attachment_actual_type.png (89,872 B, byte-identical to .bin)
5120d405adb79db020c78b7146d8d0f3c789375434a0fd6dfd205eb465690e4a evidence/headers.txt (11,246 B)
New Tier-1 DKIM-signature domain this batch (1)
| Domain | Selector | Bits | Significance | First batch citation |
|---|---|---|---|---|
vanderbilt.edu |
selector1 |
2048 | First US higher-education institutional anchor (Vanderbilt University IT, VUIT TeamDynamix) | #56 (VUIT comment-added) |
Cumulative Tier-1 DKIM-signature domains in system: 16 (prior 15 + this one).
Case-folder impact summary (batch 7)
- NEW:
TRACK-A-Colombia-Consulate-Atlanta(Provisional — hand-delivered 2026-05-18, no agency receipt yet). - UPGRADED Stub → Strong:
TRACK-B-MSRC-112639— now anchored on Tier-1 DKIM (vanderbilt.edu) via VUIT precursor and Tier-2 vendor case-ID (MSRC 112639), with a Tier-1.5 third-party-verifiable GitHub repo snapshot. Still no standalone MSRC-side.eml(open follow-up to capturesecure@microsoft.comcorrespondence).
Deferred-set reconciliation
The three Microsoft files deferred from batch 4 ("focus on all of the file except for the last 3 microsoft ones..we can take that nice and slow") are fully processed by this batch. Deferred items now = 0.
Track A standing disclaimer (must accompany #60 reference)
"Filing and agency acknowledgement does not constitute adjudication of the underlying claims."
For the Colombia packet specifically: the filer has explicitly stated "I am not alleging crimes" on the face of the document; this folder is referral-only and any references to it must preserve that posture.
Safety-hygiene posture (batch 7, Track B)
The MSRC case ships no exploit code, no payloads, and no weaponized technical detail. The public GitHub repo and the local folder both follow the no-payload rule. A prior steganographic claim was withdrawn on 2026-04-13 after byte-level analysis showed the extraction methodology was not reproducible from the delivered file; the withdrawal is locked into git history (commit a75ce46a9a6d4deabf2235500f75d95ec313dcf6) and is preserved as a discipline marker, not edited out.
Batch 8 — 2026-05-18 (Navy USN-IT + IRS-211 + dup reconciliation)
Context (verbatim from user, typos preserved): "the context of this dislisr eis hige.. i know its just outboun dbt i mean its sent to the righ tppl we should track it . both of these really . and the third.. that was submitted to the irs under form 211. no cofnrimation excpet ofr the onscreen after submisison but its submitted and tah temail from doe on christams day is cool too . its th enuclear team as well."
Four inbound files this batch. Two are genuinely new artifacts, one is a re-export collision of an already-staged outbound, and one is a byte-identical duplicate of an already-staged inbound.
Files cataloged this batch
| # | File (as dropped) | SHA-256 (short) | Size | Disposition |
|---|---|---|---|---|
| 61 | Air-Center-Helicopters-_-Rod-Tinney-cleared-MSC-contractor-adjacent-cleared-personnel-intel-available-2026-04-27T09_04_06-07_00-2.eml |
9dc71fe67529… |
17,576 B | NEW — staged to TRACK-A-USN-InsiderThreat-AirCenter-Tinney/evidence/USN-InsiderThreat-AirCenter-Tinney-Bohlke-outbound-2026-04-27.eml |
| 62 | IRS-211-STC-EDC__2026-05-05__bates_evidence_packet-3.pdf |
653f9d1f3497… |
28,862 B | NEW — staged to TRACK-A-IRS-FORM-211/evidence/IRS-211-STC-EDC-2026-05-05-bates_evidence_packet.pdf |
| 63 | Referral_-Unregistered-nuclear-policy-brokering-...-2026-05-02T14_41_48-07.eml |
d0b8e750b0f7… |
14,267 B | RE-EXPORT COLLISION — identical Message-Id and headers as already-staged TRACK-A-DOE-NE-2026-05-02/evidence/DOE-NE-CFIUS-FINCEN-referral-2026-05-02.eml (SHA 907c77106a8c…); only the MIME multipart boundary string differs (random per Proton export). Same outbound message, different export render. Not re-staged. |
| 64 | RE_-EXTERNAL-Report-ID_-5941450-1585693-2025-12-25T09_13_38-08_00-4.eml |
5a8ff29de877… |
88,811 B | BYTE-IDENTICAL DUP — same SHA as already-staged TRACK-B-DOE-417/evidence/DOE-EOC-NA40-acknowledgement-2025-12-25.eml (the DOE EOC NA-40 Christmas-Day acknowledgement, ledger entry #34). User explicitly noting it ("th eemail from doe on christams day is cool too . its th enuclear team as well"). Not re-staged. |
Full SHA-256 (long form, batch 8 — 2 net-new unique-content files)
9dc71fe67529699157f472f83c09f57c4c1a8c01be80490cc510e2c995ca5362 USN-InsiderThreat-AirCenter-Tinney-Bohlke-outbound-2026-04-27.eml
653f9d1f3497c51c955a82ef1e1b2c36782468a9eb813104fadd8d72d0c6764f IRS-211-STC-EDC-2026-05-05-bates_evidence_packet.pdf
Re-export-collision reconciliation note (#63)
Both copies of the nuclear referral outbound carry the same Proton Message-Id (<0KgGuIVoft1SM3c8edU760IjJdQ6OimCyFi2UwpOicLe1y5z9Jm3ri6g4vvcK65TxR00g45HOblvr11FLRMPuFG7NSSiHH9GILa8gAC60eo=@proton.me>), identical From/To/Date/Subject/all body content, and identical file size (14,267 B). The 189 differing bytes are entirely inside the multipart MIME boundary string (line 7) which Proton regenerates on each export. Both copies represent the same send to NECommunications@Nuclear.Energy.gov + CFIUS.tips@treasury.gov + FINCEN.Tips@fincen.gov on 2026-05-02 21:41:48 UTC. The originally-staged copy under TRACK-A-DOE-NE-2026-05-02 remains the canonical reference. The user's re-emphasis this batch ("the context of this dislisr eis hige... sent to the righ tppl we should track it") is recorded as a re-affirmation of importance without producing a duplicate staging.
DOE-Christmas-acknowledgement re-affirmation (#64)
The DOE EOC NA-40 Watch-Office acknowledgement (Christmas Day 2025-12-25) is the canonical Tier-1 anchor for TRACK-B-DOE-417 (double-DKIM on doe.gov + hq.doe.gov). User re-emphasis this batch ("th eemail from doe on christams day is cool too . its th enuclear team as well") flags additional context: the same DOE EOC routing also touches the DOE Office of Nuclear Energy — which is the same agency family that the multi-agency nuclear referral (#63) was sent to (NECommunications@Nuclear.Energy.gov). Note the strict domain separation rule: TRACK-B-DOE-417 (electric-grid cyber-incident form) and TRACK-A-DOE-NE-2026-05-02 (nuclear-policy referral) remain separate cases; the Christmas inbound anchors only TRACK-B-DOE-417.
Case-folder impact summary (batch 8)
- NEW:
TRACK-A-USN-InsiderThreat-AirCenter-Tinney(Provisional, outbound-only — sent 2026-04-27 toUSN-InsiderThreat@us.navy.mil). - UPGRADED Stub → Provisional with substantive content:
TRACK-A-IRS-FORM-211(was 1.9 KB stub README with PENDING placeholders; now has the actual 13-page Form 211 Bates evidence packet staged and a full 9.7 KB Provisional README). Filer-attested $300M+ USVI EDC tax-exemption magnitude with conservative $75M–$110M recoverable estimate — materially above the $2M IRC § 7623(b) threshold.
Track A standing disclaimer (must accompany #61, #62, #63, #64 references)
"Filing and agency acknowledgement does not constitute adjudication of the underlying claims."
The IRS-211 packet additionally states on its face: "This packet was compiled by an independent investigator. The filer is not a party to litigation involving any subject taxpayer or named individual, has not received compensation, and has not contacted any subject or representative prior to filing."
The Navy USN-IT outbound additionally states on its face: "This submission presents adverse information; it makes no finding of fact. Every evidentiary cite below is verifiable against the public U.S. DOJ Epstein Files (EFTA) release by Bates identifier."
Cross-folder topical cross-reference (informational only, NOT a domain-separation breach)
The Glendower / Southern Financial LLC / GLDUS238 line of evidence appears in TRACK-A-Colombia-Consulate-Atlanta (Lead 1, Colombian-securities-law surface) and in TRACK-A-IRS-FORM-211 (subject-taxpayer surface for USVI EDC pass-through tax). These are two distinct legal-regulatory regimes (Colombian financial regulation vs. US federal tax law) and the case folders remain strictly separated. The cross-reference is preserved in each README's "Cross-references inside the system" section for human-navigation purposes only.
Last updated: drop batch 2026-05-18 (batch 8: Navy USN-IT + IRS-211 + dup reconciliation) cataloged; total cataloged files = 64 across nine batches; unique-content files = 51 (49 prior + 2 net-new this batch); deferred Microsoft files = 0; re-export collisions = 1; byte-identical dups = 1.
Batch 9 — 2026-05-18 (Broadcom BCM4387 BroadScope PSIRT + CISA INC0625285 iOS Security Bypass)
Context (verbatim from user, typos preserved): "and then here is a dislcure i sent to broadcome.. them claiming diamin awareness, not tehncialy discsyting or anything at all.. comelte bs but eithe rway here is the dislcsure infi .. also the repo on guthub is https://github.com/JGoyd/BroadScope its a bgi deal here . i attched te headers to my intial email, the headers to their last reply. and then the disclsire eml thread i fyou can read it or not too amd the otjer 2 are a cisa /TOC case i creatd .. if yo see ho wmay differnt departemtn soare on that threat its wild !"
Five inbound files this batch across two new case folders. All five files have unique SHA-256 hashes — no duplicates, no re-export collisions. Two of the five are full .eml exports (one Broadcom inbound, one CISA inbound); three are header-extract .txt files (Broadcom outbound headers, Broadcom inbound headers, CISA inbound headers). The Broadcom outbound .eml itself was not delivered to the workspace this batch — only its header-extract .txt — so the outbound is preserved as a header-only artifact.
Files cataloged this batch (5 unique-content files)
| # | File (as dropped) | SHA-256 (short) | Size | Disposition |
|---|---|---|---|---|
| 65 | pgp-1-2.txt (Broadcom outbound headers) |
8b51b09039… |
15,826 B | NEW — staged to TRACK-B-Broadcom-BCM4387-BroadScope/evidence/Broadcom-PSIRT-outbound-headers-2026-03-09.txt |
| 66 | Re_-Vulnerability-Disclosure_-BCM4387-Coexistence-SRAM-_-Observed-In-the-Wild-Exploitation-2026-03-10T18_14_07-07_00-3.eml |
7611c85139… |
20,879 B | NEW — staged to TRACK-B-Broadcom-BCM4387-BroadScope/evidence/Broadcom-PSIRT-Edelson-reply-2026-03-10.eml |
| 67 | pgp.txt (Broadcom inbound headers) |
bf70c42521… |
12,170 B | NEW — staged to TRACK-B-Broadcom-BCM4387-BroadScope/evidence/Broadcom-PSIRT-Edelson-reply-headers-2026-03-10.txt |
| 68 | RE_-INC0625285-iOS-Security-Bypass-2026-02-26T10_22_11-08_00-4.eml |
fd4d8b8898… |
50,614 B (staged) | NEW — staged to TRACK-A-CISA-INC0625285-iOS-Bypass/evidence/CISA-INC0625285-Farouq-reply-2026-02-26.eml |
| 69 | pgp-2-5.txt (CISA inbound headers) |
396ad78626… |
17,541 B | NEW — staged to TRACK-A-CISA-INC0625285-iOS-Bypass/evidence/CISA-INC0625285-Farouq-reply-headers-2026-02-26.txt |
Full SHA-256 (long form, batch 9 — 5 net-new unique-content files)
8b51b09039326255b35a44138ff14ba4468339fa5352a031cfad21ebdd12e08c Broadcom-PSIRT-outbound-headers-2026-03-09.txt
7611c851392d2a6a7dc7fe46b8b8828beb2131de22607f1986f3129a758a25cf Broadcom-PSIRT-Edelson-reply-2026-03-10.eml
bf70c42521795b2ceec6a94ddc0b1b62d1adba23486ea268f5fff7b8d3e44d58 Broadcom-PSIRT-Edelson-reply-headers-2026-03-10.txt
fd4d8b8898f99e98d76459320a5ad3fcf232cfa5a47313b5b9876633c48c6f2e CISA-INC0625285-Farouq-reply-2026-02-26.eml
396ad78626c8a399d4dbf7ce717eaf8133a6c417f553c501544dab0724807b5a CISA-INC0625285-Farouq-reply-headers-2026-02-26.txt
New Tier-1 DKIM-signature domains this batch (2)
| Domain | Selector | Bits | Significance | First batch citation |
|---|---|---|---|---|
broadcom.com |
google |
1024 | First US private-sector hardware-vendor PSIRT cryptographic anchor. Inbound is from a named Broadcom PSIRT engineer (Daniel Edelson) with Ken Williams cc'd; DLP-relay path through *.dlp.protect.broadcom.com (Symantec/Broadcom DLP) confirms enterprise outbound posture. 1024-bit RSA is shorter than the 2048-bit federal-agency norm but still a valid Tier-1 cryptographic signature. |
#66 (Edelson reply) |
associates.cisa.dhs.gov |
select1 |
2048 | First US DHS/CISA cryptographic anchor in the system. Note the subdomain: associates.*.dhs.gov is the contractor / FFRDC tenancy within the CISA M365 tenant (69c613d2-b051-4234-8ed1-fd530b70d5d3), not the agency proper. Filer Mr. Farouq's address is marked (CTR) in the display name, confirming contractor status. The DKIM signature is the agency tenant's, not the contractor's personal — so the cryptographic anchor still attaches to DHS/CISA infrastructure. DMARC=pass with p=reject policy on the parent dhs.gov zone. |
#68 (Farouq reply) |
Cumulative Tier-1 DKIM-signature domains in system: 18 (prior 16 + these two).
Case-folder impact summary (batch 9)
-
NEW:
TRACK-B-Broadcom-BCM4387-BroadScope(Provisional). PSIRT reply 2026-03-10 18:13:49 -0700 from Daniel Edelson, with Ken Williams (ken.williams@broadcom.com) cc'd andpsirt@broadcom.comcc'd. DKIMbroadcom.comselectorgoogle, 1024-bit. DLP relay through144.49.247.117 (smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com). Reply body is PGP-encrypted to the filer's key and not readable from the build environment — only headers and envelope are preserved. Filer characterizes the vendor stance verbatim: "them claiming diamin [domain] awareness, not tehncialy discsyting [technically discussing] or anything at all.. comelte bs" — preserved here without endorsement; the README records both Broadcom's surface reply (domain-awareness acknowledgement) and the filer's characterization of it (substantive rejection). Public GitHub repoJGoyd/BroadScope(head commitba55b3f3c86b60ed63890a8c0f0f650c926f3baa, treebffbc5e4c458fdcd057db0f2c694c38f5bfabfb5, created 2026-04-03T18:57:56Z, last push 2026-04-07T15:50:18Z, public, 2 stars) provides Tier-1.5 third-party-verifiable corroboration. Outbound Message-Id<IMSuEh9Qz-I_Y-5Exnqa0HSvbpUVePVXsEbJinMyqUbWZR7b804C8iq_MMBC1g0CUcn6t4_JV6soyHvEr5YTjbbEHluAsszfpFtcJIvtj8U=@proton.me>appears verbatim in the inboundReferences:header, locking the threading. -
NEW:
TRACK-A-CISA-INC0625285-iOS-Bypass(Strong on first inbound). CISA ServiceNow ticket INC0625285 "iOS Security Bypass", reply 2026-02-26 18:22:05 UTC from Umar Farouq (contractor,umar.farouq@associates.cisa.dhs.gov). DKIMassociates.cisa.dhs.govselectorselect1, 2048-bit; DMARC=pass (p=reject) on parentdhs.gov; SPF=pass; ARC-sealed bymicrosoft.com(CISA M365 tenant69c613d2-b051-4234-8ed1-fd530b70d5d3). Proofpoint outbound transit throughmx0e-00376703.gpphosted.comIP67.231.155.98. 5 CISA To-line recipients (Central, TOC, SIM, vulnerability, filer) + 2 Cc (OCIO.TOC.FEDs, Troy Delucia). 5-deep Message-Id chain through Exchange Online nodesCO6PR09MB7319 → PH7PR09MB11913 → DS0PR09MB11798. Captured Message-Id<DS0PR09MB1179888FD99E8E58B58591138F172A@DS0PR09MB11798.namprd09.prod.outlook.com>. Body PGP-encrypted to the filer's key (not readable from build env).
Cross-folder topical cross-reference (informational only, NOT a domain-separation breach)
Both new folders touch the iPhone 12–15 BCM4387C2 device family:
- BroadScope (Track B) is the vendor coordinated-disclosure surface (Broadcom is the SoC vendor for the BCM4387 Wi-Fi/BT combo chip used in those iPhones); claim cluster is hardware/coexistence-SRAM and references in-the-wild exploitation observation.
- CISA INC0625285 (Track A) is the US-federal cyber-agency intake surface for an iOS security-bypass report; distinct ServiceNow incident, separate from CERT/CC VINCE VU#395558 (which lives under
TRACK-B-CVE-2025-24085-24201-43300) and from thecisagov/vulnrichmentGitHub issues #194 / #200 / #201 (which live underTRACK-B-CVE-2025-31200-31201and the Glass-Cage cluster).
The two folders share device-family context but cover different vendors, different vulnerability classes, and different evidentiary tracks. They are NOT technically combined: BroadScope is BCM4387 coexistence-SRAM; INC0625285 is iOS security-bypass at the OS/application boundary. Strict Track-A / Track-B domain separation is preserved.
Track A standing disclaimer (must accompany #68, #69 references)
"Filing and agency acknowledgement does not constitute adjudication of the underlying claims."
For the CISA INC0625285 thread specifically: the inbound is from a CISA contractor (Mr. Farouq, (CTR) per display-name convention) writing from an associates.cisa.dhs.gov mailbox within the CISA M365 tenant. The DKIM cryptographic anchor still attaches to DHS/CISA infrastructure; the contractor designation is preserved as a factual posture note, not as a reduction in evidentiary tier.
Safety-hygiene posture (batch 9, Track B)
The BroadScope public repo is explicitly no-payload, no-weaponized-detail per the filer's standing rule. The README in TRACK-B-Broadcom-BCM4387-BroadScope preserves the public-repo SHAs (head commit and tree) so any reader can verify the on-GitHub content matches what is described, but neither the README nor the staged artifacts ship exploit code. The Broadcom inbound .eml is PGP-encrypted body-only — the README transcribes only the envelope/headers and the filer's verbatim characterization of the vendor stance.
Last updated: drop batch 2026-05-18 (batch 9: Broadcom BCM4387 BroadScope PSIRT + CISA INC0625285 iOS Security Bypass) cataloged; total cataloged files = 69 across ten batches; unique-content files = 56 (51 prior + 5 net-new this batch); deferred Microsoft files = 0; re-export collisions = 1; byte-identical dups = 1.
Batch 10 — 2026-05-18 (Apple CVE-2023-41064 patch-bypass disclosure on iOS 26.2.1 + IC3 stub upgrade with iDrive technical bundle)
Context (verbatim from user, typos preserved): "here is anotehr realy really strong one just base don repiriducability really. dotn call it highway roberry or netoin the github .. just focus on th efacts the diclssure etc for thi splease .. but thi sis a sotrng one too esp sicne i have the diffs, tracev3 lgis and scritp setvc too . and last bu tn otleast the idrvie exfil.. i mena its a masterpiece aroun dmy son and my backyard but also a real incident i reported a while ago... i wanan make that on especial and almost an anchor somehow if pissibel by itslef.. or just catalog for now"
Filer-instructed framing constraints recorded for this batch:
- "dotn call it highway roberry or netoin the github" — the iOS 26.2.1 case folder is named
TRACK-B-Apple-CVE-2023-41064-Patch-Bypass-iOS-26-2-1(no mention of "Highway Robbery"). The paired private GitHub repositoryJGoyd/iOS26.3_Highway_Robberyis NOT referenced in the folder's README, the ledger entry, the SYSTEM-STATUS row, or the anchor script. The catalog records only the disclosure facts, the CVE clusters, and the binary artifacts the filer attached to the disclosure thread. - "i wanan make that on especial and almost an anchor somehow if pissibel by itslef" — the iDrive-Exfil bundle is staged inside the existing
TRACK-B-IC3-067b3177c3524c80bce02cca08064d11Stub folder, which is upgraded to Provisional and marked as Anchor-Class candidate on the basis of (a) the server-issued FBI IC3 Submission ID067b3177c3524c80bce02cca08064d11and (b) its public-internet long-lived corroboration in the public repositoryJGoyd/iDrive-Exfil's description field (visible since 2026-01-08T23:17:45Z). The IC3 ID is treated as the canonical anchor regardless of whether an IC3 inbound.emlis ever captured.
Eight inbound files this batch across two case folders — 5 in the Apple folder (NEW) and 3 in the IC3 folder (Stub-to-Provisional upgrade). All eight files have unique SHA-256 hashes.
Files cataloged this batch (8 unique-content files)
| # | File (as dropped) | SHA-256 (short) | Size | Disposition |
|---|---|---|---|---|
| 70 | iOS26.3_Highway_Robbery-main/README.md |
9f8fa4ef9cbc… |
3,158 B | NEW — staged to TRACK-B-Apple-CVE-2023-41064-Patch-Bypass-iOS-26-2-1/evidence/repo-root-README.md (source-bundle root README; filer-published top-level overview) |
| 71 | iOS26.3_Highway_Robbery-main/Reports/BLASTPASS_Bypass_V2.md |
497108299d6c… |
4,710 B | NEW — staged to …/Apple-PSIRT-BLASTPASS-V2-disclosure-2026-02-09.md (filer outbound disclosure markdown, 2026-02-09; cites 905b5cc8… trace hash internally) |
| 72 | iOS26.3_Highway_Robbery-main/Reports/Forensic_Rebuttal_iOS_26_3.md |
08d473e5fe0b… |
5,340 B | NEW — staged to …/Apple-PSIRT-Forensic-Rebuttal-iOS-26-3-2026-02-13.md (filer outbound forensic rebuttal markdown, 2026-02-13 20:47 EST; cites 161df0cb… trace hash internally) |
| 73 | iOS26.3_Highway_Robbery-main/Forensic Traces/logdata_26_2_1.tracev3 |
905b5cc8dc4c… |
3,229,936 B | NEW — staged to …/logdata_26_2_1-Build-23C71.tracev3 (binary unified-log capture from iOS 26.2.1 Build 23C71, captured 2026-02-09 09:15 EST, 1 min post-update) |
| 74 | iOS26.3_Highway_Robbery-main/Forensic Traces/logdata_26_3_Live.tracev3 |
161df0cbdd70… |
3,666,264 B | NEW — staged to …/logdata_26_3_Live-Build-23D127.tracev3 (binary unified-log capture from iOS 26.3 Build 23D127 post-remediation; filer's "displacement proof" comparison artifact) |
| 75 | iOS26.3_Highway_Robbery-main/check_offsets.py |
d74fc6ff6719… |
350 B | NEW — staged to …/check_offsets.py (350-byte audit-tool stub; documents mechanism without shipping the actual offset-validation routine) |
| 76 | iDrive-Exfil-main/README.md |
63a216b52877… |
1,857 B | NEW — staged to TRACK-B-IC3-067b3177c3524c80bce02cca08064d11/evidence/iDrive-Exfil-repo-README-2026-04-07.md (filer's published technical-surface description: polyglot HEIF carrier claim, mdat entropy 7.9478, three Shadow UUIDs, passd Wallet bridging to iCloud Drive) |
| 77 | iDrive-Exfil-main/assets/MyWorld.jpg |
5035e6c60204… |
4,836,652 B | NEW — staged to …/iDrive-Exfil-MyWorld-2026-04-07.jpg (JPEG/JFIF 1.01 baseline 3024×4032; carrier image; subject: filer's son in filer's backyard — personal-significance posture preserved verbatim) |
| 77a | iDrive-Exfil-main/assets/README.md |
a71fd90cc809… |
101 B | NEW (sub-row of #77 bundle) — staged to …/iDrive-Exfil-assets-README-2026-04-07.md (filer's personal note to son; preserved verbatim as on-face attestation about case's personal significance) |
(Note: the iDrive bundle is logically a 3-file set staged as ledger entries #76 + #77 + #77a. The personal-note file is recorded as a sub-row of #77 rather than its own integer ledger number to preserve a clean 8-net-new-files count this batch.)
Full SHA-256 (long form, batch 10 — 8 net-new unique-content files)
9f8fa4ef9cbc9f99ae9b79090333e3ba079bfcd9cdeb138f08ab1fdad4969625 repo-root-README.md
497108299d6cfbab09afc434d913ffed7d82460e596bb31efb1b13565ed974b1 Apple-PSIRT-BLASTPASS-V2-disclosure-2026-02-09.md
08d473e5fe0b25fc85a4c5f2a22f1da31014a97316b23a01cfc69645b5a49e78 Apple-PSIRT-Forensic-Rebuttal-iOS-26-3-2026-02-13.md
905b5cc8dc4cfc0254221bab3478c67c023821ff1852d8f8dfa2d782927e4c9c logdata_26_2_1-Build-23C71.tracev3
161df0cbdd70bfe507cb41bc2986d3474bf49755f5c97707b9751c9943b4845b logdata_26_3_Live-Build-23D127.tracev3
d74fc6ff671931e8bec912d3d41716b87e94b0924d1d852f202a0be66450bbad check_offsets.py
63a216b52877925eaf1ed1912673ccea9a79c93918b4d2ceaa128ec458d7d8e4 iDrive-Exfil-repo-README-2026-04-07.md
5035e6c602044b1a251f04e7ae5746ec7c4e7e81895bebb200952f1ca54ce6d6 iDrive-Exfil-MyWorld-2026-04-07.jpg
a71fd90cc809f5d04d51a99da7c08536464a16e4c888161a322256e9035ffad6 iDrive-Exfil-assets-README-2026-04-07.md
Internal cryptographic-consistency anchor (batch 10, Apple folder)
The trace SHA-256 values that the filer cites verbatim inside the staged disclosure and rebuttal markdowns match byte-for-byte the actual hashes of the staged .tracev3 artifacts:
| Cited inside | Hash cited | Hash actually computed on staged file | Match |
|---|---|---|---|
Apple-PSIRT-BLASTPASS-V2-disclosure-2026-02-09.md ("File Hash:") |
905b5cc8dc4cfc0254221bab3478c67c023821ff1852d8f8dfa2d782927e4c9c |
905b5cc8dc4c… (Build 23C71 trace) |
✅ Match |
Apple-PSIRT-Forensic-Rebuttal-iOS-26-3-2026-02-13.md ("Live Trace (Build 23D127) Hash:") |
161df0cbdd70bfe507cb41bc2986d3474bf49755f5c97707b9751c9943b4845b |
161df0cbdd70… (Build 23D127 trace) |
✅ Match |
This is a closed-loop self-anchor: the filer's own outbound disclosure documents quote the same hashes a third party would compute on the binary artifacts, locking the two outbound documents to the two binary captures as a single internally-consistent disclosure package.
New Tier-1 DKIM-signature domains this batch (0)
No new DKIM anchors this batch. Both folders are currently anchored on non-DKIM signals: the Apple folder on filer outbound + binary-artifact internal-consistency; the IC3 folder on the server-issued FBI submission ID + public-internet long-lived corroboration via a public-repo description field.
Cumulative Tier-1 DKIM-signature domains in system: 18 (unchanged from batch 9).
New non-DKIM anchor classes this batch (2)
| Anchor class | Where it lives | Why it works |
|---|---|---|
| Closed-loop self-hash anchor (Tier 2.5 — between Tier-2 server-pattern IDs and Tier-3 OTS+PGP) | TRACK-B-Apple-CVE-2023-41064-Patch-Bypass-iOS-26-2-1 |
Outbound disclosure documents cite SHA-256 hashes of binary artifacts; any reader can recompute and verify. Defends against post-hoc artifact substitution at the cost of being one-party-generated. |
| Public-internet long-lived corroboration of a server-issued ID (Tier 1.5 third-party-verifiable, complementary to public-repo content snapshots) | TRACK-B-IC3-067b3177c3524c80bce02cca08064d11 |
The submission ID is visible in a public-repo description field continuously since 2026-01-08; any internet archive (Wayback, Archive.today) snapshot of the repo's metadata page anchors the ID to a verifiable date that predates the catalog entry. |
Case-folder impact summary (batch 10)
-
NEW:
TRACK-B-Apple-CVE-2023-41064-Patch-Bypass-iOS-26-2-1(Provisional). Apple PSIRT disclosure thread mediated by VulnCheck; filer outbound 2026-02-09 + filer rebuttal 2026-02-13 + two pairedtracev3binary captures with internally-consistent SHA-256 cross-references + 350-byte audit-tool stub. Vendor stance preserved verbatim (Apple PSIRT characterized findings as "standard system behavior" / "no technical validity" on 2026-02-13 17:14 EST) without endorsement; filer's contrary position recorded in the staged rebuttal markdown. No mention of the paired private GitHub repository per filer instruction. Upgrades to Strong on (a)*.apple.comDKIM-signed inbound.eml, (b) Apple security-advisory cross-reference, or (c) third-party reproduction of the offset-displacement claim. -
UPGRADED Stub → Provisional (Anchor-Class candidate):
TRACK-B-IC3-067b3177c3524c80bce02cca08064d11(was 1,136-byte placeholder; now has full 12,262-byte Provisional README + 3 staged technical artifacts). Anchored on (1) server-issued FBI IC3 Submission ID, (2) public-internet long-lived corroboration viaJGoyd/iDrive-Exfilpublic-repo description field (visible since 2026-01-08T23:17:45Z, tree SHA810ab171…, last push 2026-04-07T15:35:51Z), and (3) staged byte-for-byte preservation of the filer's published technical bundle. Personal-significance posture preserved: the carrier image is the filer's own son in his own backyard.
Track A standing disclaimer (not applicable this batch)
Both cataloged folders this batch are Track B (cybersecurity vendor / federal-cybercrime intake). The Track A standing disclaimer is not required for batch-10 entries.
Cross-folder topical cross-reference (informational only, NOT a domain-separation breach)
Both folders cataloged this batch touch the iPhone-12-lineage device family the filer uses:
TRACK-B-Apple-CVE-2023-41064-Patch-Bypass-iOS-26-2-1(batch 10) — zero-click iMessage / PassKit / BlastDoor / ImageIO surface; disclosure to Apple PSIRT via VulnCheck.TRACK-B-IC3-067b3177c3524c80bce02cca08064d11(batch 10 upgrade) — iCloud-Drive synchronization-bus exfiltration surface via polyglot carrier; disclosure to FBI IC3.TRACK-B-Broadcom-BCM4387-BroadScope(batch 9) — BCM4387 coexistence-SRAM hardware surface; disclosure to Broadcom PSIRT.TRACK-A-CISA-INC0625285-iOS-Bypass(batch 9) — iOS security-bypass referral to DHS/CISA TOC; Track A.TRACK-B-CVE-2025-24085-24201-43300(Glass Cage) andTRACK-B-CVE-2025-31200-31201— prior Apple CVE clusters anchored on CERT/CC VINCE.
These six folders cover six distinct vulnerability classes through six distinct disclosure channels. The cross-references exist for human-navigation purposes only; no folder is technically combined with any other.
Safety-hygiene posture (batch 10, both folders)
Neither folder ships exploit code, PoC payloads, or weaponized technical detail. The two tracev3 binaries are read-only forensic captures intended for offset-displacement comparison, not exploit reproduction. The check_offsets.py helper is a 350-byte stub documenting audit mechanism without the offset-validation routine — deliberate by filer. The iDrive carrier image is preserved unmodified as the filer published it; no decoded payload is extracted or staged. This posture is consistent with the system-wide no-payload rule.
Batch 11 — 2026-05-18 CNVD / CNCERT original-vulnerability certificates (sovereign-CERT formal acknowledgement of the Glass Cage chain)
Source
Two PDF certificates dropped by filer into the build environment on 2026-05-18. The certificates are issued by 国家信息安全漏洞共享平台 (China National Vulnerability Database, CNVD), under 国家互联网应急中心 / CNCERT, with co-issuance by 中国互联网协会网络与信息安全工作委员会 (Internet Society of China — Network & Information Security Committee). Each certificate is headed 原创漏洞证明 ("Original Vulnerability Certificate") and identifies the contributor (贡献者) as Joseph Goydish, affiliated as 个人报送者 ("individual / personal contributor").
Filer context (verbatim, typos preserved, recorded as filer attestation):
"these vulns apply to the explout in th eglass cage report so th ecve 2025-43300, 25085, 24201. as you notuced.. cisa and apple never metione dme but china gave me the cerifatces . lik ean annoinemtn almost.. supe rimoirtant context into my ledger"
This attestation is recorded WITHOUT endorsement of the underlying CVE↔CNVD mapping. The CNVD certificates as documents stand on their own external anchors (sole-namespace server-issued IDs); the connection to the Glass Cage CVE cluster is a filer attestation cross-referenced under TRACK-B-CVE-2025-24085-24201-43300.
Files cataloged (2 unique-content files)
| # | Folder | Filename | Size | SHA-256 |
|---|---|---|---|---|
| 78 | TRACK-B-CNVD-2025-06744 |
CNVD-2025-06744-YCGO-202503023656-Certificate-2025-03-18.pdf |
700,295 B | 352a56ff1319e1b8138b1f4c6f55b652cf09ccd8c6784610e3a3ef6a9a80723c |
| 79 | TRACK-B-CNVD-2025-07885 |
CNVD-2025-07885-YCGO-202504012519-Certificate-2025-04-22.pdf |
700,113 B | d5bb17d5a27eabd32d272173116c90f89f12cdd912a26969115007383a7f21c8 |
CNVD-2025-06744 (cert CNVD-YCGO-202503023656, recorded 2025-03-18) covers vulnerability class 缓冲区溢出漏洞 (buffer overflow) in Apple iOS / iPadOS, severity 通用—操作系统-高危 (general / OS / high).
CNVD-2025-07885 (cert CNVD-YCGO-202504012519, recorded 2025-04-22) covers vulnerability class 内存释放后再利用漏洞 (memory release then reuse / use-after-free) in Apple多款产品 (Apple multi-product), severity 通用—操作系统-高危 (general / OS / high).
Stub → Provisional upgrades (batch 11)
| Folder | Was | Is |
|---|---|---|
TRACK-B-CNVD-2025-06744 |
Stub (1,139-byte placeholder) | Provisional (6,276-byte README + 1 staged certificate PDF) |
TRACK-B-CNVD-2025-07885 |
Stub (1,125-byte placeholder) | Provisional (5,944-byte README + 1 staged certificate PDF) |
New Tier-1 DKIM-signature domains this batch (0)
No new DKIM anchors this batch. Both folders are anchored on a substantively different evidence class: sovereign-CERT issuing-body certificate PDFs.
Cumulative Tier-1 DKIM-signature domains in system: 18 (unchanged from batches 9 and 10).
New non-DKIM anchor class this batch (1)
| Anchor class | Where it lives | Why it works |
|---|---|---|
| Sovereign-CERT original-vulnerability certificate (Tier 1 — substantive issuing-body finding, distinct from DKIM-attested email which only proves message emission) | Both TRACK-B-CNVD-2025-* folders |
The certificate is the issuing body's substantive recordation of the contributor under a sole-namespace server-issued certificate number. Unlike a DKIM-signed acknowledgement email (which proves "the server emitted this string at time T") or a GitHub-issue snapshot (which proves "this text was visible on a third-party platform at time T"), the certificate document itself records a finding by the issuing body: that the named contributor's submission was accepted as an original-vulnerability contribution. The certificate does NOT adjudicate vendor liability, patch mapping, or exploit reachability. |
Credit-asymmetry observation (filer-attested context, recorded for cross-folder navigation)
Apple's public security advisories for the Glass Cage CVE cluster (CVE-2025-24085, CVE-2025-24201, CVE-2025-43300) credit other reporters for the underlying patches — documented in TRACK-B-CVE-2025-24085-24201-43300/README.md. CISA has not formally acknowledged the filer's contribution either. Within the same 2025 timeframe, CNCERT/CNVD issued two formal original-vulnerability certificates naming the filer. The filer attests these CNVD entries cover the same underlying material as the Glass Cage CVE cluster.
This observation is preserved as filer-attested context, not as adjudicated finding. The CNVD certificates themselves do not assert any CVE-ID cross-reference. The Glass Cage README's existing language ("Apple's advisories credit other reporters") is the matching anchor on the other side.
Case-folder impact summary (batch 11)
- UPGRADED Stub → Provisional:
TRACK-B-CNVD-2025-06744. Was 1,139-byte placeholder; now full Provisional README with certificate PDF staged. Anchor: CNVD vulnerability ID + original-vulnerability certificate number, both sole-namespace server-issued. - UPGRADED Stub → Provisional:
TRACK-B-CNVD-2025-07885. Was 1,125-byte placeholder; now full Provisional README with certificate PDF staged. Anchor: CNVD vulnerability ID + original-vulnerability certificate number, both sole-namespace server-issued.
Track A standing disclaimer (not applicable this batch)
Both cataloged folders this batch are Track B (sovereign-CERT cybersecurity intake). The Track A standing disclaimer is not required for batch-11 entries.
Safety-hygiene posture (batch 11, both folders)
Neither folder ships exploit code, PoC payloads, or weaponized technical detail. The only artifacts staged are the issuing-body certificate PDFs themselves. Vulnerability-class language ("buffer overflow" / "memory release then reuse") is reproduced solely as it appears verbatim on the certificates.
Last updated: drop batch 2026-05-18 (batch 11: two CNVD/CNCERT original-vulnerability certificates promote prior CNVD stubs to Provisional) cataloged; total cataloged files = 79 (+ one sub-row) across twelve batches; unique-content files = 66 (64 prior + 2 net-new this batch); deferred Microsoft files = 0; re-export collisions = 1; byte-identical dups = 1.
Drop batch 2026-05-18 — batch 12 (FCA two named-officer substantive inbounds)
Status: cataloged · 2 net-new unique-content files, 1 re-export-collision duplicate, 1 stub-folder deletion, 1 case-folder upgrade (Strong → Strong-with-substantive-attestation).
Context: Three .eml files dropped this batch. All three on FCA matter 00Db00K8yP.500Sk019RuGn (= TRACK-A-FCA-BoC-StanChart). Two are net-new substantive inbound replies from FCA Consumer Queries / Supervision Hub on Bank of China (UK) Limited & Standard Chartered. The third is a re-export of the already-staged 2026-05-11 boilerplate ack (same Message-Id, different Proton-serialization bytes).
New artifacts (unique-content, staged)
| # | Source filename | SHA-256 (12) | Size | MIME | Track | Case folder | Notes |
|---|---|---|---|---|---|---|---|
| 80 | FCA-BoC-StanChart-Andrew-substantive-inbound-2026-05-08.eml (orig: Bank-of-China-UK-Limited-and-Standard-Chartered-ref_-00Db00K8yP.-500Sk019RuGn_ref-2026-05-08T09_43_04-07_00-2.eml) |
eb9978cb2a27 |
19,945 B | message/rfc822 | A | TRACK-A-FCA-BoC-StanChart |
2026-05-08 16:42:58 UTC — FCA named-officer substantive inbound. DKIM-pass fca.org.uk selector intactfcaorguk2 (2048-bit) + DMARC-pass (p=reject) + SPF-pass smtp.mailfrom=fca.org.uk (remote-ip 18.135.88.226). From FCA - Individuals Inbox <consumer.queries@fca.org.uk>. Subject "Bank of China (UK) Limited and Standard Chartered". Salesforce-relayed (Message-Id: <CRv3M0...@sfdc.net>) but DKIM-signed by FCA's own key. Body cites the underlying factual concerns verbatim (5-day work-shadow placement / 17-year-old / named intermediary / named offeror) and includes the officer attestation "I've today let my colleagues in the appropriate team that supervise the conduct of Bank of China (UK) Limited know about your concerns." Signed by named FCA Supervision Hub officer (full attribution preserved in evidence file headers + body; README uses generic framing per user instruction). Tier-1 substantive-attestation upgrade beyond the prior boilerplate noreply ack. |
| 81 | FCA-BoC-Andrew-supervisory-referral-inbound-2026-05-13.eml (orig: Bank-of-China-UK-Limited-ref_-00Db00K8yP.-500Sk019RuGn_ref-2026-05-13T02_08_46-07_00.eml) |
41a3003fe549 |
12,449 B | message/rfc822 | A | TRACK-A-FCA-BoC-StanChart |
2026-05-13 09:08:40 UTC — FCA named-officer supervisory-referral attestation. DKIM-pass fca.org.uk selector intactfcaorguk2 (2048-bit) + DMARC-pass + SPF-pass (remote-ip 18.135.88.226, same as #80). Subject "Bank of China (UK) Limited". From same consumer.queries@fca.org.uk mailbox. Body contains explicit supervisory-referral language: "I've today referred the additional information you've provided regarding Bank of China (UK) Limited to the supervisory appropriate team for further investigation. If they require any further information from you about this, they'll ask me to contact you again." Same matter reference 00Db00K8yP.500Sk019RuGn, same named officer. Strongest Track-A substantive inbound on the FCA matter to date. Strict framing: this is an intake-routing statement, NOT an adjudicative finding (FCA Track-A standing disclaimer applies). |
Re-export-collision duplicate (cataloged, not staged):
| # | Source filename | SHA-256 (12) | Duplicate-of |
|---|---|---|---|
| 82 | Thank-you-your-query-has-been-received.-2026-05-11T08_11_48-07_00-2-3.eml |
3b67b94baec9 |
RE-EXPORT COLLISION of #30 (same Message-Id <3SoUKDexQcy3vSp5cr88Gw…@sfdc.net>, same 16,266-byte length, different bytes — Proton re-export of identical FCA emission). Not re-staged. |
Full SHA-256 (long form, batch 12 — 2 unique-content files)
eb9978cb2a2717910ec4fc809ee7518ce456c2962df48684e0c8fafb8213f936 FCA-BoC-StanChart-Andrew-substantive-inbound-2026-05-08.eml
41a3003fe5495e14ca4922e0bf486b0a8f47425ba15a01d20f9369622b23bdf5 FCA-BoC-Andrew-supervisory-referral-inbound-2026-05-13.eml
(Full 64-char hashes also recorded in ANCHOR-COMMANDS-2026-05-18-batch11.sh FILES array.)
New DKIM anchors this batch (Tier 1)
None net-new — both new inbounds DKIM-sign on fca.org.uk selector intactfcaorguk2, already in the system since batch 4.
However, anchor substance upgrades materially: the two new inbounds carry the same fca.org.uk DKIM signature but on substantive named-officer reply text, not just a noreply boilerplate ack. This is the FCA anchor changing from "agency-system emitted a receipt" to "named agency officer wrote a substantive supervisory-routing letter, signed by the same agency key" — a meaningfully stronger Tier-1 surface.
Cumulative Tier-1 DKIM-signature domains in system: 18 (unchanged from batch 11).
Folder-state changes this batch
- DELETED:
TRACK-A-FCA-212278528(1,707-byte stub README, no staged artifact, no server-side corroboration of the212278528reference). Per user: "Delete the 212278528 stub." The212278528reference is treated as withdrawn; the operative FCA matter in this system is00Db00K8yP.500Sk019RuGn(=TRACK-A-FCA-BoC-StanChart) only. - UPGRADED in substance (Strong → Strong-with-substantive-attestation):
TRACK-A-FCA-BoC-StanChart. README rewritten to fold both new inbounds into the timeline, evidence table, and "what this establishes / does not establish" sections. The disclaimer language explicitly states the supervisory-referral attestation is an intake-routing statement, NOT an adjudicative finding.
Anchor script created this batch
evidence/ANCHOR-COMMANDS-2026-05-18-batch11.sh— 2 net-new unique-content files (FCA Andrew substantive + supervisory-referral inbounds). Self-test SHA verification passes; canonical PGP fingerprint expands to correct 40-char hex form.
Track A standing disclaimer (applies to all batch-12 entries)
Filing and agency acknowledgement does not constitute adjudication of the underlying claims. The 2026-05-08 and 2026-05-13 FCA replies attest receipt and intake-routing only. FCA's own standing policy (quoted in the 2026-05-08 reply): "we'll generally not provide feedback on what action has been taken… there is no general right for members of the public to know the outcome of reports that they make."
Safety-hygiene posture (batch 12)
No exploit code, PoC payload, or weaponized technical detail in either file. Both are Track A regulatory-correspondence artifacts. No Track B material introduced or referenced in batch 12.
Officer-naming posture (batch 12)
Per user instruction, the named FCA Supervision Hub officer is preserved in full in the staged .eml files (headers + body — both are signed by FCA DKIM and must not be modified) and in this ledger entry. The case-folder README uses generic framing ("FCA Supervision Hub officer", "named officer") — the verbatim name is reachable for anyone who reads the staged files but is not foregrounded in the human-facing README narrative.
Audit-finding fixes folded into this batch
This batch also persists the following audit-pass corrections completed in the same session:
- PGP-fingerprint corruption fix in 2 anchor scripts:
ANCHOR-COMMANDS-2025-05-18.sh(batch 1) andANCHOR-COMMANDS-2026-05-18-batch2.sh(batch 2) previously contained a corrupted 41-charKEY=value with a stray digit at position 14. Both now use the canonical spaced form"4A04 1F50 6D89 4F5E E391 7438 6487 8B56 A2EB 2D11", verified to expand to the correct 40-char no-space form4A041F506D894F5EE391743864878B56A2EB2D11. - Ledger hash-prefix typo fix (4 rows): row #35 (SK GenPro OP PDF) updated from
2d1d18f37b13→ correct2d1d18f3450a; row #53 (LT duplicate-of-#35) same update; row #36 (DOE-417 PDF) updated fromd203750dc3a9→ correctd203750ddb65; row #41 (LT duplicate-of-#36) same update; long-form recap block in batch-4 section synced. The 64-char full-form hashes inANCHOR-COMMANDS-2026-05-18-batch4.shFILES array were always correct and were the source of truth used to resolve the typo direction. - Lithuania hash mismatch (DeepSeek observation 5a): verified row #20 prefix
603409f4b01bmatches the actual on-disk SHA603409f4b01bfed46d22d7129ec22a1969f1a32921654b3559febbd4e62bc17dbyte-for-byte. The flagged mismatch was stale (resolved before this audit pass).
Last updated: drop batch 2026-05-18 (batch 12: two FCA named-officer substantive inbounds upgrade TRACK-A-FCA-BoC-StanChart from Strong-on-boilerplate-ack to Strong-with-substantive-attestation; TRACK-A-FCA-212278528 stub deleted; audit-pass corrections to 2 anchor scripts + 4 ledger rows folded in) cataloged; total cataloged files = 82 across thirteen batches; unique-content files = 68 (66 prior + 2 net-new this batch); deferred Microsoft files = 0; re-export collisions = 2 (1 prior + 1 new); byte-identical dups = 1.