Sergio Rodriguez — Research archivehttps://sergrdz.pages.dev/research-logReverse engineering, Python tools, and patch studies. Source and records from Sergio Rodriguez.en-us Waymark: follow the originalhttps://sergrdz.pages.dev/labs/source-trail/https://sergrdz.pages.dev/labs/source-trail/Mon, 05 Oct 2026 17:26:12 -0400Publication dates, immutable revisions, publisher-attested onion identities, and a local file hash check. Cartels in the public recordhttps://sergrdz.pages.dev/case-studies/cartelkithttps://sergrdz.pages.dev/case-studies/cartelkitMon, 05 Oct 2026 16:45:00 -0400CARTELKIT revised as a cited public-source study. Original synthetic records are excluded from the assessment. Afterimage: before the bodyhttps://sergrdz.pages.dev/labs/cve-replay/chunk-lines/https://sergrdz.pages.dev/labs/cve-replay/chunk-lines/Mon, 05 Oct 2026 12:00:00 -0400Afterimage compares urllib3 2.7.0 and 2.8.0 in 32 bounded offline cases. Framing-line rejection and body controls, with upstream credit. Where the headers wenthttps://sergrdz.pages.dev/labs/cve-replay/https://sergrdz.pages.dev/labs/cve-replay/Sun, 27 Sep 2026 12:00:00 -0400A published urllib3 redirect issue independently replayed against two release packages. Who approved this exact call?https://sergrdz.pages.dev/labs/call-boundary/https://sergrdz.pages.dev/labs/call-boundary/Sun, 27 Sep 2026 12:00:00 -0400Signed request scope, expiry and replay protection in a small Python authorization gate. C in. Ghidra out.https://sergrdz.pages.dev/labs/binary-boundary/https://sergrdz.pages.dev/labs/binary-boundary/Sun, 27 Sep 2026 12:00:00 -0400Original C, two native builds, Ghidra output and recorded boundary tests.