# First endpoint / `knowledge.txt` audit

## Result

**Verified.** The public first-endpoint Dropbox download is a 1,221-byte `ONION.zip` with exactly one member, `knowledge.txt`. The contained 967-byte clear-signed message verifies as an OpenPGP v4 RSA/SHA-256 text signature under the already preserved Tengri public key.

This closes a provenance gap in the local release: earlier text quoted the note, while this audit retains the exact downloaded ZIP and validates its signature packet against the public-key bytes. It does not make the note's promise of a 'last step' into a known action or endpoint.

## Source capture

- Public folder URL fetched with `dl=1`: `https://www.dropbox.com/scl/fo/stcs503hxh5hb60impjgr/AD4n5zB_HifOK108YeXy6vc?rlkey=alcqjqgwgzgdm2za4gwc8p7mq&dl=1`
- Downloaded ZIP: `archive/recon/dropbox-first-endpoint-2026-07-27/ONION.zip` — `1221` bytes — SHA-256 `5245b01a5fb9a48dd1ce78469de330cd5e8ae4fe33be65a44330fd9a7a97d5d8`
- ZIP members: `knowledge.txt`
- Extracted note: `archive/recon/dropbox-first-endpoint-2026-07-27/unzipped/knowledge.txt` — `967` bytes — SHA-256 `60decd157a812ec4434bdb836ce36bbd2cd6f6d9bc12afd5b8601901e5c7f3bd`

## Cryptographic check

- Public-key file: `archive/recon/pgp-crypto/key_ubuntu_666ab731.asc` — SHA-256 `9501a19f980380b0f06788ae46e0809b47d2a51d8679f315561b8b4d459640de`
- Parsed v4 RSA fingerprint: `2A2C0AD4ED1CAD8353A30056D152D6C5666AB731`
- Signature issuer key ID: `D152D6C5666AB731`
- Signature creation time: `2017-04-02T19:35:00+00:00`
- Clear-sign verification: **PASS** using `remove_terminal_signature_separator_crlf`.

The check verifies that this downloaded body was signed by the matching public key. It establishes key continuity, not the human identity behind that key.

## Exact signed text

> The last step is coming.
> Visit this place again!
>
> Tengri 137
> 0x666ab731

## Spacing / hidden-whitespace boundary

- The canonical signed body has `5` CRLF line endings and `1` intentional blank paragraph separator.
- Horizontal tabs: `0`; trailing spaces/tabs: `[]`; other control bytes: `[]`.
- Therefore the preserved bytes do not contain a variable spaces-versus-tabs or trailing-space stream from which a simple Morse/binary message could be read. The signed note is a short, plain statement with ordinary layout; this bounded result does not pretend to reject arbitrary unrelated cipher theories.

## Meaning boundary

The note proves that the first Dropbox route was a genuine Tengri-key publication and gives a return instruction. It does **not** specify what should happen on return, when it should happen, where a reward was, or how to resolve the later 2037 rendezvous. The signed November 2017 replacement-path statement remains the evidence for the route change.

## Reproduce

```powershell
& '<bundled-python>' scripts\audit_first_endpoint.py
```