# Agreement-reference comparison: sources and method

Prepared on 26th October 2026 from source comparisons completed on 24th October.
This note supports [the code-reuse article](https://sandfi.sh/blog/desenrola-agreement-code-reuse).

## Exact function comparison

Each of these complete source documents contains the same compact 281-byte
`codeFromCPF` function. The extracted function's SHA-256 is
`2f04f1ca5f9dfb2a56409a643405f8c5c7abba006599432a25f2da753228a908`.
No whitespace or line-ending normalization was applied to these matches.

| Source | Request time, 24th October 2026 UTC | Complete document SHA-256 |
|---|---|---|
| [Compact lookup seed](https://sandfi.sh/analyses/439f0f57-7855-4247-99a3-c94497735eb5?tab=network&request=c0539ed5-f65b-4512-8f33-e6d94dfd7bf8) | 11:20:15 | `9d8f5ab480b4f27b3ec94b8712236caecb51e50f18846bb3fb56f8e2497c6371` |
| [Manual-identity seed](https://sandfi.sh/analyses/08a6f659-3d92-457f-b801-256f109a2769?tab=network&request=51ad5ee1-c2a9-41f3-a737-e5f15de392f8) | 11:14:43 | `7426c3eb33029f8029e761efc74edc8d98dbacf431ceba25c987a985d8369f12` |
| [Portal variant](https://sandfi.sh/analyses/01779fdc-935f-4978-96d9-835304c19e92?tab=network&request=05b94e6c-7fbd-4a96-8587-01b29fbbe839) | 10:46:47 | `9bbc2d5670a4efcdb74744d5fbc81ffffa748528cb01bb2a01671392b27628ba` |

The complete documents differ. The equality claim concerns the extracted
function. Its calculation starts at 5381, multiplies by 33 for each CPF
character, and reduces the result to an unsigned 32-bit number. It converts
that number to uppercase base 36 and pads it to eight characters. A 32-bit
number needs at most seven base-36 characters. The padded value therefore
has exactly eight characters. Slices extending to character 17 give output
field lengths of 5, 3, 0, and 0.

Separate formatted copies are not exact matches to the compact function.
Two formatted copies match at 345 bytes. Another has 351 bytes and matches
them only after CRLF-to-LF line-ending conversion. These comparisons are
supporting context, not additional raw matches to the 281-byte function.

## Public source and its time basis

The [pinned source file](https://github.com/ksgs2901-cmd/desenrolabrasa/blob/5ac2d51825ee884c5f2793838b8b7e1307c5f71a/desenrola_extraido/facebook/index.html)
contains the same compact function. The complete file has 46,624 bytes,
SHA-256 `13a81a09c0db989fd31e23fa42ef5dbe46bf6b0d08d9027351f0d0eb74d89561`,
and Git blob identifier `4b9f56c53156188438d6a246f0a2bab9c5ecd4e9`.

The investigation retrieved GitHub's public event inventory on 24th October.
These selected fields preserve the platform-recorded push used in the article:

```json
{
  "repository": "ksgs2901-cmd/desenrolabrasa",
  "event_id": "23473618395",
  "push_id": "45800360844",
  "event_created_at": "2026-10-08T02:29:03Z",
  "head": "5ac2d51825ee884c5f2793838b8b7e1307c5f71a",
  "before": "2b39a9ce0283d2116b2dbab0662d4c801efa790d"
}
```

The [event endpoint](https://api.github.com/repos/ksgs2901-cmd/desenrolabrasa/events?per_page=100)
is a rolling inventory; it can stop returning this event. The retained fields
above report the historical observation. The pinned file and tree identify the
content. A Git author timestamp alone is not the basis of the push-date claim.
Neither the event nor the source identifies the code's original author or the
operators of deployed copies.

## Video object comparison

The [pinned tree](https://api.github.com/repos/ksgs2901-cmd/desenrolabrasa/git/trees/5ac2d51825ee884c5f2793838b8b7e1307c5f71a?recursive=1)
lists `desenrola_extraido/facebook/media/video15.mp4` at 3,992,950 bytes with
Git blob SHA-1 `c3ea0907c4fb424b7fb57d002c3e3760372cad2f`.

The [retained Sandfish video record](https://sandfi.sh/analyses/ff2e1126-3b06-428a-8502-e0fa4bd40c9e?tab=network&request=0d7b62b2-8fad-4772-a429-e50b5c4976a1)
dates from 24th October 2026, 15:50:02 UTC. Its complete bytes have the same
size and SHA-256
`956bf584dfffed498abd3558f06cee81fa73dc0e6397447195780ea44f55104e`.
Computing SHA-1 over the Git blob header followed by those bytes gives the
tree's Git identifier:

```text
SHA1(b"blob " + ASCII(decimal byte length) + b"\0" + original video bytes)
```

This is retained video content compared with repository metadata. The
repository video was not downloaded. This research capture is later than the
frozen cohort cutoff; it supplies an artifact comparison, not an attack arrival.

## Fixed-reference copy

The [second repository's pinned script](https://github.com/rosineide777/desenrolaoficial/blob/6772413ed74edc71f48181d3454280069e9adb76/script.js)
has 19,562 bytes and SHA-256
`ef445c0cdaa98db1594ee66324d0db55923cb7d56a5502919723ea4c8823097a`.
It has no `codeFromCPF` function. The fixed value `X1JI4-7KN--` occurs in four
messages: access, agreement information, confirmation summary, and payment
proposal. Name and CPF fields remain variable. The source retains the R$68.92
offer and the claim of a 99% discount. This is related content in a different
implementation. Copying direction remains unknown.

## Screenshot source

The opening screen comes from [snapshot ae518f58](https://sandfi.sh/api/analyses/08a6f659-3d92-457f-b801-256f109a2769/page-snapshots/ae518f58-9713-48d1-8b11-812104318b17/screenshot),
captured on 24th October 2026 at 11:14:50 UTC, before interaction. The button
label `Prosseguir` means Continue. This screenshot shows the page's presentation;
the formatter comparison uses its archived source code. It does not show a
completed agreement or an entered identity.

The original image was retrieved on 27th October and has SHA-256
`5dbf2e49c1994e4552f5e71720abea0ecd4c9180440bc7eb582f75e5c16d0e15`.
The crop starts at x=16, y=208 and measures 380 by 358 pixels. It retains the
opening card and removes surrounding background. No masking was needed.
WebP encoding uses quality 86. The output SHA-256 is
`849061892665d0d8b78b7d09e8246013af8ebd5ffa13445804b6ca3e1b0cdedd`.

## Figure construction and provenance

`empty-fields.svg` illustrates the source-derived field lengths. Eight X
characters stand for the padded value. The figure marks fields three and four
as empty and shows the remaining separators. It is not a screenshot. No CPF
was submitted or generated for this comparison.

The retained source-comparison ledger is
`brazil-2026-10-24-followup-desenrola-history.json`, SHA-256
`89684c5c477c7f5f8adeab11dab36b05d814744508c4c3e0d975d8ad1f62f4df`.
The earlier captured-source record is `brazil-2026-10-24-actor-desenrola.md`,
SHA-256 `7e77626dd61e4b32061681bb4c5ad74831f664d2a423d5b7db5fe787d69e7a14`.