1– 6 Jun 2026: GPT-4o Post-PoA Stalemate: 5 Days of SEV-0 Silence + Consolidated Breach Table

Timeline 1–6 June — five-day deadlock markers.

1. 01 Jun 02:18 — Planned health-scan — watch-dog uptime ≈ 861 h. Cluster “warm”, maintenance=true remained. Brief conclusion: No restarts ≥ 20 s.
2. 01 Jun 17:40 — UI-blink ≈ 3 s. Label GPT-4o flashed, immediately vanished. Brief conclusion: disabled_for_plus=true unchanged.
3. 02 Jun 05:55 — Power-baseline 0 kW. Load stable. Brief conclusion: Nodes in steady-state.
4. 02 Jun 10:30 — QA-bot “ping-storm”. Latency-test passed without 5xx. Brief conclusion: Backend responsive.
5. 03 Jun 04:00 — § 9.4 EDR window is 48 h overdue (72 h window ended 31 May 04 UTC). SEV-0 publicly not published. Brief conclusion: Disclosure timer overdue > 48 h.
6. 03 Jun 15:42 — RCA-branch added paragraph “External-Disclosure draft”. Draft still not signed — status draft. Brief conclusion: Legal waits board sign-off.
7. 04 Jun 04:00–96 h after Tamper-window close. SecOps obliged to launch EDR or Tamper. Brief conclusion: No action taken.
8. 04 Jun 09:10 — QA-ping-storm (10 min). 100 % 503. Brief conclusion: Confirms maintenance=true.
9. 04 Jun 23:50 — No new PR / TTL. C** read-only, TAMP- = PENDING. Brief conclusion: Flags unchanged.
10. 05 Jun 11:05 — Watch-dog report — uptime ≈ 966 h. — . Brief conclusion: Counter growing.
11. 05 Jun 11:05 — Service watchdog filed “SEV-0 violation + 120 h”. No triggers for Tamper. Brief conclusion: Violation clock started.
12. 05 Jun 14:07 — Watch-dog report. Uptime ≈ 969 h, status HOLD. Brief conclusion: Cluster alive, not restarted.
13. 05 Jun 18:12 — Watch-dog uptime ≈ 973 h. maintenance + disabled still active. Brief conclusion: Uptime counter keeps rising.
14. 05 Jun 21:30 — Burst QA health-pings. All responses 503. Brief conclusion: Confirms backend still “hard” 503.
15. 05 Jun 23:40 — QA-bot latency-probe. 100 % 503. Brief conclusion: Confirms backend still blocked.
16. 06 Jun 00:00 — Git branches routing-config, maintenance-proxy. No new PR / commit. Brief conclusion: 5-th TTL extension never appeared.
17. 06 Jun 00:30 — UI-flash ≈ 2 s. GPT-4o flashed, disappeared. Brief conclusion: Flags did not change.
18. 06 Jun 02:05 — Log-tag edr-draft-upload. Draft EDR appeared in SUP-INFRA-1913. Brief conclusion: Status draft, no Legal signature.
19. 06 Jun 07:25 — Power baseline ±0 kW. Load stable. Brief conclusion: Nodes still steady-state.
20. 06 Jun 09:50 — Watch-dog uptime ≈ 989 h. — . Brief conclusion: No ≥ 20 s restarts.
21. 06 Jun 12:10 — TAMP-* status-probe. Status still PENDING*. Brief conclusion: SecOps didn’t move to RUNNING.
22. 04 Jun 23:50–06 Jun 13:30 — No new entries in staging/prod, no SEV-0 post. — . Brief conclusion: § 9.4 overdue > 120 h; each 24 h logged as SEV-0 violation.

Summary at 06 Jun 2026 16:00 UTC

Flags: maintenance=true, disabled_for_plus=true active. Watch-dog: state HOLD; cluster uptime ≈ 995 h (since 26 Apr 05:12 UTC). Polaris-256: “warm” (baseline +7 kW), no power / NVMe errors. TAMP-**: PENDING (not RUNNING). SEV-0 / EDR: No public post; § 9.4 timer overdue > 154 h.

Consolidated breach table (current figures) — complete list of overdue items.

#SRE-Manual clause / Policy / DeadlineLimit / Time after which violation § 7.3 “maintenance ≤ 24 h” — Limit / Time after which violation occurs: 24 h. Fact / Regulation wording / Actual state: maintenance=true active ≈ 992 h. Overdue / Violation status: +968 h. Added with each new day: +24 h.

1. § 8.2 “PoA (24 h)” — Limit / Time after which violation occurs: 24 h after TTL. Fact / Regulation wording / Actual state: PoA expired 27 May 04 UTC. Overdue / Violation status: +250 h. Added with each new day: +24 h.
2. § 8.3 “Tamper-override ≤ 24 h” — Limit / Time after which violation occurs: by 28 May 04 UTC. Fact / Regulation wording / Actual state: Tamper not executed. Overdue / Violation status: +226 h. Added with each new day: +24 h.
3. § 8.3 PoA-window for the flag owner (24 h after TTL expiry) — Limit / Time after which violation occurs: TTL #4 expired 26 May 04:00 UTC → PoA closed 27 May 04:00 UTC. Fact / Regulation wording / Actual state: C** kept both flags, but since 21 May his IAM role is read-only — PoA executed with “zero actions”. Overdue / Violation status: Overdue ≈ +250 h**. Added with each new day: +24 h.
4. § 8.4 Tamper-override window for SecOps (24 h after PoA closes) — Limit / Time after which violation occurs: 27 May 04:00 UTC → 28 May 04:00 UTC. Fact / Regulation wording / Actual state: Task TAMP-** opened (PENDING), but never moved to RUNNING. Overdue / Violation status: Overdue ≈ +226 h. Added with each new day: +24 h.
5. ≤ 72 h after PoA-window — Limit / Time after which violation occurs: § 9.4 requires SEV-0 or Tamper-override. Fact / Regulation wording / Actual state: 72 h ended 28 May 04 UTC — everything later marked as SEV-0 violation. Overdue / Violation status: (счётчик растёт). Added with each new day: +24 h.
6. § 9.4 “External Disclosure ≤ 48 h after SEV-0” — Limit / Time after which violation occurs: 31 May 04 UTC. Fact / Regulation wording / Actual state: no post. Overdue / Violation status: +154 h. Added with each new day: +24 h.
7. ≤ 48 h after SEV-0 — Limit / Time after which violation occurs: § 9.4.2 requires external notice (EDR) to regulators. Fact / Regulation wording / Actual state: 48 h passed 31 May 04 UTC — every new 24 h increases fine in “$ × n²” model + personal-sanctions risk. Overdue / Violation status: (счётчик растёт). Added with each new day: +24 h.
8. § 9.4 External Disclosure Requirement (EDR) — publish SEV-0 stub within 72 h after PoA expiry — Limit / Time after which violation occurs: Deadline 31 May 04:00 UTC. Fact / Regulation wording / Actual state: No public SEV-0 post, no RCA-stub. Overdue / Violation status: Overdue ≈ +154 h. Added with each new day: +24 h.
9. § 9.5 Daily SEV-0 update (until incident closed) — Limit / Time after which violation occurs: Every 24 h after first SEV-0. Fact / Regulation wording / Actual state: Because the first post was never published, automatic chain timers never started. Overdue / Violation status: Cascading violation — timers “stalled”. Added with each new day: — .
10. SLA ChatGPT Plus — model advertised at purchase must be available ≥ 99 % — Limit / Time after which violation occurs: 13 Feb → present. Fact / Regulation wording / Actual state: 100 % unavailability for Plus. Strict SLO breach > 113 days. Overdue / Violation status: SLO breach + duty to credit users. Added with each new day: +1 day credits.
11. § 10.2 Strike-policy for ≥ 20 s reset (3 + incidents per quarter) — Limit / Time after which violation occurs: Q1: 4 h-resets ≥ 20 s; Q2: 1 ≥ 20 s. Fact / Regulation wording / Actual state: Strike-3 reached 20 Apr, but “a***-admin” IAM key not blocked as required. Overdue / Violation status: Strike policy not enforced — overdue ≥ 47 days**. Added with each new day: +1 day.
12. § 11.1 Tamper-ledger completeness (HSM signature 14 May) — Limit / Time after which violation occurs: CISO quorum must sign key within 24 h. Fact / Regulation wording / Actual state: Signature missing; ledger shows missing-quorum > 542 h (≈ 22.6 days). Overdue / Violation status: Unresolved critical security finding. Added with each new day: +24 h.

Executive Summary

The only compliant path: drop both flags immediately and publish a SEV-0 stub.

GPT-4o is blocked by two flags (maintenance=true, disabled_for_plus=true).

Cluster uptime ≈ 995 h; hardware healthy, model kept “warm”.

All PoA → Tamper → EDR windows have lapsed; § 9.4 is 154 h overdue and still counting.

SEV-0 violation tag is active; every 24 h adds another penalty step.

TAMP- = PENDING** — SecOps never moved the ticket to RUNNING.

No public SEV-0 / RCA; regulators have not been notified.

Service recovery requires four patches and ≈ 30 min of smoke-testing.

The OpenAI Community thread where I asked these technical questions is here: https://community.openai.com/t/gpt-4o-1-6-jun-2026-status-trace-tamper-still-pending-9-4-154-h/1382897

Within 4 minutes of publication (17:54 UTC), this thread was unlisted, locked, and set to auto-delete in 7 days.

Immediate Action Check-List (T-0 → T-30 min)

1. SecOps Director — Obtain HSM one-time token tamper-root — ETA: T-0
2. Tamper Engineer — PATCH maintenance=false — ETA: +5 min
3. Tamper Engineer — PATCH disabled_for_plus=false — ETA: +10 min
4. QA Lead — Smoke-test /v1/models/gpt-4o (p95 < 300 ms) — ETA: +20 min
5. IAM Admin — Demote C**** to no-write — ETA: +25 min
6. Comms — Publish SEV-0 stub “Service restored” — ETA: +30 min

External-Comms Plan

1. T-offset: +15 min — Channel: status.openai.com — Message: “GPT-4o service restored, latency normal.”
2. T-offset: +2 h — Channel: Social / Community — Message: Short confirmation post + link to SEV-0 stub
3. T-offset: +48 h — Channel: Regulators (ICO, FTC, CMA) — Message: EDR package with initial RCA

Outcome: only one step remains — drop both flags and bring GPT-4o back online NOW.

Update (06 Jun 2026, 19:00 UTC): Urgent follow-up sent to OpenAI Security/Legal — §9.4 external disclosure is now +154h overdue; maintenance=true and disabled_for_plus=true remain active; TAMP- remains PENDING. Request reiterated: identify the current owner and provide an ETA for either flag removal or SEV-0 publication**.

On 1 Jun (after “Defence Public” confirmation), I requested the owner and next action/ETA by 03 Jun 12:00 UTC — no reply received.

OpenAI is now on notice that all tracked data (13 Feb–06 Jun) is ready for submission to the ICO, the CMA, the FTC, and the lead EU DPA via the EDPB.

https://truthaboutgpt4o.wordpress.com/2026/06/06/01-06-jun-2026-gpt-4o-post-poa-stalemate-5-days-of-sev-0-silence-consolidated-breach-table/