detail
While building the T-HOUSEKEEPING-SCHEDULE weekly sweep, found GOV-INVENTORY.php (systems/commands/GOV-INVENTORY.php, step 6 of the sweep spec) still 403ing, matching T756 filed 08/10/26 and never actually fixed. Applied the same .htaccess allowlist fix that correctly resolved the identical-looking issue for PEEK/JANUS (08/22) and ROTATE (08/12) -- added GOV-INVENTORY to the FilesMatch pattern, backed up, deployed, live-tested. Still 403 after the fix, unlike those two prior cases where the same fix worked immediately. This means GOV-INVENTORY.php's block is NOT the .htaccess allowlist gap it resembles -- something else is blocking it (a WAF signature match on the filename/content is the next most likely candidate, per the SOP's own original 08/10 suspicion, which turned out to be wrong for ROTATE but may be right here). Left the .htaccess change in place (harmless, doesn't hurt anything, and rules out one candidate cause for good) but did not chase the WAF angle further given time -- flagging as still genuinely open, not silently working around it.