Skip to content

README.md

Latest commit

 

History

History
75 lines (64 loc) · 3.9 KB

README.md

File metadata and controls

75 lines (64 loc) · 3.9 KB
Raw

Security Review Evidence

This directory is Alice's durable security-evidence package. It preserves the Stage A preparation, the Stage B review history, the owner's Phase 5.1.c disposition, and the remaining proof gaps without turning team-authored evidence into an external audit or certification.

Status

  • Stage A threat model and evidence package: prepared; the prior local receipts are superseded after committed-SHA CI failed, so the repaired carrier needs fresh receipts.
  • Phase 5.1.c owner disposition: accepted at the claim bar "automated security scanning under OpenAI Trusted Access on the repository, plus internal adversarial review."
  • Stage B history: retained as provenance, not evidence of an external assessment. No external auditor is required under the owner's disposition, and no external audit occurred.
  • Security certification or assurance claim: none.
  • Version change or release approval: not granted by these documents.

The Stage A baseline is main at c9d24243920a694eaf00ad595da392a1478710dd. The browser-clipper remediation adds one HTTP operation to that baseline. The superseded carrier reproduced 183 default HTTP operations, including 71 /v0/vnext operations, 232 HTTP operations with legacy surfaces enabled, and 11 core MCP tools. Route, OpenAPI, legacy-gating, and flag-off MCP closure tests reproduced those values on that carrier; the repaired carrier must reproduce them again. The base counts were 182, 70, 231, and 11.

Evidence Language

  • Implemented control means the named code path exists.
  • Test evidence means a named repository test exercises the claim; it still has to pass on the exact review commit.
  • Carrier acceptance means a final-carrier CI or local result is required.
  • Proof gap means the team does not claim closure.
  • Owner action is outside the builder team's authority.

Package Index

  • Threat model — assets, actors, trust boundaries, data flows, abuse cases, controls, and residual risks.
  • Stage A evidence ledger — scope, source provenance, acceptance rules, and known gaps.
  • Authentication and authorization — HTTP, MCP, agent key, project-scope, RLS, SQLite, and legacy-gating boundaries.
  • Input validation — request models, SQL/JSON/FTS construction, import paths, and the deferred directory-import gap.
  • Secrets and redaction — key storage, provider secrets, public errors, logging evidence, and RAM-hygiene limits.
  • Dependency posture — pinning, advisory tooling, automated scans, and the Python audit gap.
  • Review disposition and retained brief — the original owner-owned Stage B scope, the accepted claim boundary, optional future review guidance, and current status.

Historical Scan: Input, Not Sign-off

A repository-wide deep scan targeted 2c372417e1d07d072265d2efdfbdace04f8bfcbb, not the Phase 5 base or final carrier. Its report contains 41 canonical findings represented by 156 report instances: 24 Medium and 132 Low, no High or Critical, all with Medium confidence. Coverage was partial and the report explicitly retained runtime and deployment proof gaps.

The scan artifacts remain with the release engineer. They are historical review input only: the counts must not be presented as a current-head finding count, clean bill of health, external assessment, or proof that untested paths are safe. Three confirmed issues from that cycle were merged in PRs #310, #311, and #312; the browser-clipper credential-context remediation belongs to the Phase 5 carrier and must pass its final acceptance tests. The owner's Stage B disposition accepts Trusted Access automated scanning plus internal adversarial review; it does not turn the historical scan into an exact-candidate external assessment or an independently audited claim.