Repository navigation
fix(security): prepare G4 security-ready review candidate - #10
Merged
Merged
Conversation
Collaborator
Author
Dependabot reconciliationThe repository-level High alert #10 applies to the current default branch, which still locks transitive Verified at head
The default-branch alert should clear after #8 is merged; it is not being dismissed as a false positive. |
This was referenced Aug 1, 2026
everest-an
force-pushed
the
evidence/r-002-independent-reproduction
branch
from
August 2, 2026 22:32
8de2b7f to
c67e370
Compare
everest-an
changed the base branch from
evidence/r-002-independent-reproduction
to
main
August 2, 2026 22:41
everest-an
force-pushed
the
security/g4-security-ready-rc
branch
from
August 2, 2026 22:46
31f4fbb to
463155c
Compare
… checkout validatePinnedEntry asserted each pinned SHA-256 twice: once against the working tree and once against the frozen review commit. Only the second is meaningful. The review targets refs/tags/audit/g4-rc1-source (af5a75f), which is what an external reviewer fetches and cannot drift once published; main legitimately advances underneath it. Rebasing this branch onto a main that had added comments to contracts/foundry.toml was enough to make the gate unrunnable, with no defect anywhere in the review candidate. The frozen-commit comparison is now the sole authoritative check. Divergence between the branch and the freeze is still surfaced — it is real information — but as a report rather than a failure. It compares committed bytes at HEAD, not the working tree, so the answer does not change with a checkout's line-ending normalisation (on a CRLF checkout every text file "differed", which made the old check fail for a reason that had nothing to do with the audit). This is the same distinction §6.1 of docs/interop/attestation-refs.md draws: "the check ran and failed" is not "the check could not have run". Collapsing the two is what turned a routine rebase into a red security gate. Tests: the tampered-pin case now asserts the frozen-commit rejection (the security property is unchanged — a mutated hash is still rejected); added a case pinning that post-freeze drift reports and exits 0. 11/11 pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Status
G4 preparation is complete; independent external Solidity review is still pending. This PR must not be represented as
External review completeor production-ready untilpnpm security:rcpasses with real external evidence.Change
AuditGrant: each grant now persists its origin Space and rejects cross-Space acknowledgement or revocation. Previously, the controller of another registered Space could revoke a victim grant, and an auditor could emit a misattributed acknowledgement.af5a75fb2db532fd5603554083d8895a825c2de2and immutable tagaudit/g4-rc1-source.security:scope,security:test, and the fullsecurity:rcrelease gate. The gate rejects self-review, weakened scope, path traversal, report mismatch, unmapped accepted findings, incomplete risk assessment, and unresolved Critical/High findings.AuditGrantaddress; no corrected deployment is allowed before G4 passes.Frozen evidence
af5a75fb2db532fd5603554083d8895a825c2de2f8d66277123391ea54de3f53842256e17e2a497ec9db7d27957c86386d8842687a2d009c0ca03bc864307e88cfed0ee25f3ae9bf307a52eb0bf512aea25565bf604d92fc6b1b2d64eb910595568a5f0c04aa6019audits/g4/README.mdaudits/g4/EXTERNAL_REVIEW_REQUEST.mdVerification
pnpm check: PASSpnpm audit --audit-level=moderate: PASS, no known vulnerabilitiespnpm conformance:clean: PASS at5ac1210969e199f29aef1211f76b6f37f35fd7capnpm security:rc: EXPECTED FAIL because external-review evidence is intentionally absentProtocol checklist
MemoryMarketis explicitly excluded from G4.pnpm security:rcpasses.Merge order
This PR is intentionally stacked on #9. Merge #8, retarget and merge #9, then retarget this PR to
mainand rerun hosted checks. GitHub Actions remain subject to the existing organization billing lock; local and clean-checkout evidence above is reproducible.