Repository navigation
docs(security): freeze external audit handoff - #13
Merged
Merged
Conversation
everest-an
force-pushed
the
security/g4-security-ready-rc
branch
from
August 2, 2026 22:46
31f4fbb to
463155c
Compare
everest-an
force-pushed
the
security/external-audit-handoff
branch
from
August 3, 2026 02:10
afcb2bc to
c8dbcd8
Compare
…the checkout Same correction already applied to the G4 scope gate. verifyPinnedFile and verifyAnchor each hashed a pinned file twice: once from the working tree and once from the evidence revision. Only the second is meaningful — that is the revision a reviewer fetches. Reading the working tree makes the result depend on the checkout's line-ending normalisation, so on any CRLF checkout every pinned text file "changed" and `pnpm security:handoff` failed with "Scope manifest current bytes changed" while git itself reported no difference at all. Since security:handoff is wired into security:scope, and that into `pnpm check`, the whole check was red for Windows contributors for a reason that had nothing to do with the handoff. verifyAnchor had a second, worse version of the same problem: it asserted the digest of the committed bytes and then returned `JSON.parse(currentBytes)` — the working-tree read. It verified one artifact and handed back another. If they ever diverged, every downstream assertion would be made against bytes whose digest was never checked. It now parses the bytes it verified. The path-existence check is kept: a manifest naming a deleted file is a defect, not drift. Tests: 15/15 pass. The three that were failing all traced to this one early exit — two of them were asserting later error messages they never reached.
everest-an
force-pushed
the
security/external-audit-handoff
branch
from
August 3, 2026 02:34
c8dbcd8 to
b49781a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Status
External audit handoff complete; qualifying independent report still pending.
This PR packages the frozen G4 candidate for an external Solidity reviewer. It does not claim that the external audit or G4 release gate is complete.
Change
security:handoffand four adversarial tests for source drift, missing evidence, and legacy-deployment misrepresentation.Frozen target
af5a75fb2db532fd5603554083d8895a825c2de2f8d66277123391ea54de3f53842256e17e2a497ec9db7d27957c86386d8842687a2d009c0ca03bc864307e88cfed0ee25f3ae9bf307a52eb0bf512aea25565bf604d92fc6b1b2d64eb910595568a5f0c04aa6019Verification
pnpm security:handoffpnpm security:scopepnpm checkafcb2bceee1155ed4ee1958a30b8e1dca6d00108pnpm security:rccorrectly remains blocked by the missing independent reportRemaining external requirement
A reviewer-controlled public report, exact report bytes, completed
external-review.json, finding dispositions, residual-risk mapping, and full-commit attestation are still required. The duplicate comments on issue #11 are recorded as provisional and are not accepted as completion evidence.Stacked on #10 so this PR contains only the external-audit handoff task.