Audit Register — brain-server

Working log of security/correctness/quality audits, findings, and the research each finding is grounded in. Each audit ships its gaps closed or carries them forward with a documented reason. The register is additive — older entries stay as the historical record, newest at the bottom.

2026-08-02 — v1.11.0 “Associate” pre-release audit (G1–G8)

Source: a post-v1.10.0 audit of the write-path AuthZ surface + dependency comments + config hygiene, performed before the v1.11.0 HippoRAG release. Research map at the bottom of this entry.

Findings + dispositions

G1 wiring detail (the “all write routes” pass)

The v1.2.0 AuthZ gate existed but had zero production callers. Every handler that mutates state or returns chunk content now calls handlers::authorize(&principal.0, Action::X, "", domain)? at entry. principal is OptPrincipal (an Option<Principal>); None = the v1.1 opaque-token / no-JWT back-compat path (superuser), so no existing install changes behavior. Enforcement binds only when a scoped JWT principal is present.

Notes:

• Modern handlers return a real HTTP 403 (HandlerError::forbidden). The three legacy /add-family handlers keep their {success:false} shape (HTTP 200 with error body) to stay shape-compatible — same choice the capacity guard already makes — documented inline at each call site.
• ingest_markdown + quarantine routes return a real 403 via the new AppError::Forbidden(String) variant added to src/main.rs.
• Read routes that return content (/suggest, /classify, /evaluate, /domains/{name}/export) are gated with Action::Read so a read-only principal can use them without a write grant.

G2 decision

Empty-scopes Some(principal) is now deny-all, NOT superuser. The None principal (opaque-token/no-JWT back-compat) stays superuser in handlers::authorize. Explicit superuser is the *:*/* scope (admin:*/*). Updated empty_scopes_principal_is_deny_all_not_superuser pins both arms.

G4 verification

The CORS layer (build_app in src/main.rs) exact-matches origin strings via AllowOrigin::predicate — no wildcard is ever honored by the layer. The only escape was a config foot-gun: CORS_ORIGINS=* silently matched nothing (a deployer would think it was open when it was closed). config::cors_origins() now strips the literal * at the single choke point; sanitize_origins is a pure fn pinned by two tests.

G5 correction

Three Cargo.toml comments corrected (no version bump — a rusqlite bump is a behavior-affecting change, out of scope for a comment-cleanup release):

1. # Database Stack - Verified Absolute Latest → documents the deliberate pin at rusqlite 0.38.0 (locked) and sqlite-vec 0.1.6 (resolves 0.1.9).
2. uuid comment claimed UUIDv7 jti minting; the code uses Uuid::new_v4() — corrected.
3. sqlite-vec pinned-version note corrected to match the lockfile.

G8 ponytail

StaticModel::from_pretrained at boot is the single source of truth for every embedding. A transient HF outage and a model-repo takeover present the same failure mode. ponytail: comment at the load site names the upgrade path: vendor the weights at install time and load from a local path (air-gapped Jetson already ships them separately).

Research map

Carried-forward gaps (G3/G6/G7 and the v1.9.1 carry-forwards) are tracked in IMPLEMENTATION_ROADMAP_v1.5_to_v4.0_EVIDENCE_GATED.md and the v2.0.0 Cortex milestone in ROADMAP.md.

Register — 2026-08-23 independent security audit (v1.28.8 line)

Single open-items register for the later audit series (the ATLAS F- / S2- / S3- / adversarial / MEMORY_STACK_REPORT entries are folded into CHANGELOG.md per release; this table is the live closure view). Findings F-*: audit BRAIN_SECURITY_AUDIT_2026-08-23.md; remediation per the 1.28.9–1.28.14 operator prompt.

Register — 2026-09-06 joint security audit (brain-server v1.28.62 × openclaw fork)

Single live register for the joint audit (BRAIN_OPENCLAW_SECURITY_AUDIT_2026-09-06.md, operator-held copy; fresh namespace X-, 41 findings). Dispositions below are the shipped-closure view at HEAD (v1.28.68): SEAM LINE rows closed per their release CHANGELOG § + release gates; the v1.28.68 row re-verified in this session against the audit’s cited source sites in the fork (the three §4.7 findings now carry the fixes at exactly the named seams) plus the e2e canary proof. Ship order .63 → .68 held.

2026-08-25 — v1.28.28 “Channel” third-pass deep hardening audit

Adversarial pass over the case-scoped channel surface (src/workflow/channel.rs, src/handlers/channel.rs, the case/% SSE drain, and the Channel DSAR arms), performed before release/tag. Method: OWASP Top-10 for LLM Applications v2025 (LLM01–LLM10) as the review frame + the 2025–26 agent-memory-poisoning literature (AgentPoison NeurIPS’24; MINJA arXiv:2503.03704; Memory Poisoning Attack & Defense arXiv:2601.05504; ConfusedPilot arXiv:2408.04870; TMA-NM non-malleable origin-bound memory authority; SMSR certified defense; MemAudit post-hoc attribution). Every disposition below is grep- or test-verified on the shipped tree.

Input-channel threat model (OWASP LLM01 auditor artifact)

Findings + dispositions

Research-grounded posture notes

• The literature’s consensus defense against memory poisoning is layered: write-time screening (shipped: one blocklist function per channel), provenance/origin binding (shipped: hash-chained audit per mutation, actor+target, tamper-evident chain + head pin), HITL gates for anything decision-shaped (steering stays approve-gated; notes carry no engine authority), and post-hoc causal attribution (shipped: per-note audit target note:{id} reconstructs authorship from the chain — the MemAudit goal).
• TMA-NM’s non-malleability ideal maps to the existing content_digest law (ReviewArmour) + audit head pin; no new machinery warranted this pass.
• SMSR’s result (“no provenance-free retrieval-time filter certifies against adaptive injection”) is why notes are fenced OUT of retrieval entirely rather than filtered INTO it.

2026-08-26 — v1.28.41 “Terrain” — the Conformance Line series close-out

Source: the series-exit gate (G8) of the v1.28.37→.41 Conformance Line — the full dogfood cycle re-audit of docs/CONTACT_CENTER_STANDARDS.md before the v1.29.x Console inherits.

Disposition of the line

Findings from the exit audit itself

Inheritance test: nothing in v1.29.x may backfill an Order-of-Care row — if it must, this line failed and this register says so.

2026-09-03 — v1.28.52 “Cornerstone” — the Foundation Line close-out report

Source: the line-exit audit of the Foundation Line (v1.28.46 “Plumb” → v1.28.52 “Cornerstone”). The line’s promise: handlers hold ZERO SQL, the service layer owns storage, and the law is machine-checked — “the repo has ONE pattern, CI-enforced.” This entry records the evidence, per the line’s executor contract.

AMENDMENT (declared up front)

The Cornerstone executor prompt assumed v1.28.51 shipped an EMPTY allowlist. It did not: gate.rs (the HITL proposal engine, 78 statements = 50 prod + 28 test) was Confluence’s declared straggler. Per the prompt’s own “Deviations = STOP + amendment” rule the executor stopped; the operator chose the AGENTS.md-prescribed path (option A): the final-vein extraction ran INSIDE v1.28.52 as its opening act, then the flip proceeded exactly as written. The extraction honored the line discipline — one surface per commit, full gate per commit, baseline row lowered in the same commit.

The final vein: gate.rs → service::gate (six commits)

Scope 1 — the enforcing flip

SQL_BASELINE (29 rows), the floor pin, and the substring-absorption machinery are DELETED — nothing is left to compare against. no_sql_in_handlers_enforced walks src/handlers/ RECURSIVELY and fails on ANY counted statement — production, test fixture, or comment residue (the substring counter is deliberately strict; the false-positive class the old baseline absorbed now has nowhere to hide, so drained files are reworded clean). Two anti-vacuity teeth: a ≥30-file sanity on the walk (the lipstyk lesson — a guard that scans nothing must not smile) and the sql_statement_counter_still_fires self-pin proving the counter still detects all four statement openers, comment residue included, with a negative control.

Scope 2 — the layer grep

service_layer_free_of_http_types (renamed from service_layer_is_transport_free at the flip) forbids axum, StatusCode, Json, AppState, Pool in production source under src/service/. It was born a hard error at the Plumb pin — there was never a warning phase — so the prompt’s “flip” is declarative: the name now matches the line plan, and both guards ride CI through the lint-test job’s cargo test steps (default + bench), alongside the inventory guard.

Pin + test counts across the line

HEAD arithmetic: 80 − 2 (baseline + floor deleted) + 2 (enforcing guard + self-pin) + 9 (gate.rs) = 89. The suite count moved 1268 → 1308 over the line and 1316 → 1308 across Cornerstone itself: the −8 is the drained handler-side test region (queue-read, export, and mirror pins moved onto the core where several were merged into REAL-path pins instead of re-stating column lists) and the deleted freeze machinery, against the +2 flip pins and the moved tests. Every milestone’s pins still pass at HEAD (full suite green, 0 failed). Count ≥ v1.28.45 baseline: YES (1268 → 1308).

Eval-floor history (v1.28.50 “Aqueduct”)

The line’s only retrieval-adjacent release gated EVERY extraction commit on the frozen 25-doc corpus (fresh scratch instance, CI recipe): pre-move baseline r@5 0.976 / r@10 0.991 / MRR 0.956; after the recall core commit identical; after the ingest core commit identical — byte-identical means AND per-query ranks on all 106 judged queries; floors (0.85) green at every gate. The honest scope: this proves behavior preservation on the frozen set, NOT external-engine parity (LongMemEval stays pending). Confluence and Cornerstone touch no retrieval path and re-ran no eval gate.

Smoke matrix per phase

Wire + schema identity (the line’s core proof)

• Routes: the registered route set is BIT-IDENTICAL v1.28.45 → HEAD (147 .route( registrations, sorted-diff empty).
• Route-authz gate table: the authz_gates_cover_every_non_public_route table is md5-identical across the line (201 rows); the pin bodies of both wire guards (authz_gates_cover_every_non_public_route, test_openapi_covers_routes) are md5-identical — the contract tables were not touched to make a move pass.
• openapi.yaml: ONE line differs from the v1.28.45 baseline — POST /ingest/proposal content.maxLength 2000 → 10000, shipped in Confluence commit b8cb52c together with the matching server bound (MAX_PROPOSAL_CONTENT = 10_000 replacing the borrowed MAX_QUERY = 2000 in the propose/edit paths). FINDING: that release’s “openapi.yaml diff-empty” claim is TRUE for routes and FALSE for this bound; the edit honored wire-contract discipline (contract + code in the same commit, the openapi-coverage test green) but was not declared in the release notes. DISPOSITION: declared here; the bound stays (widening is caller-visible but non-breaking, and reverting would break shipped callers); a docs_truth-style parity pin on the proposal bound is the follow-up. Every OTHER line release (46→47→48→49→50 and 51→52) is openapi diff-empty.
• Schema: schema_meta.schema_version still stamps 1.28.45 — untouched across all seven releases (no migration landed in the line; the line is storage-RELOCATION, not storage-CHANGE).

Cornerstone gates (this release)

fmt clean; clippy --all-targets --features bench -D warnings green; full suite 1308 passed / 7 ignored at HEAD (green at every one of the seven commits); enforcing guard + self-pin + renamed layer pin green; mdbook build green with the new architecture sections.

Ceilings (honest)

• The compliance-pack TEST RUN owed from Confluence is STILL owed before push (clippy green; the one-time full rebuild is the cost).
• The translation CAS’s decided_at = datetime('now') (SQL-side clock, inconsistent with every other branch’s bound parameter) is preserved VERBATIM and needs a pin or fix — filed, not changed in the move.
• The maxLength parity pin (above) is a follow-up.
• The line proves pattern singularity, not schema evolution readiness: the storage-adapter deadline trigger (pre-v2.x) is the next forcing function.

2026-09-05 — v1.28.57 “Capstone” — the Spire Line close-out report

The Spire Line (v1.28.54 “Scaffold” → v1.28.55 “Buttress” → v1.28.56 “Vaulting” → v1.28.57 “Capstone”) set out to dismantle the 19,906-line main.rs without changing a byte of behavior, and to make the end state IMPOSSIBLE TO UNDO QUIETLY. This report is the line’s measured before/after, re-measured at the tip with wc/grep — not from memory.

The before/after table

Per-milestone deltas (net main.rs lines): Scaffold −624, Buttress −1,191, Vaulting −5,820, Capstone −12,347. Nothing deleted: every test that ever lived in main.rs lives in the tree today — relocated, never removed.

What moved where (the module map)

• Scaffold (1.28.54): the ledger (src/spire_inventory.rs) + the route tables (src/route_guards.rs, born from arrays at main.rs ~L12k)
  • ten pure-unit pin families relocated verbatim to their subjects.
• Buttress (1.28.55): the pre-main library code stops pretending to be an entrypoint — src/http_limit.rs (RateLimiter, ConnectionTracker
  • RAII, connection/RSS watchdogs), the layer-1 blocklist + quarantine read-seam (src/screen.rs), the graph read mappers (src/graph_read.rs), the boot guards (src/boot.rs, folded into bootstrap at Vaulting) — each fn moved with its pins, ledger lowered same-commit.
• Vaulting (1.28.56): the monolith becomes the thin bin — middleware stack + auth middlewares → src/server/router/{mod,auth}.rs; app(state) → src/server/router/mod.rs as a pure function of AppState; the whole boot region → src/server/bootstrap.rs (protocol-free); six family builders (core 17 / memory 56+3 legacy+1 GiB import / ump 12 / compliance 10+5 gated / workflow 82 / auth 9); THE LIB FLIP (the server tree behind lib.rs, main.rs consumes brain_server::server::…); the law-9 authz matrix → tests/authz_matrix.rs driving the lib from OUTSIDE the crate; law-13 contention gauges on /metrics + /health.
• Capstone (1.28.57): the test mass (12,294 lines, 109 plain + 60 tokio fns) → tests/main_suite.rs verbatim (include_str anchors re-pointed CARGO_MANIFEST_DIR-absolute; the root use-block traveled with it so use super::* resolves exactly as before); route_guards.rs re-homed to src/server/router/ (100% rename, content unchanged); spire_inventory.rs stays beside main.rs — its subject.

The enforcement map (which gate guards which law)

Every scanner is self-pinned inline (the Cornerstone lesson: a counter that cannot fire guards nothing) — each gate proves, inside its own test, that it counts a planted violation string in a comment and stays quiet on clean source.

Capstone gates + validation

Two grep gates born hard (no warning phase, the Foundation precedent), each red-proofed against a planted violation BEFORE its green commit: the route gate caught a planted registration comment in src/config.rs naming the file; the protocol gate reported [axum::, Router] on a planted axum comment in bootstrap.rs. Both plants reverted. En route the route gate flagged its own doc comment carrying the needle literal — rewritten; the gate polices even its documentation.

Full suite 1,265 passed / 7 ignored (–features bench) at the tip, green at every commit; clippy -D warnings (bench) clean; fmt clean; CI dry-run green (default lint+test, engine-crates, steward-harness, otel lint+test); lipstyk diff-strict green vs the v1.28.56 tip; live smoke on the COPY instance green (/health, /audit/verify ok, the 413 + 408 paths, one ingest → recall round-trip).

Ceilings (honest)

• src/bin/mcp.rs keeps its own router: the MCP binary is a separate protocol edge, not the server’s composition. The carve-out is fenced (exactly one site) and recorded here; folding it under src/server/router/** would be a behavior-adjacent refactor the line’s no-behavior-change rule forbids.
• tests/main_suite.rs is one ~12k-line file: the mass moved as ONE verbatim block (exact-text relocation, zero churn in the pins); splitting it per-subject is churn without a forcing function.
• The ≤ 300 pin is a pin, not a proof of minimalism: main.rs could grow to 299 lines of wiring noise and pass. The gate that matters is the route gate — registrations cannot come back.
• The Capstone ledger numbers (124 lines, 1,198 pins) drift by doc-comment literals under the substring needles — the needles are measured identically every time; that is what a freeze needs.

2026-09-08 — v1.28.69 “Deadbolt” — the SEAM LINE close-out (skeleton)

The SEAM LINE (v1.28.63 “Wardline” → v1.28.69 “Deadbolt”) was the remediation program for the 2026-09-06 joint audit’s code-closeable findings: the seven releases that break a documented security law or open a model-context seam. This skeleton is the re-load anchor for the REGISTER LINE (v1.28.70 “Twokeys” → v1.28.75 “Preflight”, the program that closes everything else in the ledger): each section below states what is measured now and what the Register Line must re-measure before it opens.

The finding → release map (as shipped)

What the line proved (re-measure at Register Line open)

• Every audit law that was code-false is now code-true and PINNED: the reserved-vocabulary gate (Wardline), revocation-before-authN (Blackout), the content doors (Meridian), the approval/truncation truth (Truthglass), tool + signer identity (Pin), the egress seats (Shutter + Deadbolt).
• The one WIRE break in the whole line: parcels expected_signer becoming required (Pin). Schema untouched throughout (1.28.45 → REGISTER-LINE-OPEN value). openapi additive-only throughout.
• The drill discipline held: Meridian’s end-to-end injection proof, the Pin rug-pull demo, Deadbolt’s four-leg boot/crank/PATH drill — each release carried a live transcript, not just pins.

Register Line pre-flight checklist (what .70–.75 must carry in)

• Re-run the full ledger (§4 of the 2026-09-06 audit) against the .69 tip; re-verify each REGISTER-line finding still exists as described (X-A4, X-A5, X-R2..X-R4, X-R6..X-R7, X-W6, X-W7, X-W8, X-L4, X-C3..X-C6, X-C8, X-E5, X-S2, X-F3).
• Carry the ceilings forward honestly: allowlists are trust, not safety (Shutter); the hostcall path’s loopback exception is operator trust (Deadbolt); pins are process-lifetime (Deadbolt); screen-is-a-heuristic stands even post-Pores.
• Ops debts riding along: the openclaw-side token purge (paused), the review-posture flip at install (Preflight), the SBOM refresh (Preflight).

SEAM + REGISTER PROGRAM CLOSE-OUT — 2026-09-08 (v1.28.75 “Preflight”)

The 2026-09-06 audit’s findings ledger (§4, namespace X-) is fully dispositioned. Two lines closed it: the SEAM LINE (v1.28.63–.70) and the REGISTER LINE (v1.28.70–.75). This release is the program’s exit gate: the 1.32.x Loop line may open, with the inherited preconditions named in CHANGELOG §[1.28.75].

Findings ledger × disposition (55 findings; the plan’s “41” undercounted — all are dispositioned)

Exit-gate drill (the four headline exploits, re-run at the close-out commit — all fail closed)

1. channel/out forge via the events route → REFUSED. Pins: enqueue_child_refuses_reserved_topics, reserved_vocabulary_semantics, reserved_refusal_converts_to_loud_sql_error — green.
2. Steering launder via the same seam → REFUSED (same reserved vocabulary covers steering) — green.
3. Revoked principal on a non-mesh route → DENIED. revoked_principal_cards_fail_closed + revoked_owner_no_new_dispatch — green (probe-blind 401/403 + dispatch re-check).
4. Poisoned-memory canary (tag-encoded instruction + forged <active_memory_plugin> markers + image URL) → screened/fenced/stripped: meridian_canary_screen_verdict_unchanged (the read-seam division of labor holds), the fence welding pins (wrap_fenced_blocks_control_char_welding, wrap_fenced_blocks_invisible_near_markers), and the .71/​.74 label pins — green.

Per-release test deltas (REGISTER LINE)

Live-proof transcripts: the .65 fence canary (docs/MERIDIAN_PROOF_20260907.md) and the .74 origin canary (per-tree test pins; the live group-chat drill is the Loop line’s opening act — its inherited preconditions are hardened dormant mediation + the dormancy pin to delete on wiring, review-by-default installs, pinned signers, origin labels).

SECOND-PASS AUDIT ADDENDUM — v1.28.76 “Selfheal” (2026-09-09)

The program close-out above covers the 2026-09-06 audit (X- namespace). A second-pass audit — same trees, harder questions, fresh SP- namespace — then re-attacked the closures themselves. Full report is this addendum (previously docs/SECOND_PASS_AUDIT_20260909.md, now consolidated here).

Result: 30 fresh findings (5 HIGH, 12 MEDIUM, 9 LOW, 4 INFO) across both trees. v1.28.76 closes all 5 HIGH and 7 MEDIUM; the remainder are LOW/INFO or scheduled. The five HIGH classes, for the record:

1. Read-seam strips healed under re-assembly (2 HIGH): <scr<script>ipt> re-welded into a live <script> after the element strip; nested markdown constructs healed into auto-fetch images after the dereference. Fixed by bounded fixed-point iteration (strip_to_fixpoint, strip_markdown_refs_does_not_heal_nested_construct, hostile_element_strip_does_not_heal_nested_tag).
2. The fork’s .66/.67 halves were never shipped (HIGH, openclaw): approval-args, head+tail truncation, and MCP catalog pins were local branches. Merged to fork main 2026-09-09.
3. Compute bounds missing on the model seam (HIGH+MED): the ONNX scorer serialized all screened writes behind one mutex with no sentence/size budget; the embedder encoded full-size content. Budgeted (embed_input_is_budgeted).
4. Gate reach: the identity kill-switch missed /auth/refresh and the console actors; the MCP read-scope gate missed ump.feedback; the live SSE stream leaked valet/due labels; the X-W4 valet fence missed the CAS state-advance path. All closed (refresh_refuses_revoked_identity, valet_due_requires_optin_and_domain_authz, live_event_admissible).
5. Docs drift: THREAT_MODEL frozen at v1.28.68, SECURITY.md history at v1.28.17, plugin changelog gaps. Swept in v1.28.76.

Lesson recorded: a first-pass closure is where the work starts. The second pass found the seams the first pass’s own fixes created — which is why the trust walkthrough exists and why the audits keep running.

Per-release delta: CRATE_TEST_FLOOR 1,358 → 1,372 (v1.28.76, incl. the Origin-line and second-pass pins). The plugin rides at 0.6.1 (schema-declared untrustedOrigins).

2026-09-10 — third-pass fork-vs-upstream audit (v1.28.79 “Parity”)

Full records kept with the audit archive (THIRD_PASS_AUDIT_20260910.md, UPSTREAM_PR_SPECS_1.28.79.md); this entry is the summary. Scope: the 92-file upstream/main...fork delta across three lanes (auth/secrets, content-trust, egress/persistence) plus direct verification of every load-bearing claim. Every finding’s file classified against upstream/main: fork-only files got code, upstream files got PR specs — zero upstream hunks.

Findings + dispositions

Corrections to the pass’s own claims: the DSAR webhook posts metadata only (not the bundle); refresh-family burn is the OWASP pattern; INJECTION_POLICY=allow is loud by design. KCS-draft screening recorded as a v1.28.80 follow-up (needs lifecycle design, not a guard).

2026-09-11 — deep round (all-layers, fork-diff, docs reverse-check)

Four parallel audit lanes (server auth/seams; storage/crypto/egress/workflow; fork-vs-upstream diff; docs reverse-truth) over v1.28.81 (e39e285) + the fork (73 ahead / 10 behind upstream/main, git merge-tree CLEAN). The earlier threat-landscape round’s eight findings all closed under verification (addendum in research/security-compliance-audit-2026-09-11-threat-landscape.md).

Findings + dispositions (all code fixes landed the same day)

Validation

Lib 1,202 passed / 1 ignored (pre-existing HF-fetch ignore); all 13 test binaries green; cargo clippy --all-targets clean on bench + otel + default feature sets; cargo fmt --check clean; cargo audit exit 0; lipstyk diff-strict clean; fork suites green (pins 11/11 incl. the new env-ack pin, plugin 187/187); fork git merge-tree HEAD upstream/main CLEAN with ZERO upstream-tracked files touched by this round (the three fork edits live in fork-only files: extensions/brain-server/src/config.ts, agent-bundle-mcp-catalog-pins.ts + test). No schema; no routes; wire behavior tightens only (400s on over-bound inputs, tenant-scoped drains).

Ops adoption (same day): the live deployment now runs BRAIN_REQUIRE_AUTH=1 (plist env, bootout/bootstrap reload, verified /health/db → authn.required:true, no-token 401, agent-token recall 200 — the gateway plugin path unaffected). The deployment runbook carries the loopback-posture checklist (docs/deployment.md §Loopback posture).

ponytail: this round does NOT implement the OTLP guarded exporter client, does NOT gate MCP tool first use, does NOT build the taint lattice, does NOT add per-principal quotas, and does NOT touch any upstream-tracked fork file.

2026-09-12 — Fourth-pass full-spectrum audit (v1.28.82 × fork)

Dual-mode (forward + reverse) solo execution after the planned five-lane parallel spawn failed (usage limits — disclosed in the report’s §0). Full report: docs/SECURITY_AUDIT_20260912_FOURTH_PASS.md. Live drill on a fresh DB / test port 9876 (canary welds dead at the seam, quarantine excludes from recall+suggest, kill-switch 401 live, digest approve 409 live, DSAR cert honest, erasure verified at table level). Register-worthy findings:

Mode B verdicts (held): cross-tenant drain scoping, traverse exact-kind, provenance unknown-field rejection (14 tests green), RFC 8215 row, OWASP-2026 citation (live-verified against the GenAI repo), plugin 0.6.5 byte-parity across repos, auto-update EdDSA signatures, badges selfcheck. Gates in-window: fmt, lib 1202/0/1, main_suite 196/0/6, targeted pins — all green; clippy/otel/side-lanes not run (green at release). Outstanding lanes honestly marked in the report’s coverage grid (§7): the five subagent sweeps, fork hunk-audit, full worldwide regulatory matrix (CT leg verified 2026-09-12 vs official PA 26-15; CRA Art 14 primary text CLOSED same day — 24h/72h/14d + 11 Sept 2026 live date).

Closure record — 2026-09-12 (same-day remediation pass)

All six registered findings closed; the fork finding verified closed by the operator’s rebase. Every fix carries a red-first pin and a live re-drill where the finding was drill-proven. Full evidence in docs/SECURITY_AUDIT_20260912_FOURTH_PASS.md §3 rows.

Gates at closure: fmt (server+client) green; clippy --all-targets -D warnings green; lib 1204/0/1 (+2); main_suite 199/0/6 (+3); client 240/0 (+1); openapi + docs_truth + comment-hygiene guards green; lipstyk-gate green (real base); badges selfcheck green. Fork: plugin lane 189/189, parity restored (plugin/src ↔ extensions/brain-server/src byte-identical, fixtures synced). House-discipline note: the comment-hygiene guard caught audit-ID labels in the first draft of the fix comments — removed (the guard’s own law applied to this remediation).

Plugin 0.6.6 parity sync — 2026-09-12

The P4-01 fixture shipped as plugin 0.6.6 (test/fixture only, no runtime change): CHANGELOG + README updated, scripts/sync-plugin.sh run (oxfmt canonical-first, byte-identity verified post-sync), fork committed as ab2b81486e4 (fixtures + format.test.ts lane + the fork-host lane src/infra/unicode-visibility.fixture.test.ts). Fork gates at the sync: vitest 188/188, tsc --noEmit clean, diff -rq byte-parity OK. The fork’s uncommitted pnpm-lock.yaml typebox hunk (1.3.18→1.3.26 vs the 1.3.3 manifest pin) remains the operator’s K4-02 decision, untouched.

2026-09-12 (evening) — Fifth-pass full-spectrum audit (v1.28.82 + closures × fork)

Second audit of the day; five parallel lanes all completed (server / satellites / claims / fork / regulatory). Full report: docs/SECURITY_AUDIT_20260912_FIFTH_PASS.md. All six fourth-pass closures re-verified HELD in code and live (fresh DB, test port 9879: typo revoke → 400 naming agent@loopback; loopback revoke → 200 → agent 401; forget → retained_proposal_copies + scrubbed). But the F4-S-01 closure carries a HIGH availability regression: unknown_principal refusal fires for never-seen JWT subs too, so 7/22 authz_matrix tests fail and main is RED (release.sh blocks tags — unreleasable until fixed).

Mode B: all six closures’ pins revert-tested behavioral (not vacuous); weld/approval/provenance/egress/twokeys attacks all failed (HELD). Parity rebuilt (plugin 0.6.7 byte-clean; typebox 4-way aligned). Regulatory: L4-01 closed; US/EU core rows re-verified vs primary sources; component-vs-deployer split preserved. Gates: authz_matrix RED (7); fmt/client-fmt/badges green; drill green. Main is red: fix A5-01 first.

2026-09-12 — v1.28.83 “Recall” SHIPPED (fifth-pass fix release + untagged fourth-pass closures)

Range v1.28.82..v1.28.83 (15 commits: 9 fourth-pass closures never tagged + 6 fifth-pass fixes; fork lane 60fb64b6aea in ~/Sites/openclaw). Every fifth-pass finding CLOSED; full record with proof commits per bullet: CHANGELOG.md §[1.28.83] (complete 1.28.82→1.28.83 account, superseding the split “fifth-pass + carried closures” draft).

Gates at ship: cargo test --features bench,migrate 1,537 passed / 0 failed (1,526 at .82 + 11: 5 fourth-pass cargo pins + 7 session pins −1 removed seam-identity pin; reconciled per-target against a tag worktree); authz_matrix 22/22; clippy bench + default -D warnings clean (the default lane caught a type_complexity on the new forget 4-tuple — fixed via named alias before ship); fmt (server+client) clean; comment-hygiene guard green (8 new src comments de-labeled); badges.sh --selfcheck clean; SBOM sbom/brain-server-1.28.83.cdx.json committed; CRATE_TEST_FLOOR 1,381 → 1,418 (stale since .77, honest catch-up); live drill on the release build all legs green; diff -rq plugin/src ↔ fork extension clean. Lipstyk + otel/engine-crates/ steward lanes: see release checklist (run before push per AGENTS.md). NOT tagged/pushed here — scripts/release.sh (CI watch, fail-closed) is the operator’s step.

2026-09-13 — Seventh-pass full-spectrum audit (v1.28.85 × fork @ 94d5de789c3)

Full report: docs/SECURITY_AUDIT_20260913_SEVENTH_PASS.md (all five lanes completed: server-layers, satellites/supply-chain, Mode-B claims falsification, fork diff + rebase-survival, worldwide regulatory web-verification — plus a live drill on a fresh DB / test port and the §4 four-tree parity matrix). IDs *7-*. Theme of the pass, from the evidence: the machinery is strong; the seams added after the law are where the gaps live — ratchet erosion in miniature, plus a class the .75 vacuous-pin lesson predicted: defenses built, fixture-tested, and never wired.

Held (the honest other half): 30+ claims falsification-attempted static (weld families, opaque strips, 64-pass overflow fail-closed, JWT algs, constant-time compares, egress IANA rows, redirect policy, insert-only pins, AgBOM, spire arithmetic 169=152+13+4+8 exact); live drill green on digest-bound approvals (409/200/404-replay), revocation kill-switch (write 401 + SSE 401 pre-stream), quarantine exclusion, DSAR certificate + digest-only tombstones (physical residue = the documented secure_delete off ceiling, disclosed on the certificate), audit-chain census, /ready JSON posture; tamper demonstration confirmed the X-C5 host-compromise ceiling’s shape (business-row tamper behind the chain undetected — T7-02 docs note); four-tree invisible-set parity HELD (exhaustive fixture), plugin↔fork byte-identical at 0.6.8; fork hardening survived today’s 614-commit upstream rebase on every reachable path; 5 of 6 sampled pins BEHAVIORAL; supply chain fresh (SBOM 375/375 match, typebox pinned). Gates: fmt/clippy bench/test bench/clippy default/test default/ client fmt/lipstyk(base=v1.28.85) ALL GREEN. Remediation: v1.28.86 “Attrbane” → v1.28.87 “Ownerstamp” → v1.28.88 “Clocktruth” → v1.28.89 “Bounded”, floor +13 (1,448 → 1,461 walk-estimate). Ceilings: drill legs b/c (fork-gateway session, console GUI) not driven live; compliance-map rows beyond reg_watch dates spot-checked only; per-lane coverage notes in the report.

2026-09-15 — v1.28.91 “Notary” — the operator-held evidence pair

Operator-directed closures of two standing disclosed ceilings; no pass ran (the seventh pass’s remediation line was complete; this release is the follow-through on the residual-risk review, not an audit’s findings).

2026-10-04 — v1.29.2 eighth-pass full-spectrum audit (F8/D8/R8/P8/K8/S8/L8/T8)

Report: docs/audit8/ (9 files). Scope: brain-server v1.29.2 HEAD e9c71919 × openclaw fork 1d2d29b22 (0 behind / 90 ahead, plugin 0.6.10). Fresh eyes — prior reports not read.

Note on the brief’s framing. The commission described this as the fourth pass at v1.28.82 "Vigil", 2026-09-12. Measured: HEAD is v1.29.2 / e9c71919, schema 1.32.25, today is 2026-10-04; the fourth-, fifth- and seventh-pass reports are already committed. The target report path was also already occupied, so this pass writes to docs/audit8/ rather than overwriting a colleague’s work. The “gap ledger zero” claim the brief asked me to attack had already been retracted upstream at v1.28.87 → “balanced (4 known residuals with owners)”, with a gate enforcing the wording (grep -rn "gap ledger zer[o]" CHANGELOG.md docs/ → 0 hits).

Findings + dispositions

Verified HELD (the honest good news)

The anti-vacuity sweep found ZERO genuinely vacuous pins. Every suspicious shape was defended — soft_handoff_threshold_is_not_decorative (absence pin, defended three ways), sql_statement_counter_still_fires (exemplary, 10 cases incl. the negative), the read-seam fixture pins, handler_body_ignores_comments_naming_the_symbol. The exec_spawn_carries_kill_on_drop lesson was learned. Four of the five spire guards are not gameable.

Drill-verified live (fresh DB, port 18765, live DB SHA-256 identical before/after): write-time screen + human-in-the-loop enforced · read seam stripped the tag block, welded script, image-exfil URL, onerror and bidi override · untrusted: true carried · digest-bound approval rejected a wrong digest with 409 and replay returned 404, never double-applied. The forged host-fence tags that survive the server are neutralized downstream by the fork’s ZWSP-split merge seam — defence-in-depth verified, not assumed.

Sixteen claims HELD against direct attack, including provenance marks (behavioural pins, not string matching), revocation reach including mid-stream SSE, alg:none/HS* rejected before key lookup, and the audit-chain ceiling stated precisely rather than overclaimed.

Gates — all executed at e9c71919

Full suite 3122 passed / 0 failed / 3 ignored · clippy bench/default/otel exit 0 · fmt + client fmt exit 0 · crates 308/0 · steward-harness 44/0 · lipstyk exit 0 (verified against a real code base after it correctly refused to pass vacuously on the docs-only HEAD) · badges selfcheck · env-truth · doc-links (404 resolve) · docs-truth · cargo audit exit 0 on all four lockfiles (one yanked-crate warning, yoke-derive 0.8.3 in the Tauri shell).

Carry-forward ceilings (this pass)

• The fork’s red-proofs were not executed — every “test that fails on deletion” cell is derived by reading tests, not by deleting the hardening. Largest gap in the report.
• 11 regulatory items unverified, including the CRA Art 14 clocks — the repo’s most-cited legal claim. Each has a named next check in docs/audit8/06-regulatory-matrix.md §7.8.
• Concurrency is the weakest dimension — no lock-ordering cycle analysis over the ~19 Mutex/RwLock sites; FTS/vec bloat, metric cardinality and single-mutex inference behaviour unmeasured.
• No live surface touched; no file in either repository modified.

2026-10-06 — Ninth-pass full-spectrum audit (F9/S9/P9/K9/D9/L9/R9/T9/W9)

Executed at ea286449 (R76 tip) over docs/SECURITY_AUDIT_20261006_NINTH_PASS.md — six parallel arms (server core, satellites, Mode-B claims, fork, regulatory, 2026 landscape) plus an orchestrator-owned live drill (fresh DBs, ports 18976–18978) and three EXECUTE-LATER probes run to completion. The drill overrode a static verdict twice: R9-01 (filed WEAKENED statically, REFUTED live — the approve digest binds raw drift the reviewer cannot see, fail-closed), and the orchestrator’s own first recall check (vacuous on 0 hits, caught and re-run). 29 finding rows; no HIGH in the server core — the HIGH sits in the fork’s packaging.

Re-verified this pass, still open, unchanged: S8-07 (islands — corrected census: 3 genuinely unconsumed: aftersales, care, interview; troubleshoot HAS a consumer in steward-harness), F8-02 enforcement decline, F8-03 idempotency residual, D8-02 gate-law register, K8-01 (sharper — the substring skip also disables sanitizeExternalContentText: invisible-strip AND image-strip off at once on read/exec/transcript), K8-03 (shared by the MCP path), K8-05/06 (narrowed), K8-11 (split; node lane same-origin checksum), D8-01, L8-04/05/06/07/11.

Drill-verified HELD (no rows owed): read-seam neutralization (tag block, nested + mixed-case welds, onerror, markdown weld, bidi — live wire diff); quarantine list/release; digest-bound approve + replay refusal (404, no double-promote, count 2→3 once); parcels tamper → 400 signer_mismatch; DSAR purge reaching promoted proposals (proposals→0) with zero db+wal residue and backup retention matching the certificate’s own caveat; suggest untrusted:true + provenance.reason:anticipated; /auth/refresh 404 jwt_unavailable in opaque mode (posture fact).

2026-10-06 — Tenth-pass full-spectrum audit (F4/D4/P4/K4/L4/R4/T4)

Executed at fecfeac0 (v1.29.3) over docs/SECURITY_AUDIT_20261006_TENTH_PASS.md (untracked, as every audit report since the ninth pass). Five parallel arms — server core, satellites/CI/supply-chain, Mode-B claims falsification, fork diff, regulatory sweep — plus an orchestrator-owned pass: the A1 comprehension artifacts (layer map, trust boundary, five inventories), the four-tree parity matrix rebuilt from scratch, and two reconciliations where a subagent’s verdict was overturned by re-running its attack myself (§ errata in the report).

The tenth pass’s theme: not a missing control — a control whose enforcement point was never exercised. Nine passes closed controls; what survived is a wrapper nothing calls, a value arm unreachable through the tokeniser’s grammar, a posture flag read by presence, and rung 3 of a three-rung ladder. Two register rows this pass falsifies (K9-01, and R9-02 via B4-01) and one re-opens a register’s own premise (K8-01, sharpened).

This charter repeated the ninth pass’s own defect, recorded as T4-01-adjacent truth: T9-01 closed “the execution charter’s §1 baseline was 8+ releases stale and its deliverable filename collided with the existing FOURTH_PASS report”. The tenth charter was issued from the same template and carried the same stale baseline (pinned v1.28.82 / 2026-09-12 / “you are the FOURTH pass”) against a measured v1.29.3 / 2026-10-06 / ninth-pass-closed tree, and the same colliding filename. The fix for T9-01 was applied to one charter; the class is unclosed. The deliverable was renamed …_20261006_TENTH_PASS.md and added to .gitignore in the same act, because .gitignore lists each audit report explicitly — a new one is NOT covered by the existing lines, so writing it without that edit would have shipped a private audit report with the next release tag (the R77 privacy failure, re-armed).