From 13db3996d97ffbba44f065a5b5a1458c5cf4cf4b Mon Sep 17 00:00:00 2001 From: Cayce Date: Tue, 20 Oct 2026 02:22:36 +0000 Subject: [PATCH] =?UTF-8?q?audit:=20round-2=20response=20=E2=80=94=20findi?= =?UTF-8?q?ng=20->=20commit=20->=20test=20table=20(audited:=20post-merge)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- AUDIT.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/AUDIT.md b/AUDIT.md index 7e84478..c96a961 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -175,3 +175,31 @@ issues. All criticals and all mediums are fixed in **c9bd441** (PR #9): New audited commit: **c9bd441**. Gate at that commit: ruff 0 · 56/56 tests · alembic 0001→0002 · gitleaks `--all` clean · `make check` exit 0. Still open (declared): apply `roles.sql` on production, provision CI runner. + +--- + +## Response to audit round 2 — 2026-10-20 (PR #10) + +Round-2 audit closed findings 2, 3, 5 and the mediums; the remaining points +were re-implemented in PR #10, one commit per point: + +| Punto | Hallazgo | Commit | Test que lo prueba | +|---|---|---|---| +| 1a/1b/1c | firmas obligatorias atadas a contenido+deployment, completas en fila y audit | `40453aa` audit-1 | `test_signed_approval_mandatory_and_content_bound` | +| 1d | verificación al ejecutar/enviar/publicar; SQL-directo se rechaza y revierte | `40453aa` audit-1 | `test_sql_approved_row_is_refused_at_execution`, `test_unsigned_sql_approved_draft_is_refused`, `test_unsigned_sql_approved_item_not_published` | +| 1d | to_addr cambiado tras aprobar bloquea envío | `40453aa` audit-1 | `test_changed_to_addr_after_approval_blocks_send` | +| 1d | firma de otro deployment/contenido rechazada | `40453aa` audit-1 | `test_foreign_deployment_signature_refused` (executor+maild), `test_foreign_deployment_signature_refused` (publisher) | +| 1e | sin ramas `if approved_hash and ...`: binding obligatorio | `40453aa` audit-1 | cubierto por los tests de firma obligatoria | +| 1f | fallos de firma auditados desde el CLI | `40453aa` audit-1 | `test_approve_fails_audited_from_cli_wrapper` | +| 2 | clasificador: negación en el mail veta approval → needs_review | `903c591` audit-2 | `test_negated_approvals_never_classify_approval` (las 6 oraciones mandadas + 4 extra) | +| 3 | roles.sql: mínimo privilegio por daemon, trigger de aprobación, cayce_approver único, sin contraseñas literales | `d774091` audit-3 | `tests/integration/test_pg_roles.py` (PG real, ciclo completo por rol) | +| 4 | escrituras serializadas; génesis documentado; anclaje Nostr diario | `ffe4253` audit-4 | `test_concurrent_writers_keep_chain_verifiable`; legacy-genesis en `verify_audit_chain`; `test_anchor_signs_and_logs_once_per_day` | +| 5 | CLI de envío usa el código testeado; fallos auditados + daemon_runs; exit ≠ 0 | `56b35d3` audit-5 (nota: refactor dentro de audit-1, commit marcador) | `test_send_failures_audited_and_exit_code` | +| 6 | migraciones upgrade/downgrade contra Postgres 16 en CI | `c855f01` audit-6 | job "Migrations upgrade/downgrade round-trip (Postgres 16)" en ci.yml; ejecutado localmente contra Postgres 18.6 (reportado en PR) | +| 7 | unidad systemd para `publisher plan` | `3bde785` audit-7 | `deploy/systemd/cayce-ops-plan.{service,timer}` (diaria) | + +Gate en el commit auditado: ruff 0 · 65 unit tests + 1 integración PG · +alembic 0001→0003 con round-trip PG · gitleaks `--all` limpio · `make check` exit 0. + +Declarados abiertos (no resueltos aquí): aplicar `roles.sql` en producción y +provisionar el runner de CI — decisión y ejecución del operador.