From 61d5cfd67dfc1f67825320743523749270e542bb Mon Sep 17 00:00:00 2001 From: Cayce Date: Mon, 19 Oct 2026 23:07:17 +0000 Subject: [PATCH] =?UTF-8?q?audit:=20response=20section=20=E2=80=94=20all?= =?UTF-8?q?=20findings=20addressed=20at=20c9bd441?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- AUDIT.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/AUDIT.md b/AUDIT.md index 7e7fcfa..7e84478 100644 --- a/AUDIT.md +++ b/AUDIT.md @@ -155,3 +155,23 @@ docker compose up -d # or run each: uv run cayceops {scanner,executo - **Audited: d500d888701c3f1cd3305d098a448c3e20a8ad99** (merge of PR #7) - Gate at that commit: ruff clean (0 findings) · 44/44 tests · alembic 0001 smoke OK · gitleaks `--all` no leaks · `make check` exit 0. + +--- + +## Response to external audit — 2026-10-20 + +External audit verdict reproduced our gate and found 5 critical + 6 medium +issues. All criticals and all mediums are fixed in **c9bd441** (PR #9): + +| # | Finding | Fix | +|---|---|---| +| C1 | approval forgeable with any `--actor` | hash-chained `audit_log` (`verify_audit_chain`); optional-required operator BIP-340 signature (`CAYCE_OPS_OPERATOR_PUBKEY`); `deploy/roles.sql` least-privilege DB roles | +| C2 | mail threading dead (no OUTBOUND rows, inbound id overwritten, no first-contact) | sends create OUTBOUND rows (own Message-ID + In-Reply-To); inbound id untouched; `maild compose`; chain fallback in `_match_proposal` | +| C3 | duplicate sends on SMTP failure | per-message transactions; failures audited (`send_failed`), row stays queued | +| C4 | negated approvals classified as approvals; LLM prompt `.format()` KeyError | negation rules first (0.95 REJECTION); prompt braces escaped | +| C5 | systemd units ran nonexistent `run` subcommands | `run` added to all five daemons; `publisher plan` timer documented | +| M1-M6 | gate not self-installed; approved text unbound; `risk_score` misnamed/ordered; postgres 0.0.0.0; IMAP seen-before-commit; publisher noise/infinite retries | `make hooks`; `approved_hash` bindings; `match_score` (migration 0002) + relevance-desc; `127.0.0.1` bind; `\Seen` post-commit; `SKIPPED` terminal + attempt budget | + +New audited commit: **c9bd441**. Gate at that commit: ruff 0 · 56/56 tests · +alembic 0001→0002 · gitleaks `--all` clean · `make check` exit 0. +Still open (declared): apply `roles.sql` on production, provision CI runner.