archy/docs/security/2.1-beta-audit-acceptance-matrix.md

2.1 Beta security audit disposition and acceptance

Source qualification checkpoint, 2026-11-09. Audit input remains the unmerged AUDIT-2.0.3-alpha.md at 351fd8bf9bdfadb2ea72d9c7ff49d03fa370a892. Combined source is bd28160932b568c748b4e429b74087199397da43. The security-only review excludes the separate native AIUI, Companion media and VPN proposals; combined UI evidence below is explicitly labeled. No release version, signed artifact or main ref was changed. The separate 2.0.4 work must be incorporated from accepted canonical refs before eventual release integration.

Current source regressions pass, including the final isolated backend suite. This is not security clearance or release approval. Maintainer UX is next; actual app-image compatibility, migration, signing/provenance, Docker, firmware, physical devices and installed-node acceptance remain the explicit gates below. Earlier failures are retained alongside the passing evidence.

Finding	Disposition in the pinned source	Available focused evidence	Outstanding source qualification	Later manual/runtime/artifact gate
P0-1: node-key backup export	Onboarding gate runs before key access; a valid session cannot reopen the legacy endpoint after provisioning. Shared provisioning transition prevents an admitted request crossing setup. Identity/peer, sessions.	HTTP refusal, fresh backup/restore and provisioning regressions are included in the passing r6; see E5.	Record final backend receipt after the two r5 failures are dispositioned (E5).	First-run/restore UX and deployed HTTP/HTTPS/Tor/FIPS refusals. Any future post-setup export needs its own fresh-proof flow.
P0-2: node signing oracle	Same onboarding and transition boundary closes legacy chosen-message signing after setup.	Cryptographic verification, refusal and transition regressions are included in the passing r6; E5.	Final backend receipt (E5).	Verify deployed refusal and legitimate onboarding. A future proof-of-control protocol needs purpose-bound authorization.
P0-3: public DWN	/dwn and descendants return 410 before buffering/storage; unprotected sync client removed. Owner RPC authorization remains. Identity/peer.	HTTP refusal/store-preservation and owner authorization regressions are included in the passing r6; E5.	Final backend receipt (E5).	Confirm signed federation remains functional over actual transports; review disabled-sync UX.
P0-4: peer trust mutation	Signed destination-bound envelopes, expected key/onion and one-use correlation are mandatory. Exact retries preserve lifetime; owner accept/reject share the store lock. Peer inventory uses strict, serialized atomic replacement; active/archive storage is bounded. Peer storage.	Signed request, replay, retry, expiry, evidence and concurrent-store regressions are included in the passing r6; E5.	Final backend r6 passed (E5); retain crash/refusal evidence and ignored-test dispositions.	Two-node Tor/FIPS and mixed-version compatibility; connected-node UX. Legacy unsigned peers cannot use a bypass.
P0-5: OTA signature stripping	Release-root verification is mandatory at discovery/download/staging/activation for ordinary and OS updates; stronger OS admission remains. Implementation, commit 442512e87.	Signature admission regressions are included in the passing r6 (E5); E4 source-binding fixtures pass.	Final backend r6 passed (E5); actual signed release bytes remain the separate artifact gate.	Qualify genuine signed component bytes, immutable provenance, OTA/rollback/reboot and installed behavior on the selected candidate.
P0-6: catalog downgrade/fallback	Catalog verification is mandatory; external browser/proxy unsigned fallbacks removed. Previously verified data is preserved on refusal. Implementation, candidate procedure.	Catalog regressions are included in the passing r6 (E5); E4 fallback checks and E10 full dashboard suite pass.	Final backend r6 passed (E5); refreshed signed catalog bytes remain the artifact gate.	Re-sign edited catalog payloads; verify actual served/cache bytes and install UX. Old signatures do not authenticate edited catalogs.
P0-7: image authenticity/TLS	Both runtime pull paths and first boot require immutable image identity, a pinned verifier key and successful verification; empty/placeholder claims and registry TLS bypass fail closed. Image gate.	E2 admission/TLS/verifier fixtures and E4 first-boot checks pass; integrated backend result is E5.	Final backend receipt; real cryptographic image qualification remains open. Stub-verifier success is not authenticity evidence.	Open: actual signing ceremony, cosign/key provisioning, signed digests, registry/mirror TLS and signature retrieval on both runtimes. Placeholder images remain blocked.
H-1: shared app credentials	PhotoPrism/Grafana use per-install generated secrets. Existing-account rotation uses a journaled native API flow with fresh proof; data and lifecycle decisions are preserved. Credential migration.	E2 manifest/secret-reference checks pass; migration/API regressions are included in the passing r6 (E5).	Final backend r6 passed (E5); operator migration acceptance remains separate.	Pinned app images and existing-data migration with unchanged users/photos/dashboards; maintainer UX. No live credential rotation has occurred.
H-2: public identity creation	Public only during fresh onboarding; provisioned requests require session, admin record, origin and CSRF. Provisioning is serialized with creation. Identity/peer.	HTTP fresh/provisioned/session/role/CSRF/origin and transition regressions are included in the passing r6; E5.	Final backend receipt (E5).	Onboarding and identity-management UX; deployed authorization checks.
H-3: at-rest claims	Documentation now distinguishes plaintext mode-0600 identity keys, ciphertext with colocated keys and random-key manager records. No hardware-backed confidentiality is claimed. Actual boundaries.	Boundary correction is documented; this is not a new cryptographic protection.	Review recovery instructions and threat-model claims; separately decide any keyring/hardware-envelope redesign.	Protect complete-disk and backup custody; qualify restoration. Root/full-disk disclosure remains outside these local-file protections.
H-4: path-derived secret key	Random protected per-store key and authenticated versioned envelopes replace deterministic encryption. Migration validates before replacement and resumes interrupted mixtures. Migration.	E1: 17/17, including independent/wrong/corrupt/missing keys, custody refusal and resumed migration; integrated run E5.	Final backend r6 passed (E5); actual backup and moved-store recovery remain operator gates.	Actual full-backup restore, moved v2 store and operator recovery with matching protected key. Other app-secret stores are not implicitly migrated.
H-5: fresh funds/signing proof	Central session/method/parameter-bound one-use grants enforce policy; password/TOTP are consumed atomically. Explicit pre-dispatch refusal drives one guarded UI retry; ambiguous payment failures never replay. Fresh proof, UAT.	E3 focused UI and E10 full dashboard checks pass; grant/TOTP/capability regressions are included in the passing r6 (E5).	Completed: final backend r6, with earlier failure disposition retained (E5).	Maintainer password/TOTP/cancel/error UX, including signer broker and app credentials; separately authorized funds scenarios. Paid-file recovery must never repay.
H-6: remembered-session revocation	Durable remembered families, logout/credential/device revocation, original authentication lifetime and restart policy are enforced. Atomic account writes and guarded signer finalization close transition races. Sessions.	E3 authentication UI and E10 dashboard suite pass; session/app-gate/signer/race regressions are included in the passing r6 (E5).	Final backend r6 passed (E5); do not treat 27 ignored backend cases as passes.	Browser/app-gate/Companion logout, re-pairing and policy changes across real restart; legacy cookies require fresh sign-in.
H-7: resource exhaustion	Streaming body caps/deadline, reserved validated-session admission, anonymous memory budget and independent GET health. Telemetry reserves local capacity, retires eligible remote records and preserves bounded migration evidence. Availability policy.	Body-admission, saturation/recovery and telemetry/evidence regressions are included in the passing r6; E5.	Final backend r6 passed (E5); controlled deployed load remains a runtime gate.	Controlled deployed load, uploads/fleet UX and operator-maintenance handling; no production flood qualification claimed.
H-8: AIUI origin boundary	Native Chat uses one host Vue/Pinia runtime and the typed permission/consent/fresh-proof broker. Untrusted code, external articles and remote video SDK content retain opaque frames; rich content is sanitized. Reviewed native application code shares first-party dashboard trust; this is not whole-origin isolation. Existing history/vault and lock behavior are preserved. Boundary documentation accompanies the separate dependent native draft and is not included in the security-only branch.	E8 browser/unit checks and E10/E11 integrated dashboard, strict and production bundle checks pass.	Combined frontend/bundle qualification complete; final backend r6 passed (E5). Native implementation remains a separate dependent draft.	Maintainer Chat/vault/provider/context UX, real provider/video behavior, CSS @scope and physical Companion/WebView acceptance. Native mounting alone does not establish an XSS boundary.
H-9: container confinement	AppArmor/seccomp declarations reach Docker, Podman and Quadlet; invalid/disabled profiles are rejected. Eight manifest-named application profiles now ship with enforced startup gating. Policy translation, private probe.	E2 translation tests and E5 full backend pass. E6 proves actual Podman seccomp/NNP, application profile attachment, positive data and denied control-secret access.	Source and bounded private-runtime qualification complete; generic baseline and application-image compatibility are distinct.	Complete app-image operation and denied-access probes on selected deployment runtimes, including Docker; no installed-app confinement claim.
H-10: host hardening	Locked credentials, scoped sudo, authenticated signed boot chain, exact image/artifact/snapshot inputs, TLS verification, owned default-deny firewall and D09-only unattended-update policy are implemented in the reachable recipe. Image trust.	E12: source/refusal checks, authenticated package indexes, real isolated packets and systemd sandbox/failure ordering pass.	Source qualification complete. Exact input locking is not bit-for-bit ISO reproducibility or an appointed update review cadence.	Extracted image, actual shim/GRUB firmware trust and tamper rejection, boot, local/remote networking, login/sudo, installed host policy and physical/operator acceptance remain.
H-11: stale release metadata	Original audit mismatch remains recorded; existing 2.0.3 metadata is preserved. A read-only source-binding check rejects mismatched version/ref/component URLs. No next-release metadata was regenerated or signed.	E4 source-binding fixtures pass; this does not validate current artifacts.	Select the reviewed next-release version/ref and check coherent candidate metadata when release work is authorized.	Separate authority to build/sign/publish; authentic manifest/artifacts, both-mirror parity, review dispositions and install/rollback acceptance.
H-12: dependency/current-source evidence	Patched locks, esptool 5.6.0 compatibility and source inventory are integrated. The resolved Python graph no longer includes ecdsa. Dependency disposition.	E7: 2,498 components / 18 inputs / 0 missing declarations; Python 23 packages/zero reported OSV findings, flash 15/15, E5 full backend and E10/E11 UI pass.	Source evidence complete within recorded graph/platform scope. Low deepmerge, maintenance notices, custom/file-specific terms and dormant-feature scope remain explicit.	Installed-image SBOM, frozen Python/vendor inclusion, packaged executable qualification, ESP hardware, build provenance, runtime compatibility and operator acceptance. Source inventory is not blanket security/license approval.

Evidence available at this snapshot:

• E1 — security crate: isolated runner, 17 passed / 0 failed. Retained receipt security-manager-integrated-r1.log. This qualifies that crate's fixtures, not the full daemon or installed migrations.

• E2 — container crate: isolated runner, 98 passed / 0 failed. Receipt security-container-integrated-r1.log. Includes image-gate, TLS, secret references and confinement-option tests, not real registry/image signatures or running container confinement.

• E3 — focused frontend: retained authentication run 140/140 across five files (auth-frontend-r1.log). Separate author-worktree fresh-proof checks passed 24/24, with 104/104 adjacent RPC/send checks. These overlap in scope and predate final integration; do not add them or substitute them for complete frontend, native AIUI, modal or manual UX qualification.

• E4 — earlier source fixtures: release-source binding 4/4, verified first-boot pull 4/4, image-login policy 4/4, catalog/fallback UI checks 29/29. These are fixture/source receipts, not artifact, signature-ceremony or installed-host evidence. Relevant tests live in scripts/tests/ and the dashboard catalog/discovery suites.

• E5 — final isolated backend passed: security-backend-resume-r6.log records 3,054 passed / 0 failed / 27 existing explicit ignores, 239.39s. The code under test includes esptool and HTTPS policy changes; the later Rust change is test formatting only. Focused flash regressions passed 15/15. Earlier r5 3,051/2/27, compile/terminated failures, unchanged Tor focused retry and fresh-proof purchase-fixture correction remain retained. No ignored case is represented as a pass.

• E6 — actual bounded confinement passed: private Podman seccomp/direct syscall, NNP, existing enforced attachment and missing-profile refusal passed in container-confinement-private-r3.json. The exact new Grafana application profile passed positive app-data and denied control-secret access in container-app-profile-resume-r3.json. It used an isolated policy namespace and private storage/rootfs; cleanup passed. The initial readiness timeout, unsupported parser option and namespace-name mismatch are preserved in their earlier receipts. This is not complete application-image or Docker acceptance.

• E7 — dependency inventory: 2,498 components / 18 input/evidence hashes / zero missing package-level license declarations. All 18 hashes match the integration tree/evidence. Esptool 5.6.0 replaces 4.8.1; the resolved Python graph has 23 packages, no ecdsa and zero reported OSV findings. Its source Python suite passed 17/17 and inventory fixtures 4/4. Frozen artifacts and actual ESP write/reset flows remain separate. Retain low deepmerge, Rust maintenance notices, 185 lock-only Cargo components, Reticulum custom terms, PyInstaller exceptions and per-file/platform limits. See the dependency disposition and inventory summary; declarations do not establish compliance.

• E8 — native AIUI: source commits 359ff6595, a137d8f49, 753e20191 and 30722047a are integrated. Author-worktree strict checking and production lazy/single-runtime/precache assertions passed. The full app suite passed 408 tests before 11 bounded new tests, which passed separately; this is not a single 419-test full-suite receipt. Browser checks passed 5/5, with 2/2 targeted real PDF.js/KaTeX/remount checks. These establish their source boundaries, not arbitrary-native-script isolation or real provider/device UX.

• E9 — Companion media: source commits 93f0017a4, 68a1c14cc and 7c4fdb918 are integrated. Focused viewer checks 103/103, delayed-history 3/3, Chromium viewport/MP4/fullscreen 5/5 and document-chain 26/26 passed. They preserve owned/cache-only recovery and require no new payment. The separate canonical media review is published with verified draft status; accepted-main-only mirror parity passed. Neither result is merge, all-history parity, release or manual UX approval. The VPN draft remains separate.

• E10 — integrated frontend passed: full dashboard r2 passed 271 files / 2,466 tests, exit 0 (integrated-ui-full-r2.log). One nonfatal stableAppUrl worker-termination warning remains in the receipt. Integrated strict checking passed (integrated-ui-types-r3.log). Earlier r1's 2,436 passes, five obsolete assertion failures (corrected) and two worker-startup failures remain recorded; r2 is the completed passing repeat.

• E11 — integrated production UI pipeline passed: frozen dependency installation, full AIUI strict checking, host vue-tsc, Vite/PWA build and lazy-entry/single-runtime/no-standalone-bootstrap/no-native-precache assertions passed. Receipts: integrated-ui-production-r1.log and integrated-native-bundle-evidence-r1.json. This is source bundle evidence, not a signed release artifact or installed-device acceptance.

• E12 — image/host source qualification: 44 image-input/Secure Boot/login/ UAT source checks passed (image-final-source-r2.log); the additional exact snapshot-index-hook regression passed (snapshot-lock-source-r1.log). Offline provisioning/refusal/profile inventory passed 8/8 (host-policy-final-offline-r3.log). Actual IPv4/IPv6/WG/FIPS/container/TollGate packets and foreign-rule/atomic refusal checks passed (host-policy-packets-forward-r1.log). The actual systemd sandbox and dependency-failure journal passed (host-policy-systemd-final-r1.log). Earlier fixture failures remain retained. Authenticated snapshot indexes qualify available package identities, not a built image. ISO web/runtime/first-boot fixtures pass; no ISO was built.

Acceptance order remains: current source qualification, maintainer manual UX and selected runtime checks, then the user's release decision. Incorporate the latest accepted 2.0.4 UX changes before that release integration and repeat checks affected by integration. Do not close physical/runtime issues based on source tests or merge UI drafts without maintainer approval. Preserve wallets, persistent app data, uninstall decisions and no-repayment recovery. Keep the unresolved release regression checklist.