v12 security claims and evidence ledger
This page is the canonical boundary for security claims made by the Rullst v12 release notes. Each row names the narrow behavior implemented in the repository, the tests that exercise it, and a known limit. A security statement that is not represented here is not a v12 release guarantee.
The evidence links point to source-controlled tests. A passing local run proves only that checkout and environment; the release candidate must attach the same checks to its immutable tag SHA. None of these rows is a certification, external audit, proof of complete OWASP coverage, or substitute for an application’s own threat model.
| Narrow v12 claim | Implementation | Verification | Known boundary |
|---|---|---|---|
The optional Connect Axum session flow binds one authorization callback to ten-minute state + PKCE and, for OIDC, nonce held in tower-sessions; it removes and immediately saves the challenge before validation and does not print its URL, code, nonce or verifier through managed Debug implementations. | Managed session flow and constant-time callback state comparison | Round-trip, sequential replay, expiry, mismatch, missing-state, replacement and redaction negatives, promoted to TM-AUTH-04 in the release minimum | One challenge per browser session invalidates an earlier concurrent tab. The generic session-store contract is not a distributed compare-and-delete across requests that already loaded the same record. The host still owns durable/shared session storage, Secure/HttpOnly/SameSite cookie and TLS/proxy policy, redirect registration, post-login rotation, idempotent account linking/recovery and live-provider conformance. |
| The explicitly mounted Connect Mock IdP supplies a bounded signed OIDC loopback fixture: exact configured HTTP-loopback issuer/client/callback, expiring one-shot code, optional S256 PKCE and nonce, EdDSA ID token/JWKS and issued-bearer userinfo. | Concrete router/state, validated configuration and fixture signer | Real OidcProvider loopback discovery/exchange/signature/replay test and local negative matrix, plus router integration | The signing seed and credentials are public deterministic fixtures. The state is bounded and process-local. This is not safe for public exposure and does not implement interactive login/consent, refresh/device/federation lifecycle, durable state, key rotation or OIDC conformance. |
Nexus requires an explicit access policy and rejects an unverified peer; registered CRUD metadata and submitted semantic fields also fail closed before dynamic SQL. An opt-in registered text tenant column scopes every built-in read/mutation/batch path to a trusted Core TenantContext, and required mutation audit couples one minimized record to the data transaction. | NexusAuthPolicy, registry validation, bounded form validation, scoped mutations, scoped batch and audit schema/API | Access-policy unit tests, metadata negatives, semantic validation negatives, HTTP widget/parameter-pollution regression, and materialized cross-tenant/audit atomicity regression, promoted as TM-NEXUS-02/TM-NEXUS-06 through portable release-minimum tests | Loopback convenience is debug-only and Basic Auth requires verified TLS. Unscoped models remain global. The application owns identity/membership/domain policy, within-tenant ownership, custom-route authorization, database schema/privileges and audit export. The built-in audit table is same-database mutable committed-event evidence, not denied-attempt, append-only, tamper-evident, retention, backup, replication or external-review evidence; generated create keys may be absent. |
Studio’s built-in local capability accepts only a verified loopback peer and local Host in debug builds, and unsafe methods require a same-origin Origin. | LocalStudioAccess | Inline loopback, remote-peer, missing-peer, Host and Origin negative tests, plus router integration tests | This bounds the supported local browser surface against direct remote access, DNS rebinding and cross-origin mutation. Shared or release deployments still need application-owned authentication, administrator authorization, TLS and network policy; Studio does not supply them. |
| Newly generated CORS middleware fails closed without a valid explicit origin allowlist. | CORS scaffold template | Generated-middleware HTTP tests | Previously generated applications are copied code and are not rewritten by a CLI upgrade. Browser/proxy behavior must still be tested in the deployed application. |
Newly generated fiscal-receipt mail keeps an OfflineMock visibly unauthorized, rejects contradictory fiscal markers, and both fiscal/dunning action links require credential-free HTTP(S) URLs. | Extended mail scaffold templates, validate_action_url, and CLI dispatch | Materialized seven-template Clippy/runtime/provenance/link/collision contract and action-URL unit negatives | Generated source cannot prove an application-supplied response truthful, authorize tax documents, calculate due state, schedule delivery, pause access, or define billing policy. Previously generated source is not rewritten. |
| The opt-in Mail inspection guard completes every configured static inspection before transport and fails closed on scanner unavailability. Its strict local policy rejects executable magic, spoofed recognized types, active PDF/SVG, recognized secrets and unsafe links. | Inspector contract and guard | Safe-shape and active/type-confusion negatives, promoted to TM-MAIL-01 in the release minimum | The local policy is a bounded heuristic, not antivirus, sandbox execution, recursive archive inspection or CDR. Hosts that require authoritative scanning must provide and operate a production AttachmentInspector. |
| The opt-in Mail suppression guard checks a recipient before transport and fails closed when suppression state is unavailable. The SQLite store binds provider/event/payload replay exactly, escalates manual/hard-bounce/spam-complaint state monotonically and enforces immutable quotas across restart and competing local instances. | Suppression domain and guard and SQLite store | Process-local contracts and restart, two-instance quota, conflict, pruning, target and corruption negatives, promoted to TM-MAIL-02 in the release minimum | SuppressionEvent does not authenticate a webhook. Only already verified provider events may be recorded. Replay retention must cover provider redelivery; file protection/encryption/backups, multi-host replication and provider conformance remain external. |
| Mail terminal observations exclude recipient, subject, body, filenames and provider response content. The default sink is bounded and exposes eviction count, while observer failure cannot turn an accepted delivery into a retryable error. | Observation contract and wrapper | Outcome, minimization, capacity, tenant and label regressions, promoted to TM-MAIL-03 in the release minimum | The default sink is process-local. External tracing/metrics delivery, retention, correlation and alerting remain deployment work; a custom sink must not block or panic. |
| Newly generated billing code selects SQLx or Turso-primary persistence, derives checkout/portal identity from an authenticated extension, requires an explicit production plan allowlist before persistence, accepts webhook events only through the mandatory verifier layer, refuses existing outputs and rejects cross-owner subscription reuse before binding the conflicting customer. | Billing generator and generated controller | Materialized SQLite/Turso Clippy, migration, persistence, ownership and collision contract, promoted under TM-DEPLOY-06 | Generated code is application code. The host must configure correct provider plan IDs, mount auth and exact webhook middleware, add durable provider-event idempotency/reconciliation, validate a provider sandbox and review previously generated source separately. |
| Core CSRF middleware uses a double-submit check and only exact configured webhook exemptions. | CSRF middleware | CSRF unit tests and application integration tests | Safe deployment still depends on HTTPS, cookie configuration, application authentication, and a correct exact-path exemption list. Request-body inspection is bounded. |
| Core WAF inspects and preserves supported bounded request bodies and rejects bodies outside its one-megabyte inspection envelope. | WAF middleware | WAF body and query tests | Detection is pattern-based, has false positives and negatives, and is not complete OWASP coverage. Streaming or other uninspected representations require application controls. |
| Parameterized routes recognized by the CLI audit require an adjacent public/owner/role/admin classification; owner paths require the recognized ownership guard. | Bounded route source audit and RbacGuard | Audit negatives, scaffold contracts, and HTTP owner/cross-owner test | Static analysis recognizes bounded syntax and guard names; it cannot prove the correctness of an application’s identity source, object lookup, or business authorization. |
| Encrypted session tokens are versioned, authenticated with AES-256-GCM, expire, and reject malformed or weak-key inputs. | Session implementation | Session negative and round-trip tests and integration tests | Application-key custody, rotation, session/device revocation, and distributed logout are application or roadmap responsibilities. |
The optional application JWT policy binds versioned access claims to issuer, audience, subject, times, token ID and session version; it bounds TTL/scopes and supports strong kid key rotation. The SQLite profile serializes bounded JTI/session-version revocation shared by local processes and verifies it asynchronously. | JWT policy and SQLite revocation store | Rotation, revocation, audience, configuration and production fail-closed tests, plus restart, exact quota, two-instance and corruption evidence | The bundled in-memory store remains process-local and is rejected by production mode. SQLite is one shared local file, not multi-host replication, secret management, backup/availability or a refresh-token workflow. Third-party OIDC verification belongs to Connect. |
| MFA recovery helpers generate subject-bound 80-bit codes and persist only salted HMAC-SHA256 verifiers; verification is constant-time and a successful in-memory consume removes one verifier. | Recovery-code implementation | Subject binding, single-use, plaintext-storage, format, pepper and tamper tests | The application must render plaintext once, protect the pepper, persist compare-and-delete transactionally, rate-limit attempts and audit enrollment/recovery. This is not a complete account-recovery workflow. |
| TOTP enrollment uses 160 bits from the OS RNG, rejects weak/invalid inputs, compares exactly six ASCII digits in constant time and can render a bounded SVG QR. | TOTP and QR implementation | Secret, code, drift, invalid-input and real-SVG tests | The application must encrypt the TOTP secret, protect the enrollment ceremony, confirm a code before activation, rate-limit verification and own account recovery. |
The optional Redis rate limiter hashes client-derived keys and atomically shares a bounded fixed-window counter across independent clients. Empty or mock_* configuration is explicitly process-local and rejected by the production boundary. | Redis rate limiter | Offline fail-closed regression, live independent-client contract, and digest-pinned services in CI / release | A single Redis service does not prove cluster/failover behavior, Academy HTTP identity/origin composition, or an operational abuse policy. |
Core can bind its storage, cache and in-process realtime/presence facades to a tenant selected by authenticated membership. TenantStorage applies an immutable tenants/<tenant>/ object root after strict path validation; TenantCache validates logical keys, applies an immutable backend namespace and exposes no global flush; TenantRealtime/TenantPresence validate logical names, cap message payloads at 64 KiB and namespace rooms. | TenantStorage, TenantCache, realtime wrappers and TenantContext | Exact same-logical-name cross-tenant non-interference tests for storage, cache, broadcast and presence rooms in realtime (TM-TENANT-04) | These prove local wrapper contracts, not room-level authorization, distributed realtime/presence liveness, remote bucket policy, search/metrics/export isolation or automatic use by Academy/application routes. Redis cluster/failover remains separate evidence. |
The LMS starter persists schools, active/default memberships, course scopes, cohorts and temporal entitlements. Authentication treats X-School-ID only as a selector against persisted membership, binds the validated tenant to UserContext, and loads roles for that school. Learning, publication/rollback, assignment grading/correction, score correction/leaderboard, completion/certificate mutation, role lifecycle and scheduled publication enforce the selected school. Outbox, derived automation and notification state preserve school_id; the leaderboard cache is tenant-scoped, payload-validated and invalidated after authoritative mutations. | Tenancy models/migration/service, authentication and learning composition, leaderboard/cache service, and tenant-aware RBAC | Materialized arbitrary/ambiguous selection, entitlement, cache/invalidation, same-user notification/preference separation, foreign-rule isolation, cross-school HTTP enrollment/leaderboard and foreign-admin mutation/scheduler/role non-interference, plus exact tenant guard tests | This is bounded SQLite database/HTTP/local-cache evidence, not complete multi-tenancy. Other caches, files, search, metrics, exports, Nexus, invite/provisioning, distributed cache/failover and PostgreSQL/MySQL non-interference remain open. |
| The Academy scaffold provides a minimized, school-scoped privacy lifecycle foundation: age band instead of birth date, versioned bounded retention, purpose-specific guardian consent/revocation and idempotent export/delete request records. Minor authorization fails closed without matching active consent. A bounded admin/owner sweep schedules replay-safe delete requests; fulfillment adds exact leased claims, abandoned-claim recovery, delayed retry/dead-letter, a hard ten-attempt claim ceiling and actor/SHA-256-bound completion. A supervised static-dispatch executor applies an adapter timeout shorter than the lease, explicit shutdown and local metrics; its deterministic mock never exports, deletes or anonymizes data. | Privacy migration and service templates, retention scheduler, request worker protocol, and supervised executor boundary | Materialized consent, cross-school, stale-token, lease-recovery, retry/dead-letter, hard-limit, completion-digest, supervised-success and adapter-failure regression (TM-ACADEMY-10) | No product adapter that performs cross-table export/deletion/anonymization, legal-guardian verification, PII-safe application telemetry proof or legal compliance claim is provided. |
| Core’s storage-agnostic upload admission contract enforces a hard in-memory size ceiling and kind allowlist, validates canonical tenant/name and exact declared MIME/extension against recognized signatures, denies recognized active text, emits randomized tenant-prefixed quarantine keys and a SHA-256 digest, and fails closed unless a scanner adapter supplies a valid clean verdict. | Upload admission/quarantine contract | Exact unit negatives for active SVG text, traversal, tenant injection and MIME/extension spoofing, plus digest-bound clean/infected/unavailable mock scans in the same module | This is not an HTTP multipart implementation, deep parser, S3/R2 mover, transcoder or production malware scanner. PDF/media checks are bounded signatures, the bundled scanner is mock-only, and archives/SVG/HTML remain denied or outside the allowlist. |
| The LMS outbox commits score, first lesson completion, enrollment, achievement, publication, editorial rollback, assignment submission/grading/correction, course completion and certificate revocation events with domain state, claims an available event under a bounded lease, binds acknowledgement/failure to an exact token, schedules bounded retry, recovers expired claims, counts attempts and dead-letters at a bound. Its supervised database worker validates each supported envelope, loads current rules, rederives/applies the sole achievement action and ACKs/fails the exact claim; configuration, shutdown, safe drop and local counters are explicit. | Generated score/outbox templates, assignment services, progress/completion services, claim service, worker, closed passive envelopes, and executor | Materialized SQLite supervised worker/FIFO delivery, assignment/rollback/completion/revocation delivery, progress, score, backoff, expired-claim/stale-token, ACK-loss redelivery, transactional achievement and poison dead-letter regression | No external transport or exported durable telemetry is built in. Only score_recorded → award_achievement currently drives an automation mutation; tenant policy and approval envelopes are required before adding sensitive actions. |
The LMS starter grades single-choice quizzes from server-side question/option state, binds replay to attempt/quiz/learner/ruleset, enforces the configured attempt count, and commits immutable answers, a ScoreEvent, the authoritative leaderboard update, score_recorded and quiz_graded in one transaction. Timed quizzes require a persisted server-time start/expiry session and server-random question/option presentation; replay cannot extend/change either, starting consumes an attempt and grading rejects an ID set changed under the same ruleset. Authenticated start/submit routes derive subject/quiz from session/path and never accept client points. | Generated grading, timing ceremony, HTTP boundary and schema/models | Materialized SQLite correct/incorrect grade, start/order replay/expiry, cross-user, unknown-option, attempt-limit, score-event/outbox counts and leaderboard regression | Quiz grade override, browser UI and multi-database contention proof remain open; distributed clock and concurrent-start behavior remain deployment/test boundaries. |
The complete LMS starter’s owner-only activity routes accept only an idempotency key plus one selected option, a complete bounded pair-ID permutation or bounded typed text. Static-dispatch single-choice/matching/typed evaluators and opaque ValidatedActivityResult keep identity, answers, points, policy, evidence and time server-owned. Typed replay uses a policy-bound SHA-256 digest rather than raw text. A transaction-locked recheck binds exact evaluator configuration and atomically stores the exact-replay attempt, appends ScoreEvent v2, updates the leaderboard and emits strict score_recorded v2. Attempt identity is learner/activity-scoped and event identity is server-derived. | Activity evaluation/HTTP templates, matching evaluator/route, typed evaluator/route, persisted bridge, replay gate, score service and schema | Materialized SQLite HTTP owner/cross-user, actor/evidence/policy mismatch, malformed pair/text input, normalized/conflicting replay, raw-text absence, durable attempt, score/outbox/leaderboard and downstream automation regression | Typed comparison does not provide Unicode normalization/accent/fuzzy semantics and its digest may remain personal data. Listening/game evaluators, quiz-path unification and PostgreSQL/MySQL contention proof remain open. |
| Enabled Academy activities update a versioned deterministic review schedule in the same transaction as a newly applied authoritative score. Policy/state validation and algorithm drift fail closed; exact replay returns before the schedule transition. The bounded owner-only due endpoint derives learner/time server-side and rechecks school membership, course scope and active enrollment. | Review policy/state/service and HTTP templates, score transaction, routing and schema | Pure deterministic pass/lapse transition test and materialized SQLite three-activity persistence, replay, future queue and cross-user boundary | rullst-box-v1 is an inspectable bounded heuristic, not FSRS/SM-2 compatibility, educational efficacy, AI personalization or generated pedagogy. Algorithm migration/experimentation, complete privacy integration, visual UX and PostgreSQL/MySQL contention remain open. |
| Text assignments persist versioned server policy, rubric criteria, owner-bound submissions, human grades and criterion feedback. Submission requires the authenticated learner’s school-scoped enrollment, server deadline/attempt limit and exact idempotency request. Grading/correction derive the lesson scope from persisted assignment state, require the selected school and then apply evaluator/admin/rubric policy. Admin correction is append-only and records before/after, reason, actor, server time, canonical request and outbox. | Assignment models, submission service, grading service, correction service, schema, and HTTP boundary | Materialized deadline, cross-user, replay, impossible-score and correction regression, plus foreign-school grading denial | There is no attachment pipeline, visual authoring/review UI, tenant-scoped outbox or PostgreSQL/MySQL contention proof. Human evaluator identity is only as strong as the host authentication/role lifecycle. |
| Protected LMS lesson, progress and assessment paths require the authenticated school, an active membership, a course scope, open-or-active entitlement policy, active enrollment and exactly one valid versioned availability rule; server time enforces release/expiry and same-course prerequisites. | Generated learning guard, school service, and availability schema/model | Materialized prerequisite/release/expiry regression and cross-school HTTP/database denial plus entitlement regression | Entitlement issuance is not connected to billing, and signed media/download URLs, cross-subsystem tenant isolation and multi-database contention remain open. |
Academy course completion is derived only after school-scoped membership/entitlement checks and from the immutable version pinned at enrollment plus persisted lesson progress under a closed rule. The transaction writes immutable evidence, one opaque certificate and course_completed; public verification omits learner identity, while revocation requires an admin in the certificate’s school, server time, reason and exact idempotency. | Completion service, models/schema, and HTTP boundary | Materialized completion/revocation regression and foreign-school revocation denial | Certificates are database-verifiable opaque records, not externally signed credentials. Portable signatures, full relational snapshots, tenant-scoped outbox, PostgreSQL/MySQL contention and an external revocation registry remain open. |
A newly applied Academy achievement emits school-bound achievement_awarded in the same transaction; the exact claimed event creates one localized in-app notification in that school, applies school/user opt-out/locale state, and authenticated owner/admin APIs control bounded school-filtered listing, preference updates and idempotent read transition without accepting subject identity from input. Its closed versioned template renders Portuguese, Spanish or English with deterministic English fallback and rejects unknown keys/payloads. A new unsuppressed row and the same rendered projection are sent after commit through TenantRealtime to an authenticated tenant/user subscription. | Transactional achievement event, notification contract/schema/realtime projection, closed translation templates, HTTP boundary, and worker dispatch | Materialized database delivery, three-locale/fallback rendering, unknown-key denial, realtime receipt, owner/cross-user listing/read/preference/replay and same-user cross-school notification/preference isolation | The database is authoritative; realtime is in-process and best-effort. Catalogs for other event kinds, Mail/push, distributed realtime/replay, tenant-scoped Nexus UI and PostgreSQL/MySQL contention remain open. |
| Course versions are immutable snapshots with explicit draft/review/scheduled/published transitions, an admin reviewer distinct from the author, atomic archival/publication plus outbox, and an enrollment-time pin that does not move when a newer version publishes. Authenticated handlers derive the author/reviewer and current time from server state rather than payload fields. A supervised bounded scheduler acquires/renews/releases an exact shared lease, activates due versions with an admin context, preserves the independent reviewer, records the activation actor and fails closed on lease loss. Admin-only editorial rollback rejects the source author, requires reason/idempotency, creates a new published revision from historical content and atomically persists replaced/result version evidence plus outbox without moving old pins. | Publication model/service/migration, rollback service/model/migration, HTTP boundaries, scheduler loop and transactional enrollment pin | Materialized service/pin regression, rollback authorization/replay/conflict/audit and old/new pin regression, and handler plus supervised scheduler contention/activation/replay continuation | The starter does not yet serve every module/lesson/assessment field from the snapshot, expose visual Nexus authoring, export scheduler telemetry to Studio, or prove PostgreSQL/MySQL contention. |
Education roles are durable, allowlisted and reconstructed from active assignments for the authenticated school; each grant stores school_id, actor, reason and validity window, support must expire, and only a distinct school owner can grant or revoke owner/admin. Exact grant/revocation replay is a no-op only for the same request; cross-school assignment lookup returns not-found. | Role model/service/migration, HTTP boundary and authentication composition | Materialized expiry/grant/revoke/replay negatives and foreign-school revocation denial | There is no explicit step-up ceremony, external audit sink or AI tool integration. Provisioning/bootstrap and full Nexus isolation remain application-owned. |
| Academy scheduler instances sharing a database coordinate on a named lease with exact holder/token renewal and release; another token can take over only at expiry. Scheduled publication mounts that lease around every bounded cycle, renews before each mutation and provides an awaited shutdown, safe drop and local counters. | Generated scheduler lease model/service/migration and supervised publication scheduler | Materialized competing acquire, wrong-token renewal, pre/post-expiry takeover and stale-release regression, plus continuous scheduler standby, activation and empty replay | Delay/failure metrics are not exported to Studio or a durable backend. PostgreSQL/MySQL contention and distributed clock-topology behavior remain unproved. |
| Automatic OAuth refresh validates and redacts token state, binds every replacement to the original provider user, serializes concurrent process-local refresh and swaps credentials only after a complete response with a bounded lifetime. A storage-neutral AES-256-GCM snapshot preserves the validated generation and authenticates the version, key ID, provider and trusted local-account binding before restoration. The optional SQLite store adds a persisted quota, restart recovery and exact generation CAS for shared-local writers. | Refresh coordinator and values, encrypted snapshot and SQLite store | Fresh, concurrent single-refresh, rotation, identity-confusion, malformed-response and rollback tests, snapshot unit negatives, public storage/ownership contract and the TM-CONNECT-24 two-instance/restart/corruption matrix | The host must authorize the account, provide high-entropy key custody/rotation, lease the remote provider call, reconcile a losing rotation, protect and back up the directory, configure retry/backoff/revocation and decide when reauthentication is mandatory. SQLite CAS is local durability, not a secret manager, remote refresh lock or multi-host replication contract. |
| The current passkey foundation binds ceremonies to relying-party/origin data, consumes bounded challenges once, verifies flags/signatures, and enforces monotonic counters. The SQLite profile persists bounded device registration/inventory/rename/revocation and advances counters with CAS shared by local processes. | Passkey service, ceremony store and SQLite device lifecycle | Invariant tests, negative-path tests, and real ES256 lifecycle, restart, replay, quota and two-instance CAS tests | Challenge state remains process-local, so multi-instance ceremonies require sticky routing or a host shared layer. It has not passed an external WebAuthn conformance suite or independent audit; SQLite file trust/encryption/backup/replication and device ownership remain deployment/application duties. |
| Capital exposes Axum and opt-in Actix middleware over one canonical verifier. Both bound payloads at two megabytes, verify the selected provider before dispatch, restore the exact signed body, insert the normalized event, check protocol freshness where defined, and reject replay within the configured store. | Canonical verifier and Axum adapter and Actix adapter | Stripe/LemonSqueezy canonical, freshness, reconstruction, capacity, expiry, Actix preservation/rejection and replay tests | The default replay store is process-local and payload-keyed. Multi-instance deployments require durable shared provider-event idempotency before side effects, provider-specific operational validation, and an append-only audit trail. |
A Billable direct charge requires bounded integer minor units, currency, provider-owned customer and tokenized payment-method IDs, validated model e-mail and an application idempotency key. Stripe forwards the key, confirms off-session and accepts only amount/currency-bound succeeded or processing; deterministic offline receipts are explicitly non-success Mock. | Charge contract, Billable helpers, and Stripe adapter | Validation/redaction/provider-negative integration, Stripe response-confusion negatives, and facade derive regression | The application must authorize provider IDs, establish mandate/SCA, persist unique keys/order state, reconcile signed events and drive entitlements. No other adapter or live sandbox is implied. |
| Metered usage uses provider-specific identities and actions rather than guessing from one uniform subscription ID. Stripe forwards and binds customer/event/value/timestamp/identifier; Lemon Squeezy sends and binds the subscription-item relationship, quantity and action while preserving a separate application event key. | Usage domain, Stripe adapter, and Lemon Squeezy adapter | Stripe exact HTTP/body-limit/mismatch/mock tests, Lemon exact JSON:API/mismatch/mock tests, and domain validation/redaction tests | The fixtures do not establish live-account acceptance. Stripe uniqueness is rolling, while Lemon’s request has no equivalent provider event key; the application must durably claim events, configure the matching aggregation, retry/reconcile and drive quota/entitlement state. |
| Coupon IDs and relative trial changes are bounded before provider dispatch. Stripe’s discount response must bind the subscription and expanded coupon; Stripe and Lemon Squeezy trial responses must bind subscription and exact expiration. Unreviewed live operations fail explicitly. | Subscription values, Stripe protocols, Lemon Squeezy trial protocol, and static handle | Exact local HTTP fixtures assert form/JSON:API headers, body and response binding; cross-provider fail-closed integration covers unreviewed live paths. | The host must authorize ownership, persist one command clock for stable retries, serialize conflicting updates, understand provider billing-cycle effects and reconcile signed webhooks. Protocol fixtures are not live-account acceptance. |
Shared Team/Workspace quotas use a trusted billing subject, an application-stable event key and an atomic conditional counter. An over-limit or exact replay never executes QuotaGate’s callback; a conflicting replay fails closed. The SQL adapter can reserve in the same transaction as the domain insert. | Quota domain and gate, SQL store, and Billable limit derivation | Local validation, isolation, replay, compensation and concurrency plus live PostgreSQL, MySQL, and MariaDB contention contracts | Authentication must establish membership and the active tenant; webhook reconciliation must persist the authoritative tier. Schema migrations, abandoned standalone reservation policy and Turso/NoSQL adapters remain host work. Writes outside the explicit gate are not intercepted. |
| Opt-in paid-invoice delivery rejects non-final/mock payment evidence and exact recipient, minor-unit amount or currency mismatch before producing bounded HTML/PDF; the Mail bridge runs pre-flight and retains a stable non-secret delivery key. | PaidInvoice binding, PDF renderer, and Mail bridge | Payment-status/substitution and key-stability negatives, font/pagination/PDF parse tests, and prepared plus explicit-driver delivery tests | A custom adapter is trusted to authenticate its own provider response. The application must construct the authoritative order, reconcile webhooks, atomically claim the key in a durable outbox and own retry/provider attachment policy. No automatic webhook hook, provider acceptance or exactly-once delivery is implied. |
| Vault field envelopes use authenticated AES-256-GCM, random nonces, version/key identifiers, AAD binding, and explicit rotation keys. | Vault implementation | Round-trip, tamper, wrong-key, malformed-envelope, and rotation tests | The caller owns key custody and rotation. No real KMS/HSM adapter or hardware-backed key claim is made. |
#[orm(encrypted)] transparently encrypts String and Option<String> values on generated writes, decrypts generated model reads, authenticates table/column context, and reads prior keys from an explicit keyring. | ORM privacy implementation and derive integration | End-to-end SQLite insert/read/update/rotation/tamper/query-boundary test and envelope unit tests | Randomized fields cannot support generated filtering, ordering, grouping, or explicit selection. Raw SQL is not transformed, blind indexes are application-owned, full key retirement is not automated, and key custody remains external. |
| Portable document recovery encrypts and authenticates a versioned MongoDB/SurrealDB/deterministic-store snapshot with AES-256-GCM, fresh nonce, explicit rotation key and length-delimited application/collection binding. Export compares two bounded inventories; restore accepts only an empty or exact matching subset, never replaces/deletes and verifies the final collection. | Recovery types and redacted key/envelope, bounded codec, and restore algorithm | Tamper/key/scope, conflict/extra-row, replay, capacity, ordering and concurrent-source negatives, plus the live MongoDB→SurrealDB→MongoDB matrix | Applications must quiesce writers, provision destination schema and own high-entropy key custody, rotation, snapshot permissions, durability, retention and erasure. Two equal scans are not formal online snapshot isolation; partial successful inserts remain for exact retry, and no managed backup, point-in-time recovery, replication or cross-store transaction is claimed. |
| OTA accepts firmware for commit only after Ed25519 verification binds target, version, rollback counter, length, and SHA-256 digest. The store-backed path additionally requires exact monotonic compare-and-set before local mutation. | OTA manifest verifier and counter-store contract | OTA integration negatives and state tests, restart/retry/conflict store tests, and bounded fuzz target | Rullst does not download, flash, boot, or implement/certify a physical durable counter. Platform bootloader, storage integrity, wear and power-loss integration remain external. |
Core’s canonical browser baseline installs the exact application config outside a stable secure-header/CSP nonce → exact-origin CORS → WAF → CSRF → optional PII order; Server uses the same composition. Core and the optional extended secure-header layer reuse one per-request CSP nonce. Generated LMS/SaaS authentication plus LMS catalog/course/player style elements consume that nonce, and the audited LMS shell has no remote page dependency or inline style attribute. | Core baseline, generated authentication controller, LMS catalog, and extended layer | Integrated Core baseline tests, generated catalog contracts, materialized escaping/nonce regression, and extended nonce tests | In-process/source evidence does not guarantee a scanner grade or real-browser behavior. TLS, proxy policy, every application-owned HTML surface and session/auth/tenant layers still require deployment testing. |
| Response DLP masks recognized secrets only in supported, bounded textual payloads without corrupting invalid UTF-8 or incomplete values. | DLP middleware | Unit/integration tests and bounded fuzz target | It does not prove zero leakage and does not rewrite arbitrary binary, compressed, encrypted, or streaming bodies. Unknown secret formats can pass through. |
| RASP rejects the implemented SQL injection, path traversal, JNDI, SSRF, RCE, header, and decoded JSON patterns within its inspection boundary. | RASP inspector | Middleware and pattern tests, integration tests, and bounded fuzz target | It is a bounded detector, not a parser for every protocol or proof against every bypass; false positives and false negatives remain possible. |
| Login Jail applies bounded progressive delay and temporary process-local jailing, with cleanup of expired state; its async API awaits the selected delay. | Login guard | Applied-delay, jail, expiry, capacity, and concurrency tests and contention tests | State is not distributed. Correct client identity depends on trusted peer/proxy handling, and deployments still need upstream abuse controls. |
| The optional Redis limiter consumes one namespaced fixed-window budget atomically, hashes the caller-supplied client key and returns TTL-derived retry metadata. | Redis limiter | Configuration, key-redaction, explicit-mock and shared-clone tests | Offline mode is process-local and require_distributed() rejects it. Real Redis cross-instance, eviction/failover and trusted-proxy deployment tests remain required; the caller still owns the identity key policy. |
| Audit-chain entries use HMAC verification and unambiguous length-prefixing; ordinary process-local telemetry is not presented as HMAC verified. | Audit chain, telemetry store, authenticated journal, and Nexus rendering | Tamper/concurrency tests, telemetry provenance tests, journal forgery/rotation tests, and Nexus badge test | The compatible DurableSiemSpool deliberately stores unsigned events. The separate opt-in journal sets the flag only after verifying its complete local HMAC chain; it does not authenticate the truth or identity behind a semantic event. Key management, trusted tail checkpoints, external storage/delivery and independent verification remain open. |
| Local security telemetry uses an exact, versioned v1 JSON envelope with normalized identifiers, IPs and timestamps, bounded UTF-8 details, escaped CEF extension values and opt-in synchronous local journals. | LiveSecurityEvent, machine-readable schema, CEF serializer, compatible spool, and authenticated journal | Schema/normalization tests, unsigned spool tests, authenticated restart/rotation/forgery/ordering tests, public API restart test, and CEF injection test | Both formats are bounded and single-process. The authenticated form supports explicit key rotation but not trusted whole-tail checkpoints, directory policy, compaction, delivery, acknowledgement, retention, correlation, retry, dead-letter handling, or an external SIEM. |
| Declared JSON bodies fail closed on invalid syntax, recursive duplicate keys, excessive size/depth and ambiguous content types; an explicitly mounted policy additionally enforces one bounded JSON Schema 2020-12 document or OpenAPI 3.1 component without external retrieval; recognized log secrets and local SRI assets have explicit bounded helpers. | Schema guard, compiled policy, log redactor, and SRI helpers | Inline malformed/duplicate/nested JSON, schema shape/external-reference/OpenAPI component negatives, repeated secret and file-backed SRI tests in those modules, plus DLP/RASP integration | This validates JSON bodies only after explicit per-route mounting. It does not infer arbitrary route schemas, authorize a subject, enforce domain rules, install a global tracing filter, discover every secret, or rewrite every asset automatically. |
| Security CLI evidence fails when an explicitly requested Geiger/SBOM/network check is incomplete or reports a finding; SBOM UUID/component fields and actual MSRV parsing are regression-tested. | Audit orchestration, SBOM/network evidence, doctor, and managed hook | Unit tests in the linked modules and strict package Clippy | Source heuristics are not complete static analysis; the SBOM is not signed attestation; listener observations are not external reachability; tool presence and local output are not certification. |
| AI prompt checks and PII masking run before built-in provider dispatch and report only a heuristic result. | GuardrailReport, provider dispatch, compatible adapter, and versioned corpus | Versioned cross-provider eval runner, cross-provider guardrail pipeline, compatible public/loopback contracts, and provider capability tests | The corpus is a deterministic regression suite, not a safety benchmark. Compatible capabilities are caller declarations, not discovery. Passing heuristics or JSON schema does not make output trustworthy, stop adaptive injection, authorize tools, prevent egress, or prove an upstream request was cancelled. |
| Every built-in live AI transport applies a configurable local request deadline, defaulting to 30 seconds. | OpenAI, OpenAI-compatible, Anthropic, Gemini, DeepSeek, and Ollama adapters | Capability contract and loopback timeout/shape regressions | A local timeout only drops the request future. It does not prove upstream cancellation, prevent billing, provide automatic retries, limit concurrency, or implement circuit breaking. |
| The strict AI egress policy denies every host until an exact allowlist is configured and rejects insecure/credentialed URLs, local/private/metadata/reserved addresses, mixed DNS answers, disallowed redirects and oversized bodies. Its opt-in fetcher resolves under deadline, pins all validated answers into a proxy-free client, verifies the connected peer, disables automatic redirects and enforces the byte budget while streaming. | EgressPolicy, host normalization, and EgressFetcher | IPv4, IPv6, allowlist, DNS, redirect, configuration and resource-budget negatives, plus private/mixed DNS rejection before transport and streaming overflow tests | The fetcher is not mounted around arbitrary application/provider traffic. Tenant-aware destination authorization, response content/schema validation, data minimization and a deterministic successful live-origin redirect/stream contract remain caller/integration work. |
| Local AI tool dispatch requires an exact allowlist, principal authorization, closed bounded JSON, call budget and audit sink; destructive/financial approvals are one-use and exact-payload-bound. Bounded local RAG/tool trails synchronously persist distinct versioned streams and fail closed on quota, corruption, unsafe targets and competing-writer growth. | Guarded tool registry, policy, tool audit, RAG audit, and shared durable format | Authorization, schema, budget, approval binding, failure, and audit tests, plus restart, tamper, quota, concurrency and real-pipeline durable evidence | Provider-native calling, principal/approver authentication, domain ownership and network egress policy remain application responsibilities. The local trail is single-process; SHA-256 detects corruption but does not authenticate events, and the host owns permissions, rotation, retention, backup and external delivery. |
The Academy production preset normalizes all twelve declared boundaries and fails unless each has one explicit evidenced PASS. | ProductionPreset::academy and the Academy CLI diagnostic | Preset negatives, diagnostic normalization tests, process-level CLI tests, and CLI inventory contract | Evidence is caller-declared and the diagnostic always reports certification: false; it does not inspect a deployment, prove the declaration true, or replace independent review. |
| Live Alipay RSA2 verification and NFS-e homologation/production fail closed instead of returning simulated success. NFS-e local preparation separately enforces pinned XSDs, PKCS#12 XMLDSig, deterministic issuance JSON, bounded signed-authorization and structured-rejection parsing and bounded mTLS construction. | Alipay adapter, NFS-e signer, protocol codec, schema boundary, and NFS-e client | Alipay unsupported-path tests plus fiscal builder, signature verification, protocol binding/tamper/decompression negatives, official-artifact opt-in validation, and environment tests | Offline fixtures and local schema/cryptographic/protocol validity are not legal compliance, certificate trust, tax authorization, settlement, live response evidence, independent review, or provider homologation. |
Release use
Before an RC or stable release, reviewers should:
- run the linked tests through the workspace trifecta on the candidate SHA;
- attach multi-OS CI and packaged-distribution evidence to that same SHA;
- confirm the changelog uses the narrow claim wording above;
- keep every remaining boundary visible in the release notes; and
- leave the release at
NO-GOif a claimed control lacks matching evidence.
Threat assumptions and abuse cases live in the v12 threat models. The broader implementation/roadmap boundary lives in the capability ledger.