From 967d7ab45fdad6e5ee02238e55b27812b4fc92c8 Mon Sep 17 00:00:00 2001 From: nicweyand Date: Sun, 13 Sep 2026 12:25:26 -0400 Subject: [PATCH] docs: record v0.4 release validation --- docs/VALIDATION.md | 47 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/docs/VALIDATION.md b/docs/VALIDATION.md index 062ce8f..6bb3593 100644 --- a/docs/VALIDATION.md +++ b/docs/VALIDATION.md @@ -1,5 +1,52 @@ # Validation +## Version 0.4.0 release and security validation, 2026-09-13 + +Implementation commit: `e26efc19fa7f73e63cd98cb32b446d1fe10eed40`, signed by +Nic Weyand. Version 0.4 completes plan phases 0 through 2: typed source coverage, +granular name/edge/equivalence trust, authenticated quorum votes, structured +observation batches, a bounded candidate observer, deterministic review queues, +drift classification, sticky revocation, and publisher-signed emergency feeds. +Writer stores migrate to schema version 5 and `argand.site-rules/v4`. + +Linux x86_64 with Rust/Cargo 1.98.1 and Python 3.14.7 passed: + +- Formatting, locked all-target compilation, Clippy with warnings denied, strict + API documentation, all 61 Rust tests and all eight Python source-release tests. +- Native CLI, reusable Rust and Python consumer parity across the five-source + synthetic fixture, including trust failures. +- The strict two-reviewer acceptance flow from source assertions through separate + name, edge and equivalence votes, observation replay, evidence invalidation, + drift, revocation, signed release, emergency-feed application, explicit + reinstatement, and policy-epoch revocation retention. +- Adversarial coverage for source-coverage forks and gaps, signature tampering, + future and expired decisions, duplicated physical reviewer keys, publisher key + reuse, stale and cross-generation revocation feeds, late observation inserts, + SSRF address classes, redirect loops, compressed bodies, extraction limits and + a deterministic 512-case parser mutation corpus. +- `cargo audit --deny warnings` scanned 1,243 RustSec advisories across 272 locked + dependencies without a finding. `systemd-analyze verify` accepted the observer + units; its sole output was an unrelated warning from the host's installed + `arch-audit.service`. + +Two source packages from the clean signed implementation commit were byte +identical. Receipt pin: +`a1614fcd44c91c5d842d2c391b2d31f530ab2fceed295aab834612cd885f8a19`. +Archive SHA-256: +`d260bfce000cc1d2e6fb81db4f9fda4a4b0727a729af1cab761fc46bda53bb17`. +The receipt verifier accepted both copies. The archive was extracted outside the +repository without Git metadata and passed the complete acceptance gate again. + +The final inventory was reviewed for credentials, private paths, datasets, +generated artifacts, unsafe Rust and unrelated changes. The 0.4 security review +found and fixed seven issues before release; no known critical, high or medium +finding remains in its reviewed scope. See +[SECURITY-REVIEW-0.4.md](SECURITY-REVIEW-0.4.md). + +No provider dataset was acquired or published, no production review or signing +key was used, and no Argand source tree, build cache, service or public route was +changed during implementation or validation. + ## Version 0.3.0 security validation, 2026-09-13 Implementation commit: `9705b01fe4bca201220c22aed7aab10c17abbf1d`, signed by