2026-08-14 — Sprint 1 current-tree security verification

Status

Sprint 1 code changes remain uncommitted. Local verification is complete and passing, and the exact-current-tree independent reviewer gate is closed. The separate live-operation gate is pending. No commit, push, deploy, credential/JWT rotation, or public-access change was performed.

Latest remediation

After the earlier password-policy finding, the current tree also closes these response and tenant-boundary classes:

UserStore and HTTP/admin password paths share the 12-character minimum; weak/non-string credentials fail before mutation.
User/admin serialization uses a closed allowlist; password_hash and future internal user fields are omitted from listing and mutation responses.
Authenticated group/private-persona mutations reject missing tenant identity instead of falling back to org-default.
Admin organization plan, seats, active, and new_org inputs use strict types.
Provider-controlled final judge output is constrained to a closed debrief envelope.
Chat session start/resume/send/finish/list/get responses use a closed session serializer and omit user_id, hidden internal judge state, provider metadata, and unknown message fields.
Group serializers fail closed for malformed stored input/persona shapes; legacy group errors remain fixed public codes.
A bounded exact-tree review (deleg_fccee30d) identified that organization admin PATCH updates used a read-modify-write path without cross-process locking; JsonStore.update() now uses the same per-record process lock as conditional updates.
test_org_updates_preserve_concurrent_fields_across_processes reproduces the stale-read race and verifies that concurrent active and seats changes both persist.

The deferred private-group filesystem scan/create collection race remains a Sprint 2/S2.1 task and is not represented as fixed.

Verification evidence

Executed from the repository root:

backend/.venv/bin/python -m pytest backend/tests -q
97 passed in 23.50s

This is the post-remediation exact current-tree run after the organization
admin update race fix. The earlier completed background run, `proc_ba80f06ca949`,
returned `91 passed in 928.85s (0:15:28)` and is retained as historical
supporting evidence.

Another earlier background run, `proc_efcee6c93382`, returned `93 passed in
23.11s` before the current collection state and is also historical supporting
evidence.

backend/scripts/test_*.py
12/12 passed

cd frontend && npm run build
passed; 1,772 modules transformed

backend/.venv/bin/python -m compileall -q backend/app backend/tests backend/scripts
AST parse + git diff --check
passed

Added-line security scan:
hardcoded_secret=0
shell_injection=0
eval_exec=0
pickle=0
sql_format=0

Additional focused checks for the latest response-boundary changes passed, including user-list redaction, provider-debrief allowlisting, session-internal redaction, malformed group serialization, strict organization field types, and tenant fallback removal.

Reviewer and operational gates

The exact-tree read-only reviewer deleg_6e386e71 timed out after 600.19 seconds and returned no schema-valid JSON. The earlier two-workstream batch, deleg_da73aca4, also timed out in both workstreams. The bounded exact-tree reviewer deleg_fccee30d returned schema-valid passed=false and found one concrete cross-process organization-update race: JsonStore.update() lacked a process lock. That finding was remediated in backend/app/storage/store.py and covered by the new regression test above. The fresh post-remediation exact-tree reviewer deleg_7bcf0dfd returned the required schema-valid verdict passed=true, with security_concerns=[] and logic_errors=[]. This closes the Sprint 1 code/reviewer gate. Prior reviewer timeouts, packet/scoped verdicts, and delegation completion status are not approval.

Docker is unavailable locally. Real-provider LLM QA, browser/mobile QA, restricted deployment, bootstrap credential change, JWT_SECRET rotation, audit inspection, and authenticated smoke have not been run. Public/untrusted access must remain disabled.

Next action

The next gate is the separate operator-approved restricted deployment and credential/JWT rotation checklist. Do not restore public/untrusted access or start Sprint 2 until that live-operation gate is explicitly completed.

4.3 KiB Raw Blame History