diff --git a/findings/RISK-F-0016-user-engine-os-runtime-findings.md b/findings/RISK-F-0016-user-engine-os-runtime-findings.md index 505ad3c..aa38d61 100644 --- a/findings/RISK-F-0016-user-engine-os-runtime-findings.md +++ b/findings/RISK-F-0016-user-engine-os-runtime-findings.md @@ -23,9 +23,9 @@ constraint_severity: ungraded constraint: "On the approved rollback to user-engine@sha256:312dcb06 — executing it (default if the renewal is not answered) restores an image that scans worse: 3 CRITICAL, 88 HIGH, 27 HIGH/CRITICAL CVEs (2026-10-14). Its exposure is unassessed; rollback must not be read as lowering this risk." graded_by: risk-nexus ruling: "RISK-F-0016 register ruling 2026-10-14" -checked_by: "claude/risk-nexus" -last_checked: "2026-10-14T07:33:04Z" -next_check: "2026-10-14T07:33:04Z" +checked_by: "worsch" +last_checked: "2026-10-14T07:42:48Z" +next_check: "2026-10-14T07:42:48Z" cadence: instant clean_streak: 0 --- @@ -122,3 +122,17 @@ either the founder's answer to the renewal or the executed rollback. ## Reviews - **2026-10-14** — not clean: first grading (low, I2 x L1, public, no escalation); 2026-10-14 rescan of f239 unchanged at 0 CRITICAL / 44 HIGH, 8 CVEs, no fixed versions; fix tracking moved to USER-WP-0038-T01; disposition expires 2026-10-18T23:59:59Z, renewal infd-20261014-user-engine-risk-renewal-r1 pending founder answer, not accepted. Cadence instant → instant; checked again immediately. + +## Renewed temporary disposition — 2026-10-14 + +The founder (platform-root) confirmed ACCEPT of infd-20261014-user-engine-risk-renewal-r1@1 +at 2026-10-14T07:37:00Z; approval 93e5081a-e6e2-4b83-8365-4d0164d93056, disposition +disp-77f38f7b-9380-4ad5-957f-a267305431d4 (native readback: +rapp-user-engine/docs/evidence/2026-10-14-risk-review/founder-disposition-readback.json). +The temporary acceptance of this finding's residual risk on image f239 now runs until the +earlier of 2026-11-15T23:59:59Z or the scoped rollout of the image remediated under +USER-WP-0038-T01. The rollback constraint above is no longer the default at 10-18. +Conditions carried by the memo: weekly rescans of f239; a new CRITICAL, known exploit or +available fix returns the decision early. The register's checks track this; no automatic +expiry is claimed. This is a human disposition, not a regrade. +- **2026-10-14** — not clean: founder renewed temporary disposition to 2026-11-15 or USER-WP-0038-T01 rollout (approval 93e5081a); weekly f239 rescans owed Cadence instant → instant; checked again immediately.