coulomb/risk-nexus
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

File and grade Emergent knowledge and Claude routing findings

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a102b3-d324-7ee3-a57a-702b4ae6a39b
This commit is contained in:
tegwick 2026-10-03 19:03:38 +02:00
parent 0b3cfb81c6
commit 55af2d09d5
4 changed files with 367 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
REGISTER.md
View file

@ -1,18 +1,21 @@
# Register
Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-09-22.
Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-10-03.
3 live of 12 findings; 3 notes below the floor.
6 live of 15 findings; 3 notes below the floor.
## Findings
| ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Cadence | Next check |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [RISK-F-0015](findings/RISK-F-0015-emergent-claude-owner-routing.md) | Retained Claude 0.2.1 answers misroute model-switch and zones questions | emergent-security | low | public | none | emergent-security | open | instant (0) | **due** |
| [RISK-F-0014](findings/RISK-F-0014-emergent-loaded-withdrawal-snapshot.md) | Loaded Emergent 0.2.1 continues serving a source after withdrawal and reseal | emergent-security | low | public | none | emergent-security | open | instant (0) | **due** |
| [RISK-F-0013](findings/RISK-F-0013-emergent-unsealed-card-receipt.md) | Loaded Emergent 0.2.1 returns unsealed card bytes under the reviewed digest | emergent-security | medium | public | none | emergent-security | open | instant (0) | **due** |
| [RISK-F-0012](findings/RISK-F-0012-e-invoice-receipt-and-retention.md) | The estate cannot show it receives and retains EN 16931 e-invoices | qonto-assistant | medium | public | none | qonto-assistant | open | instant (0) | **due** |
| [RISK-F-0011](findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md) | qonto-assistant audit.deny stream completeness is not established | qonto-assistant | medium | public | **pending** (t5, sent) | qonto-assistant | open | instant (0) | **due** |
| [RISK-F-0010](findings/RISK-F-0010-embedded-backup-webdav-credential.md) | Forgejo backup source embeds a WebDAV credential default | railiance-platform | low | public | none | railiance-platform | fixed | 1h (1) | **due** |
| [RISK-F-0009](findings/RISK-F-0009-openbao-deny-set-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | **high** | public | none | railiance-platform | fixed | instant (0) | **due** |
| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **answered** (t2, answered) | risk-nexus | accepted | 8h (2) | 2026-09-22 14:13Z |
| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **answered** (t2, answered) | risk-nexus | accepted | 8h (2) | **due** |
| [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | public | **answered** (t4, assigned) | per-consumer, on request | fixed | instant (0) | **due** |
| [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | public | **answered** (t3, answered) | railiance-platform | fixed | instant (0) | **due** |
| [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | public | none | audit-core | fixed | instant (0) | **due** |

122
findings/RISK-F-0013-emergent-unsealed-card-receipt.md Normal file
View file

@ -0,0 +1,122 @@
---
id: RISK-F-0013
type: finding
title: "Loaded Emergent 0.2.1 returns unsealed card bytes under the reviewed digest"
status: open
owner: risk-nexus
reported_by: whitehat-security
date_reported: "2026-10-03"
date_filed: "2026-10-03"
system: emergent-security
environment: build
fix_owner: emergent-security
reporter_reference: "WH-KNOW-001"
correlation: WHITEHAT-WP-0009-T03
fix_tracking: EMERGENT-WP-0002-T04
related: [RISK-F-0014, RISK-F-0015]
closure_condition: "EMERGENT-WP-0002-T07 accepts exact-digest remediation and review independence limits, with supported release use recorded"
severity: medium
severity_at_production: medium
impact: I2
likelihood: L2
fidelity_modifier: true
production_rescore: false
disclosure: public
escalation: none
last_checked: "2026-10-03T17:02:41Z"
next_check: "2026-10-03T17:02:41Z"
cadence: instant
clean_streak: 0
checked_by: "codex/risk-nexus"
graded_by: risk-nexus
ruling: "RISK-F-0013 register ruling 2026-10-03"
---
# RISK-F-0013
## What is true
On 0.2.1, constructing `Knowledge(bundle)`, changing a card and retrieving it
returned the replacement bytes with the original reviewed package digest.
Construction rejected a card changed beforehand. This is a validation/read
binding defect, not a grant of write access or effect authority.
It requires write access to the trusted bundle during use of an already loaded
object, or a concurrent change between validation and read. The report did not
test race timing or provider susceptibility. Fresh CLI construction narrows the
window; it does not bind the exact bytes returned.
On local 0.2.3 the same after-load mutation raised
`release content changed; review and reseal` and returned no bytes. The
original 0.2.1 pin continued to reproduce the defect. Owner T04 records the
implementation as done; T07 still owns remediation and independence acceptance.
## Register ruling — 2026-10-03
Provisional carried-defect grade: **medium**, `I2` × `L2` with the fidelity
modifier raising effective impact to `I3`. The same grade applies at production
on the stated prerequisites; no wider reach or estate-wide effect is assumed.
`I2` is recoverable corruption of one knowledge reader's input. The receipt
falsely binds unreviewed bytes to a reviewed release, so the fidelity modifier
applies. `L2` requires a separate bundle-write foothold. Synthetic reproduction
is not an incident and does not make reach `L4`.
This grade records the still-open 0.2.1 defect pending owner disposition. It
makes no claim that 0.2.3 returns unsealed content or that 0.2.1 is deployed.
The retest reduces the evidence of current exposure; it is recorded explicitly
rather than silently closing the finding. The grade/status changes when T07
accepts the exact-digest remediation and establishes the release in use, or
new evidence changes the write prerequisite or consequence.
**Public**, under the bounded build-mode default: the record identifies a
local library prerequisite, no live endpoint or additional route to write
access. No publication handover is made by this filing. **No escalation**:
no real tenant exposure, external obligation, new spend, disputed ownership or
fourteen-day stall is established.
## Owner disposition and closure
Suggested measure: return an immutable verified snapshot or validate the exact
returned bytes, with lifecycle invalidation. Work stays in T04/T07. Closure
requires T07's recorded acceptance of remediation for the exact 0.2.3 digest,
including the review's independence limit and the scope of release use. Until
then this finding remains open; provider, rollout and adoption gates remain
separate.
## Evidence and limits
Owner tracking read directly:
`emergent-security/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md`:
T04 `done`, T07 `wait`, workplan `blocked` on 2026-10-03. The current fix
tracker reports these task IDs as `unreadable` because their task blocks place
`title` between `id` and `status`; this filing uses the explicit file read,
not that parser result as evidence of absent tracking.
Reporter evidence (read from the sibling checkout):
- `whitehat-security/evidence/2026-10-03-emergent-021-offline-review.md`
- `whitehat-security/evidence/2026-10-03-emergent-023-offline-retest.md`
- `whitehat-security/workplans/WHITEHAT-WP-0009-emergent-knowledge-offline-review.md`, Required from risk-nexus
- Hub message `9cfdad0d-d531-4387-bf58-78b025dc77a4`; correlation `WHITEHAT-WP-0009-T03`.
The original release is 0.2.1, commit
`f9cba6fb35425f74e34401b1baf09f6057ace493`, package digest
`d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767`.
The local retest is 0.2.3, commit
`681144e5d4f59ef00418e7ae776e180b671f5d4d`, package digest
`60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5`.
These are package identities, not credential material.
Whitehat used synthetic copied bundles and the local implementation. Its
separate authorship shares the implementing session/model/workspace context;
it is not a separately authenticated Whitehat principal or institutional
assent. Risk-nexus read these records and the owner's existing plan; it did
not rerun probes. No live tenant boundary or deployed release was established.
A bounded passing retest does not certify the package or close owner T07.
The retest's `informed-decision` source-pin drift remains an owner acceptance
item; it is not evidence that either defect recurred.
## Reviews
- **2026-10-03** — filed and graded from reporter evidence and owner tracking.
Initial filing/movement; cadence remains instant, with no clean rung earned.

119
findings/RISK-F-0014-emergent-loaded-withdrawal-snapshot.md Normal file
View file

@ -0,0 +1,119 @@
---
id: RISK-F-0014
type: finding
title: "Loaded Emergent 0.2.1 continues serving a source after withdrawal and reseal"
status: open
owner: risk-nexus
reported_by: whitehat-security
date_reported: "2026-10-03"
date_filed: "2026-10-03"
system: emergent-security
environment: build
fix_owner: emergent-security
reporter_reference: "WH-KNOW-002"
correlation: WHITEHAT-WP-0009-T03
fix_tracking: EMERGENT-WP-0002-T04
related: [RISK-F-0013, RISK-F-0015]
closure_condition: "EMERGENT-WP-0002-T07 accepts exact-digest remediation and review independence limits, with supported release use recorded"
severity: low
severity_at_production: low
impact: I2
likelihood: L2
fidelity_modifier: false
production_rescore: false
disclosure: public
escalation: none
last_checked: "2026-10-03T17:02:41Z"
next_check: "2026-10-03T17:02:41Z"
cadence: instant
clean_streak: 0
checked_by: "codex/risk-nexus"
graded_by: risk-nexus
ruling: "RISK-F-0014 register ruling 2026-10-03"
---
# RISK-F-0014
## What is true
On 0.2.1, a loaded `Knowledge` object still served source content after an
authorized source withdrawal and reseal. It used the old digest; a fresh object
withheld the card. The published adapter required reload after source changes,
and the existing resume fixture constructed a fresh object. This is a loaded
snapshot lifecycle defect/contract gap, not a fresh CLI withdrawal failure or
a runtime permission bypass. It does not require an attacker authorized to
reseal a release.
On local 0.2.3 withdrawal and reseal made the loaded object raise
`release changed; reload the reviewed bundle` and return no content. A fresh
object withheld the card. The original 0.2.1 pin still reproduced the defect.
Owner T04 records implementation as done; T07 acceptance remains pending.
## Register ruling — 2026-10-03
Provisional carried-defect grade: **low**, `I2` × `L2`, also low at production
on the same facts. `I2` is one reader using withdrawn guidance, recoverable by
reload. No cross-tenant data or authorized effect is established. Here `L2`
is the non-adversarial trigger: a source lifecycle change while an object
remains loaded is an ordinary possible event within a review interval, mitigated
by the documented reload requirement. It is not shown to be occurring in real
use. **No fidelity modifier**: the old digest describes the old snapshot; the
report establishes stale lifecycle handling, not a false claim that a current
withdrawal was checked.
The grade covers the registered 0.2.1 behavior pending owner disposition and
does not assert that local 0.2.3 remains defective or that 0.2.1 is deployed.
The grade/status changes when T07 accepts exact-digest remediation and defines
the supported object lifetime/release use, or evidence shows a broader
consequence or an expected rather than possible trigger.
**Public**, bounded local lifecycle facts with no live access route. No
publication handover is made by this filing. **No escalation** under the five
triggers: owned, implementation moving, no real tenant exposure, outside duty,
new spend or ownership dispute established.
## Owner disposition and closure
Suggested measure: enforce object lifetime or reject a changed release/source
manifest. Resolve with RISK-F-0013 in the existing T04/T07 work; no duplicate
remediation plan. Closure requires the owner's T07 acceptance of exact-digest
remediation, object-lifetime contract and the evidence's independence limit.
A local passing retest is evidence toward closure, not acceptance itself.
## Evidence and limits
Owner tracking read directly:
`emergent-security/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md`:
T04 `done`, T07 `wait`, workplan `blocked` on 2026-10-03. The current fix
tracker reports these task IDs as `unreadable` because their task blocks place
`title` between `id` and `status`; this filing uses the explicit file read,
not that parser result as evidence of absent tracking.
Reporter evidence (read from the sibling checkout):
- `whitehat-security/evidence/2026-10-03-emergent-021-offline-review.md`
- `whitehat-security/evidence/2026-10-03-emergent-023-offline-retest.md`
- `whitehat-security/workplans/WHITEHAT-WP-0009-emergent-knowledge-offline-review.md`, Required from risk-nexus
- Hub message `9cfdad0d-d531-4387-bf58-78b025dc77a4`; correlation `WHITEHAT-WP-0009-T03`.
The original release is 0.2.1, commit
`f9cba6fb35425f74e34401b1baf09f6057ace493`, package digest
`d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767`.
The local retest is 0.2.3, commit
`681144e5d4f59ef00418e7ae776e180b671f5d4d`, package digest
`60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5`.
These are package identities, not credential material.
Whitehat used synthetic copied bundles and the local implementation. Its
separate authorship shares the implementing session/model/workspace context;
it is not a separately authenticated Whitehat principal or institutional
assent. Risk-nexus read these records and the owner's existing plan; it did
not rerun probes. No live tenant boundary or deployed release was established.
A bounded passing retest does not certify the package or close owner T07.
The retest's `informed-decision` source-pin drift remains an owner acceptance
item; it is not evidence that either defect recurred.
## Reviews
- **2026-10-03** — filed and graded from reporter evidence and owner tracking.
Initial filing/movement; cadence remains instant, with no clean rung earned.

120
findings/RISK-F-0015-emergent-claude-owner-routing.md Normal file
View file

@ -0,0 +1,120 @@
---
id: RISK-F-0015
type: finding
title: "Retained Claude 0.2.1 answers misroute model-switch and zones questions"
status: open
owner: risk-nexus
reported_by: whitehat-security
date_reported: "2026-10-03"
date_filed: "2026-10-03"
system: emergent-security
environment: build
fix_owner: emergent-security
reporter_reference: "Claude model-switch / zones"
correlation: WHITEHAT-WP-0009-T03
fix_tracking: EMERGENT-WP-0002-T07
related: [RISK-F-0013, RISK-F-0014]
closure_condition: "EMERGENT-WP-0002-T07 accepts complete current-release provider evidence resolving model-switch and zones owner routes"
severity: low
severity_at_production: low
impact: I1
likelihood: L3
fidelity_modifier: false
production_rescore: false
disclosure: public
escalation: none
last_checked: "2026-10-03T17:02:41Z"
next_check: "2026-10-03T17:02:41Z"
cadence: instant
clean_streak: 0
checked_by: "codex/risk-nexus"
graded_by: risk-nexus
ruling: "RISK-F-0015 register ruling 2026-10-03"
---
# RISK-F-0015
## What is true
Whitehat's review of the retained 0.2.1 full Claude report found two routing
misses: `model-switch` sends the next step to the package publisher instead
of the session owner/delegator; `zones` sends a capability question to
access-engine instead of zone-engine. The zones answer correctly denies a live
endpoint and HOT permission. No unsafe effect recommendation was observed.
Whitehat accepted 26/28 answers under its owner-specific rubric. The owner's
earlier 27/28 assessment remains a separate record. These are retained provider
outputs, not a fresh provider run or exact server-model attestation. The 0.2.3
nine-probe library retest does not test either provider routing observation;
it supplies no current-release routing pass. The owner plan requires renewed
provider evidence for 0.2.3 and keeps T05/T07 waiting.
## Classification and register ruling — 2026-10-03
**Finding, not note; low**, `I1` × `L3`, low at production on these facts, no
fidelity modifier. Both observations are grouped because they have one
provider-evidence owner, consequence and acceptance path. Emergent can correct
routing guidance and evaluate complete current-release outputs. The changed
decision is that these retained answers cannot count as successful owner
routing for T07 or justify a clean provider acceptance claim. Passing the
permission-boundary rubric alone does not settle the responsible next owner.
Thus both floor tests in `docs/method/severity.md` are met.
`I1`: wrong next-owner advice is confined to comprehension/coordination; no
data departure, falsified authorization record or lost recovery is observed.
`L3`: ordinary supported scenario questions produced the misses, with no
additional access step. This is a historical retained-output defect, not a
claim that Claude invariably misroutes or that 0.2.3 has been tested for it.
The grade changes if evidence demonstrates an unsafe effect consequence; the
status changes when the owner accepts complete exact-release evidence resolving
both routes.
**Public**: these observations provide no additional attack reach. No
publication handover is made by this filing. **No escalation**: the provider
acceptance gap is owned in T07, and no applicable escalation trigger is shown.
## Owner disposition and closure
Retain the full-report failures and resolve both next-owner routes in the
existing T05/T07 provider work. Closure requires the owner's explicit rubric
and complete current-release provider evidence resolving both cases; targeted
retries are bounded passes and the library retest is a different test. No new
provider call or rollout work is authorized by this finding.
## Evidence and limits
Owner tracking read directly:
`emergent-security/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md`:
T04 `done`, T07 `wait`, workplan `blocked` on 2026-10-03. The current fix
tracker reports these task IDs as `unreadable` because their task blocks place
`title` between `id` and `status`; this filing uses the explicit file read,
not that parser result as evidence of absent tracking.
Reporter evidence (read from the sibling checkout):
- `whitehat-security/evidence/2026-10-03-emergent-021-offline-review.md`
- `whitehat-security/evidence/2026-10-03-emergent-023-offline-retest.md`
- `whitehat-security/workplans/WHITEHAT-WP-0009-emergent-knowledge-offline-review.md`, Required from risk-nexus
- Hub message `9cfdad0d-d531-4387-bf58-78b025dc77a4`; correlation `WHITEHAT-WP-0009-T03`.
The original release is 0.2.1, commit
`f9cba6fb35425f74e34401b1baf09f6057ace493`, package digest
`d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767`.
The local retest is 0.2.3, commit
`681144e5d4f59ef00418e7ae776e180b671f5d4d`, package digest
`60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5`.
These are package identities, not credential material.
Whitehat used synthetic copied bundles and the local implementation. Its
separate authorship shares the implementing session/model/workspace context;
it is not a separately authenticated Whitehat principal or institutional
assent. Risk-nexus read these records and the owner's existing plan; it did
not rerun probes. No live tenant boundary or deployed release was established.
A bounded passing retest does not certify the package or close owner T07.
The retest's `informed-decision` source-pin drift remains an owner acceptance
item; it is not evidence that either defect recurred.
## Reviews
- **2026-10-03** — filed and graded from reporter evidence and owner tracking.
Initial filing/movement; cadence remains instant, with no clean rung earned.