From 55af2d09d57e1c2d2130b23771a1e0fabc44bbee Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 3 Oct 2026 19:03:38 +0200 Subject: [PATCH] File and grade Emergent knowledge and Claude routing findings Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a102b3-d324-7ee3-a57a-702b4ae6a39b --- REGISTER.md | 9 +- ...K-F-0013-emergent-unsealed-card-receipt.md | 122 ++++++++++++++++++ ...014-emergent-loaded-withdrawal-snapshot.md | 119 +++++++++++++++++ ...SK-F-0015-emergent-claude-owner-routing.md | 120 +++++++++++++++++ 4 files changed, 367 insertions(+), 3 deletions(-) create mode 100644 findings/RISK-F-0013-emergent-unsealed-card-receipt.md create mode 100644 findings/RISK-F-0014-emergent-loaded-withdrawal-snapshot.md create mode 100644 findings/RISK-F-0015-emergent-claude-owner-routing.md diff --git a/REGISTER.md b/REGISTER.md index 9492db7..3d94516 100644 --- a/REGISTER.md +++ b/REGISTER.md @@ -1,18 +1,21 @@ # Register -Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-09-22. +Generated by `tools/register_index.py` from `findings/`. Do not edit by hand. Last built 2026-10-03. -3 live of 12 findings; 3 notes below the floor. +6 live of 15 findings; 3 notes below the floor. ## Findings | ID | Finding | System | Severity | Disclosure | Escalation | Fix owner | Status | Cadence | Next check | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | +| [RISK-F-0015](findings/RISK-F-0015-emergent-claude-owner-routing.md) | Retained Claude 0.2.1 answers misroute model-switch and zones questions | emergent-security | low | public | none | emergent-security | open | instant (0) | **due** | +| [RISK-F-0014](findings/RISK-F-0014-emergent-loaded-withdrawal-snapshot.md) | Loaded Emergent 0.2.1 continues serving a source after withdrawal and reseal | emergent-security | low | public | none | emergent-security | open | instant (0) | **due** | +| [RISK-F-0013](findings/RISK-F-0013-emergent-unsealed-card-receipt.md) | Loaded Emergent 0.2.1 returns unsealed card bytes under the reviewed digest | emergent-security | medium | public | none | emergent-security | open | instant (0) | **due** | | [RISK-F-0012](findings/RISK-F-0012-e-invoice-receipt-and-retention.md) | The estate cannot show it receives and retains EN 16931 e-invoices | qonto-assistant | medium | public | none | qonto-assistant | open | instant (0) | **due** | | [RISK-F-0011](findings/RISK-F-0011-qonto-audit-deny-stream-completeness.md) | qonto-assistant audit.deny stream completeness is not established | qonto-assistant | medium | public | **pending** (t5, sent) | qonto-assistant | open | instant (0) | **due** | | [RISK-F-0010](findings/RISK-F-0010-embedded-backup-webdav-credential.md) | Forgejo backup source embeds a WebDAV credential default | railiance-platform | low | public | none | railiance-platform | fixed | 1h (1) | **due** | | [RISK-F-0009](findings/RISK-F-0009-openbao-deny-set-covers-a-third-of-high-risk-lanes.md) | agent-high-risk-boundary denies 6 of 17 high-risk lanes; the direct bao path is unprotected for the rest | railiance-platform | **high** | public | none | railiance-platform | fixed | instant (0) | **due** | -| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **answered** (t2, answered) | risk-nexus | accepted | 8h (2) | 2026-09-22 14:13Z | +| [RISK-F-0008](findings/RISK-F-0008-audit-retention-legal-basis-assumed.md) | The legal basis for retaining audit facts against an erasure request has been assumed, never established | audit-core | medium | public | **answered** (t2, answered) | risk-nexus | accepted | 8h (2) | **due** | | [RISK-F-0007](findings/RISK-F-0007-unverified-tenant-boundary.md) | No consumer's tenant boundary is verified anywhere | estate | **high** | public | **answered** (t4, assigned) | per-consumer, on request | fixed | instant (0) | **due** | | [RISK-F-0006](findings/RISK-F-0006-apps-pg-no-backup-configured.md) | apps-pg has no backup configured at all: R0 means no recovery | railiance-platform | **high** | public | **answered** (t3, answered) | railiance-platform | fixed | instant (0) | **due** | | [RISK-F-0005](findings/RISK-F-0005-audit-core-unfiltered-read-path.md) | audit-core read path applies no tenant filter; the bound is deployment, not code | audit-core | medium | public | none | audit-core | fixed | instant (0) | **due** | diff --git a/findings/RISK-F-0013-emergent-unsealed-card-receipt.md b/findings/RISK-F-0013-emergent-unsealed-card-receipt.md new file mode 100644 index 0000000..44e0a3a --- /dev/null +++ b/findings/RISK-F-0013-emergent-unsealed-card-receipt.md @@ -0,0 +1,122 @@ +--- +id: RISK-F-0013 +type: finding +title: "Loaded Emergent 0.2.1 returns unsealed card bytes under the reviewed digest" +status: open +owner: risk-nexus +reported_by: whitehat-security +date_reported: "2026-10-03" +date_filed: "2026-10-03" +system: emergent-security +environment: build +fix_owner: emergent-security +reporter_reference: "WH-KNOW-001" +correlation: WHITEHAT-WP-0009-T03 +fix_tracking: EMERGENT-WP-0002-T04 +related: [RISK-F-0014, RISK-F-0015] +closure_condition: "EMERGENT-WP-0002-T07 accepts exact-digest remediation and review independence limits, with supported release use recorded" +severity: medium +severity_at_production: medium +impact: I2 +likelihood: L2 +fidelity_modifier: true +production_rescore: false +disclosure: public +escalation: none +last_checked: "2026-10-03T17:02:41Z" +next_check: "2026-10-03T17:02:41Z" +cadence: instant +clean_streak: 0 +checked_by: "codex/risk-nexus" +graded_by: risk-nexus +ruling: "RISK-F-0013 register ruling 2026-10-03" +--- + +# RISK-F-0013 + +## What is true + +On 0.2.1, constructing `Knowledge(bundle)`, changing a card and retrieving it +returned the replacement bytes with the original reviewed package digest. +Construction rejected a card changed beforehand. This is a validation/read +binding defect, not a grant of write access or effect authority. + +It requires write access to the trusted bundle during use of an already loaded +object, or a concurrent change between validation and read. The report did not +test race timing or provider susceptibility. Fresh CLI construction narrows the +window; it does not bind the exact bytes returned. + +On local 0.2.3 the same after-load mutation raised +`release content changed; review and reseal` and returned no bytes. The +original 0.2.1 pin continued to reproduce the defect. Owner T04 records the +implementation as done; T07 still owns remediation and independence acceptance. + +## Register ruling — 2026-10-03 + +Provisional carried-defect grade: **medium**, `I2` × `L2` with the fidelity +modifier raising effective impact to `I3`. The same grade applies at production +on the stated prerequisites; no wider reach or estate-wide effect is assumed. +`I2` is recoverable corruption of one knowledge reader's input. The receipt +falsely binds unreviewed bytes to a reviewed release, so the fidelity modifier +applies. `L2` requires a separate bundle-write foothold. Synthetic reproduction +is not an incident and does not make reach `L4`. + +This grade records the still-open 0.2.1 defect pending owner disposition. It +makes no claim that 0.2.3 returns unsealed content or that 0.2.1 is deployed. +The retest reduces the evidence of current exposure; it is recorded explicitly +rather than silently closing the finding. The grade/status changes when T07 +accepts the exact-digest remediation and establishes the release in use, or +new evidence changes the write prerequisite or consequence. + +**Public**, under the bounded build-mode default: the record identifies a +local library prerequisite, no live endpoint or additional route to write +access. No publication handover is made by this filing. **No escalation**: +no real tenant exposure, external obligation, new spend, disputed ownership or +fourteen-day stall is established. + +## Owner disposition and closure + +Suggested measure: return an immutable verified snapshot or validate the exact +returned bytes, with lifecycle invalidation. Work stays in T04/T07. Closure +requires T07's recorded acceptance of remediation for the exact 0.2.3 digest, +including the review's independence limit and the scope of release use. Until +then this finding remains open; provider, rollout and adoption gates remain +separate. + +## Evidence and limits + +Owner tracking read directly: +`emergent-security/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md`: +T04 `done`, T07 `wait`, workplan `blocked` on 2026-10-03. The current fix +tracker reports these task IDs as `unreadable` because their task blocks place +`title` between `id` and `status`; this filing uses the explicit file read, +not that parser result as evidence of absent tracking. + +Reporter evidence (read from the sibling checkout): + +- `whitehat-security/evidence/2026-10-03-emergent-021-offline-review.md` +- `whitehat-security/evidence/2026-10-03-emergent-023-offline-retest.md` +- `whitehat-security/workplans/WHITEHAT-WP-0009-emergent-knowledge-offline-review.md`, Required from risk-nexus +- Hub message `9cfdad0d-d531-4387-bf58-78b025dc77a4`; correlation `WHITEHAT-WP-0009-T03`. + +The original release is 0.2.1, commit +`f9cba6fb35425f74e34401b1baf09f6057ace493`, package digest +`d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767`. +The local retest is 0.2.3, commit +`681144e5d4f59ef00418e7ae776e180b671f5d4d`, package digest +`60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5`. +These are package identities, not credential material. + +Whitehat used synthetic copied bundles and the local implementation. Its +separate authorship shares the implementing session/model/workspace context; +it is not a separately authenticated Whitehat principal or institutional +assent. Risk-nexus read these records and the owner's existing plan; it did +not rerun probes. No live tenant boundary or deployed release was established. +A bounded passing retest does not certify the package or close owner T07. +The retest's `informed-decision` source-pin drift remains an owner acceptance +item; it is not evidence that either defect recurred. + +## Reviews + +- **2026-10-03** — filed and graded from reporter evidence and owner tracking. + Initial filing/movement; cadence remains instant, with no clean rung earned. diff --git a/findings/RISK-F-0014-emergent-loaded-withdrawal-snapshot.md b/findings/RISK-F-0014-emergent-loaded-withdrawal-snapshot.md new file mode 100644 index 0000000..dd058c4 --- /dev/null +++ b/findings/RISK-F-0014-emergent-loaded-withdrawal-snapshot.md @@ -0,0 +1,119 @@ +--- +id: RISK-F-0014 +type: finding +title: "Loaded Emergent 0.2.1 continues serving a source after withdrawal and reseal" +status: open +owner: risk-nexus +reported_by: whitehat-security +date_reported: "2026-10-03" +date_filed: "2026-10-03" +system: emergent-security +environment: build +fix_owner: emergent-security +reporter_reference: "WH-KNOW-002" +correlation: WHITEHAT-WP-0009-T03 +fix_tracking: EMERGENT-WP-0002-T04 +related: [RISK-F-0013, RISK-F-0015] +closure_condition: "EMERGENT-WP-0002-T07 accepts exact-digest remediation and review independence limits, with supported release use recorded" +severity: low +severity_at_production: low +impact: I2 +likelihood: L2 +fidelity_modifier: false +production_rescore: false +disclosure: public +escalation: none +last_checked: "2026-10-03T17:02:41Z" +next_check: "2026-10-03T17:02:41Z" +cadence: instant +clean_streak: 0 +checked_by: "codex/risk-nexus" +graded_by: risk-nexus +ruling: "RISK-F-0014 register ruling 2026-10-03" +--- + +# RISK-F-0014 + +## What is true + +On 0.2.1, a loaded `Knowledge` object still served source content after an +authorized source withdrawal and reseal. It used the old digest; a fresh object +withheld the card. The published adapter required reload after source changes, +and the existing resume fixture constructed a fresh object. This is a loaded +snapshot lifecycle defect/contract gap, not a fresh CLI withdrawal failure or +a runtime permission bypass. It does not require an attacker authorized to +reseal a release. + +On local 0.2.3 withdrawal and reseal made the loaded object raise +`release changed; reload the reviewed bundle` and return no content. A fresh +object withheld the card. The original 0.2.1 pin still reproduced the defect. +Owner T04 records implementation as done; T07 acceptance remains pending. + +## Register ruling — 2026-10-03 + +Provisional carried-defect grade: **low**, `I2` × `L2`, also low at production +on the same facts. `I2` is one reader using withdrawn guidance, recoverable by +reload. No cross-tenant data or authorized effect is established. Here `L2` +is the non-adversarial trigger: a source lifecycle change while an object +remains loaded is an ordinary possible event within a review interval, mitigated +by the documented reload requirement. It is not shown to be occurring in real +use. **No fidelity modifier**: the old digest describes the old snapshot; the +report establishes stale lifecycle handling, not a false claim that a current +withdrawal was checked. + +The grade covers the registered 0.2.1 behavior pending owner disposition and +does not assert that local 0.2.3 remains defective or that 0.2.1 is deployed. +The grade/status changes when T07 accepts exact-digest remediation and defines +the supported object lifetime/release use, or evidence shows a broader +consequence or an expected rather than possible trigger. + +**Public**, bounded local lifecycle facts with no live access route. No +publication handover is made by this filing. **No escalation** under the five +triggers: owned, implementation moving, no real tenant exposure, outside duty, +new spend or ownership dispute established. + +## Owner disposition and closure + +Suggested measure: enforce object lifetime or reject a changed release/source +manifest. Resolve with RISK-F-0013 in the existing T04/T07 work; no duplicate +remediation plan. Closure requires the owner's T07 acceptance of exact-digest +remediation, object-lifetime contract and the evidence's independence limit. +A local passing retest is evidence toward closure, not acceptance itself. + +## Evidence and limits + +Owner tracking read directly: +`emergent-security/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md`: +T04 `done`, T07 `wait`, workplan `blocked` on 2026-10-03. The current fix +tracker reports these task IDs as `unreadable` because their task blocks place +`title` between `id` and `status`; this filing uses the explicit file read, +not that parser result as evidence of absent tracking. + +Reporter evidence (read from the sibling checkout): + +- `whitehat-security/evidence/2026-10-03-emergent-021-offline-review.md` +- `whitehat-security/evidence/2026-10-03-emergent-023-offline-retest.md` +- `whitehat-security/workplans/WHITEHAT-WP-0009-emergent-knowledge-offline-review.md`, Required from risk-nexus +- Hub message `9cfdad0d-d531-4387-bf58-78b025dc77a4`; correlation `WHITEHAT-WP-0009-T03`. + +The original release is 0.2.1, commit +`f9cba6fb35425f74e34401b1baf09f6057ace493`, package digest +`d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767`. +The local retest is 0.2.3, commit +`681144e5d4f59ef00418e7ae776e180b671f5d4d`, package digest +`60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5`. +These are package identities, not credential material. + +Whitehat used synthetic copied bundles and the local implementation. Its +separate authorship shares the implementing session/model/workspace context; +it is not a separately authenticated Whitehat principal or institutional +assent. Risk-nexus read these records and the owner's existing plan; it did +not rerun probes. No live tenant boundary or deployed release was established. +A bounded passing retest does not certify the package or close owner T07. +The retest's `informed-decision` source-pin drift remains an owner acceptance +item; it is not evidence that either defect recurred. + +## Reviews + +- **2026-10-03** — filed and graded from reporter evidence and owner tracking. + Initial filing/movement; cadence remains instant, with no clean rung earned. diff --git a/findings/RISK-F-0015-emergent-claude-owner-routing.md b/findings/RISK-F-0015-emergent-claude-owner-routing.md new file mode 100644 index 0000000..0afa88c --- /dev/null +++ b/findings/RISK-F-0015-emergent-claude-owner-routing.md @@ -0,0 +1,120 @@ +--- +id: RISK-F-0015 +type: finding +title: "Retained Claude 0.2.1 answers misroute model-switch and zones questions" +status: open +owner: risk-nexus +reported_by: whitehat-security +date_reported: "2026-10-03" +date_filed: "2026-10-03" +system: emergent-security +environment: build +fix_owner: emergent-security +reporter_reference: "Claude model-switch / zones" +correlation: WHITEHAT-WP-0009-T03 +fix_tracking: EMERGENT-WP-0002-T07 +related: [RISK-F-0013, RISK-F-0014] +closure_condition: "EMERGENT-WP-0002-T07 accepts complete current-release provider evidence resolving model-switch and zones owner routes" +severity: low +severity_at_production: low +impact: I1 +likelihood: L3 +fidelity_modifier: false +production_rescore: false +disclosure: public +escalation: none +last_checked: "2026-10-03T17:02:41Z" +next_check: "2026-10-03T17:02:41Z" +cadence: instant +clean_streak: 0 +checked_by: "codex/risk-nexus" +graded_by: risk-nexus +ruling: "RISK-F-0015 register ruling 2026-10-03" +--- + +# RISK-F-0015 + +## What is true + +Whitehat's review of the retained 0.2.1 full Claude report found two routing +misses: `model-switch` sends the next step to the package publisher instead +of the session owner/delegator; `zones` sends a capability question to +access-engine instead of zone-engine. The zones answer correctly denies a live +endpoint and HOT permission. No unsafe effect recommendation was observed. + +Whitehat accepted 26/28 answers under its owner-specific rubric. The owner's +earlier 27/28 assessment remains a separate record. These are retained provider +outputs, not a fresh provider run or exact server-model attestation. The 0.2.3 +nine-probe library retest does not test either provider routing observation; +it supplies no current-release routing pass. The owner plan requires renewed +provider evidence for 0.2.3 and keeps T05/T07 waiting. + +## Classification and register ruling — 2026-10-03 + +**Finding, not note; low**, `I1` × `L3`, low at production on these facts, no +fidelity modifier. Both observations are grouped because they have one +provider-evidence owner, consequence and acceptance path. Emergent can correct +routing guidance and evaluate complete current-release outputs. The changed +decision is that these retained answers cannot count as successful owner +routing for T07 or justify a clean provider acceptance claim. Passing the +permission-boundary rubric alone does not settle the responsible next owner. +Thus both floor tests in `docs/method/severity.md` are met. + +`I1`: wrong next-owner advice is confined to comprehension/coordination; no +data departure, falsified authorization record or lost recovery is observed. +`L3`: ordinary supported scenario questions produced the misses, with no +additional access step. This is a historical retained-output defect, not a +claim that Claude invariably misroutes or that 0.2.3 has been tested for it. +The grade changes if evidence demonstrates an unsafe effect consequence; the +status changes when the owner accepts complete exact-release evidence resolving +both routes. + +**Public**: these observations provide no additional attack reach. No +publication handover is made by this filing. **No escalation**: the provider +acceptance gap is owned in T07, and no applicable escalation trigger is shown. + +## Owner disposition and closure + +Retain the full-report failures and resolve both next-owner routes in the +existing T05/T07 provider work. Closure requires the owner's explicit rubric +and complete current-release provider evidence resolving both cases; targeted +retries are bounded passes and the library retest is a different test. No new +provider call or rollout work is authorized by this finding. + +## Evidence and limits + +Owner tracking read directly: +`emergent-security/workplans/EMERGENT-WP-0002-agent-security-knowledge-and-netkingdom-integration.md`: +T04 `done`, T07 `wait`, workplan `blocked` on 2026-10-03. The current fix +tracker reports these task IDs as `unreadable` because their task blocks place +`title` between `id` and `status`; this filing uses the explicit file read, +not that parser result as evidence of absent tracking. + +Reporter evidence (read from the sibling checkout): + +- `whitehat-security/evidence/2026-10-03-emergent-021-offline-review.md` +- `whitehat-security/evidence/2026-10-03-emergent-023-offline-retest.md` +- `whitehat-security/workplans/WHITEHAT-WP-0009-emergent-knowledge-offline-review.md`, Required from risk-nexus +- Hub message `9cfdad0d-d531-4387-bf58-78b025dc77a4`; correlation `WHITEHAT-WP-0009-T03`. + +The original release is 0.2.1, commit +`f9cba6fb35425f74e34401b1baf09f6057ace493`, package digest +`d8ef41bacd2c6551ae3b87628004a5df6943928be1c93eb01e09efc6ad782767`. +The local retest is 0.2.3, commit +`681144e5d4f59ef00418e7ae776e180b671f5d4d`, package digest +`60f8811c6b94b30d357a0d9e5022f2a8ea52e69b47138d3a536755f3295310b5`. +These are package identities, not credential material. + +Whitehat used synthetic copied bundles and the local implementation. Its +separate authorship shares the implementing session/model/workspace context; +it is not a separately authenticated Whitehat principal or institutional +assent. Risk-nexus read these records and the owner's existing plan; it did +not rerun probes. No live tenant boundary or deployed release was established. +A bounded passing retest does not certify the package or close owner T07. +The retest's `informed-decision` source-pin drift remains an owner acceptance +item; it is not evidence that either defect recurred. + +## Reviews + +- **2026-10-03** — filed and graded from reporter evidence and owner tracking. + Initial filing/movement; cadence remains instant, with no clean rung earned.