# Local security audit notes

Status date: 2026-07-30 (America/Chicago)

## Dependency audit

`pip-audit` checked the 21 locked runtime dependencies exported with hashes from
`uv.lock`. It reported zero known vulnerabilities.

- receipt: `evidence/python-dependency-audit-20260730.json`
- hashed input: `evidence/runtime-requirements-20260730.txt`

This is a point-in-time advisory-database result, not a guarantee that the
dependencies contain no vulnerabilities.

## Source scan

Bandit reported zero unsuppressed findings. Five source locations are explicitly
reviewed and excluded:

1. `sw1` is a public protocol version tag, not a password.
2. `action-approval` is a public state-machine token kind, not a password.
3. `action-ticket` is a public state-machine token kind, not a password.
4. importing `subprocess` is intentional because the module implements the
   subprocess enforcement adapter.
5. the subprocess call receives an absolute canonical argv whose complete
   SHA-256 digest must be present in the principal-signed allow rule, and it
   always uses `shell=False`.

The machine-readable receipt is
`evidence/python-static-security-audit-20260730.json`.

## Historical manual findings (2026-07-30)

- The explicit HTTP adapter checks DNS immediately before execution but does
  not pin the later socket to the checked answer.
- The reference recorder serializes threads, not multiple writer processes.
- An agent with a raw capability outside the adapter can bypass ScopeWrit.

The 2026-09-05 engineering revision addresses the first two findings with
literal-IP connection binding and OS-serialized recorder writes. Real socket,
TLS, four-process logging, and closure-recovery tests cover those changes.
Raw-capability bypass remains a deployment boundary. The older dependency
and Bandit results above have not been relabeled as a fresh security audit.
