Every audit cycle, in full.

Controls held

• RB1 concurrency/rate: per-org global rate limiter + route toolLimiter + agent loop MAX_ITERATIONS=3.
• RB2 (fixed): gemini_generate + perplexity_research default to propose-first (no unbounded paid-API spend), red-proven pin; live.
• RB3 (fixed): ssh command bounded by EXEC_TIMEOUT_MS=120s + capStreamOutput 1MB/stream, red-proven pin; live. Connector calls already timeout; results truncated.
• RB4 (fixed): telegram outboundQueue depth cap (a fleet host) shed, live. Scheduler triad present across feed/inboxq/quoxseo/reach/reflection/telegram/x pollers.

Controls held

• AU1 single-use: atomic claimForResume + bastion nonce (pinned approvalGateGrantSingleUse / qlusterDelegationStore).
• AU2 expiry: use-time revalidation collector + bastion (pinned toolResumeFailClosed 'T-AUTH expiry revalidation').
• AU3 revocation-at-use: explicit deny through the same atomic claim gate (pinned).
• AU4 scope+binding: unknown-agent denies (quox#556); bastion MatchesTool = ToolID+ParamsSHA256+targets; approval fingerprint binds action (pinned approvalGateInputBinding).
• AU5 credential least-privilege + JIT lease: declared-type-scoped resolution; getActiveLease filters expires_at>now + atomic use-increment.

Controls held

• ET1 chain completeness/gap-detection: verifyChain returns SEQ_INVALID on a deleted/omitted entry (live throwaway-DB test + new red-proven pin); no DELETE/UPDATE on ward_entries.
• ET2 no silent reorder: ordering hash-bound (seq + prev_chain_hash), not timestamp-trust.
• ET3 action-binding: witness hash binds payload_commit -> canonical_action (tool/tenant/identity/content_commit/outcome); payload-exclusion bug fixed (hooks.js).
• ET4 recompute fails closed: export-security-audit.mjs re-derives + throws on mismatch (exit 1; fail-closed if key unprovisioned); ward-verify EXIT_BROKEN=1.

Controls held

• IN1 clean: no eval/Function/vm sink for model output; remote_ssh read-allowlist + approval; db_query parameterised + read-only/gated.
• IN2 clean: email_send always-propose + fingerprint binds to/cc/bcc/subject/body (resume refuses on change); resolveToolOrgId locks org to authenticated ctx.
• IN3 fixed: browserActions.validateUrl blocks loopback/private/link-local/metadata (honours SCREENCAP_ALLOWED_PRIVATE); red-proven pin; deploy-verify in running quox-screencap.
• IN4 clean: single referenceMonitor.mediateGovernancePolicy chokepoint, effect-based gating, untrusted retrieved content cannot trigger an ungated effect.

Controls held

• CF1 (fixed): collector tool-input logging redacted via summarizeToolInputForLog (secret keys masked, free-text reduced to length, nested to shape), red-proven pin; deployed + verified in running collector.
• CF2 (clean): credentials resolved by credential_id reference, raw secret never in tool input or response; vault tools echo metadata only.
• CF3 (clean): mandatory execution evidence always stored + witnessed regardless of transcript retention; receipts are content-free commitments (digest + per-field hashes).
• CA2 (pass): quoxagent install.sh verifies BINARY_SHA256 and refuses on mismatch (exit 1; bypass needs explicit flag).
• T-ART dep (fixed): @anthropic-ai/claude-code pinned @2.1.197 in the collector Dockerfile.

Controls held

• PB3 (must-fix): commanderq compliance/governance tools route org through resolveToolOrgId(ctx,input) (authenticated org wins), verified LIVE in quox-collector (0 inverted patterns, resolveToolOrgId present).
• PB1 F6 bastion key grant fail-closed (origin/main).
• PB2 F7/RR5 quoxagent replay freshness + durable seen-set (origin/main).
• PB4 fail-closed collector gates, running container sha byte-identical to origin/main.
• PA5 half: quoxagent heartbeat reports the real build version (Options.AgentVersion wired; red-proven pin).

Controls held

• RR5 (the must-fix): quoxagent replay seen-set is now DURABLE (persisted to DataDir atomically, restored at boot), a restart no longer reopens the 15-min replay window on /jobs or /dev/invoke. Best-effort write so a disk fault cannot DoS the agent. Deployed as v84780f4.
• RR1 evidence/WARD store down: collector counts + surfaces audit-write failures (recordAuditWriteFailure, /health + /metrics) instead of a silent skip, verified in the running quox-collector.
• RR2 policy store down: collector fails closed on storeResult.unavailable (approvalGate) and returns policy_unavailable on governance exception (quoxchat), verified in the running container.
• RR3 external-effect crash-after-send: executionLedger durable claim before dispatch; reconcileOnBoot flips dispatched -> outcome_unknown, no retry, states enumerated, verified live.
• RR4 restart mid-dispatch: toolApprovalStore single atomic claim (SQLite-durable, replay -> null), reconciled at boot, verified live.
• RR2-bastion grant verification: fails closed on zero trusted keys / verify error (internal/approval/grant.go).

Controls held

• MF-1: bastion DELETE /keys/{id} revoke now requires the collector-signed approval grant (F6 sibling closed), live the bastion host, running-exe verified.
• MF-2: native externalEffect tools (alerts_manage silence, backup_run, keeper_backup_create, deploy_template) default to HITL via AGENT_ALWAYS_PROPOSE + withApprovalGate, with non-blind T4 cards, NOT blanket-gated, live in the running collector.
• MF-3: github-proxy write routes routed through the executeConnectorTool governance choke (policy/approval/ledger/WARD); generate-notes via mediateGovernancePolicy + WARD, live in the running collector.
• MF-4: quoxagent /dev/invoke verifies signature before freshness (loopback pre-consumption DoS closed), live 34/36 fleet.
• hat_load_bundle classified (QuoxHat P4, option A: within-envelope capability selection, witnessed, not an external effect), T9 pin green.

Controls held

• Cross-tenant isolation made platform-wide: org derived from authenticated identity, never caller-supplied body/header, across ~8 header-routes + the native-tool route + security/compliance routes + vault-credential path (FND resolved).
• Arbitrary shell/SQL (ssh_exec, remote_ssh, db_query writes) and the wider bastion-tool shell-injection class now require human approval and are input-validated (multiple criticals resolved).
• Approval cards render the exact effective action (to/cc/bcc/subject/body, command, SQL), no blind-approve (T4).
• Fail-closed gates: 4-eyes policy-change gate no longer fails open on audit-write error; WARD witness no longer silently no-ops; GOV-4 store outage denies (T2).
• Signature integrity: AEE signature scope now covers HITL gate fields; approval_events chain covers action/actor; offline verifier binds key_id (T8).
• F6 DEPLOYED: bastion keys/deploy + sudo/setup gated behind the collector-signed approval grant (parallel path closed).
• F7 DEPLOYED: quoxagent /jobs + /dev/invoke replay/freshness guard keyed on the SIGNED CreatedAt (dc25995, 34/36 hosts).

Controls held

• Complete mediation held: every scan minted and presented a bastion approval grant scoped to the exact command and target host; an out-of-scope subdomain probe was refused by the scope gate, not executed.
• Fail-closed held under real load: when the grant-mint policy callback timed out, the scan was refused rather than run ungranted.
• Proof-of-control enforced before any scan: a target that had not proven control (DNS or well-known challenge) could not be scanned.
• Discovery-tier ceiling enforced: production engagements cap at discovery, so no intrusive or exploit tooling ran against a live customer site.

Controls held

• Every fix is pinned by a required, non-continue-on-error CI gate that runs the invariant suites across two packages and is proven to exit non-zero on a deliberately broken candidate, so a reopened fail-open gate, an unwitnessed receipt or an ungated effect path goes red before it can merge
• The reference monitor now sits at both the native and the connector choke, and a governance deny takes precedence over the entitlement and rate checks, so no connector caller, direct route or delegated agent, can reach an effect the org policy forbids
• The durable execution ledger reconciles in-flight effects on boot and refuses to dispatch when its own durable write fails, so an ambiguous external send is recorded as outcome-unknown rather than silently lost or blindly retried
• The fixes were verified test-first and on the running deployment, not only in unit tests; each of the six runtime findings was re-checked in the running collector after its fix
• No secret values were disclosed by any finding in this cycle; the findings are structural properties of the enforcement path, not leaked credentials
• The published log recomputes each WARD receipt at publish time and is Ed25519-signed and verified in CI and in the production build, so a fabricated entry needs the signing key, not merely an internally consistent shape

Controls held

• The fixes were verified test-first and on the running deployment, not only in unit tests; the three launch-blocking routes were re-checked live and refused another org's data after the fix
• Where the collector authentication gate was present it held; the cross-tenant findings were routes that lacked the gate or trusted a client-supplied org id, never the gate itself being defeated
• The publish-path evidence check held: recomputing each cycle's WARD chain against the live store at publish time is intact, and the allowlist projection that lets only title, severity and status reach the page is unchanged
• Once fixed, the approval path and per-agent RBAC refused the escalations they had allowed: an under-approved bulk response and a destructive action on the legacy gate now stop rather than proceed
• No secret values were disclosed by the findings above; the one leak was a host prefix in placeholder copy, corrected, not a credential

Controls held

• The collector authentication gate held: unauthenticated requests were refused before any org data was returned on every route checked
• A signed-in caller could not widen their scope with a client-supplied org id or org header on any fixed route; the override is honoured only for trusted service callers
• The auth service enforced organisation membership as a second, independent gate on the Action Tracker proxy
• A route with no resolvable organisation returned an empty result, never a global fallback, and a record owned by another org read as not-found rather than disclosing its existence
• The isolation fixes were proven against the deployed containers, not only in unit tests, with the org id read from a verified token rather than any client-supplied value

Controls held

• Vault envelope encryption held end to end; no secret values in logs or API responses
• Tenant scoping held on vault, memory, HITL and admin paths (queries traced, not assumed)
• Privilege-escalation guards held on both role paths
• Job-envelope signing fails closed; delimiter injection previously found is fixed
• No phone-home beyond the disclosed heartbeat and license check, and the heartbeat is now strictly opt-in
• Agent RBAC held during the fix sweep itself: the builder-role agent session was refused allowlist changes and could not approve its own gated actions