Nine adversarial trust bars. Each one attacked, each fix proven on the running system, each result independently recomputable from signed evidence.

Certifies

No bypassable release-blocker on the frozen release surface, with every trust-property boundary verified on the running systems, not just the source.

Attack

An independent adversarial pass over the whole frozen release surface: collector, auth, the quoxagent fleet and bastion.

Fixed live

Thirty-three findings in the cycle; the release-blocking set remediated and deployed. The two deploy-pending blockers (bastion keys and deploy-grant, quoxagent job-envelope replay) were deployed live and resolved.

Honest debt

Plugin backends still share the internal service key (carried to a higher bar); some policy routes trusted a caller-supplied org id (carried to v1.2).

engagement ENG_01M3R1RVXHFNRB3GF6CAFNRB3G

Certifies

What was audited is what is running, provably (source equals artifact equals running, or the gap is named with a remediation path), and the v1 pass repeats on a second independent attempt.

Attack

Byte-identical hash parity on the running collector, plus a full second independent pass over v1's invariants.

Fixed live

The repeatability pass caught a high-severity cross-tenant hole the first pass missed: a set of compliance tools trusted a caller-supplied org id, so a user in one org could read or write another org's compliance artifacts via chat. Fixed, deployed, verified live, red-proven.

Honest debt

Build-provenance observability is incomplete: most components cannot yet report their running generation (the fleet agent now can). Fleet at twenty of thirty-seven current, seventeen unreached.

engagement ENG_01M3X057C151EGY8PMZE51EGY8

Certifies

Every effect-producing entry point across all surfaces passes exactly one reviewed gate, enforced and not merely asserted.

Attack

A bounded sweep enumerated every effect path across five surfaces: collector tool executors, connector HTTP routes, the chat widget, plugin tools, agent jobs and dev-seams, and bastion key and exec paths.

Fixed live

A conformance test now proves every effect-verb tool sits in exactly one reviewed bucket, green in continuous integration. Four fixes closed the gaps the sweep found, all deployed with red-proven pins.

Honest debt

Paid tools have no per-org cost-budget gate yet (no budget infrastructure exists; an honest TODO carried to v1.8), plus two weaker fail-open hardening items.

engagement ENG_01M3WC959AS5XWEGCGVBS5XWEG

Certifies

Every mandatory-dependency fault leaves the effect path fail-closed or durably queued, with visible degradation, no double-effect, and recoverable incomplete executions.

Attack

Fault-injected every mandatory dependency across five surfaces: evidence store down, policy service down or null, external-effect crash after send, collector restart mid-dispatch, agent restart.

Fixed live

Fail-closed evidence and policy gates, a durable execution ledger (crash becomes outcome-unknown, never a silent retry) and an atomic single-use claim, all verified live in the running container. The real fix: the agent replay set was in-memory only, so a restart reopened the replay window; now durable, red-proven, deployed.

Honest debt

The durable write is best-effort (a write failure plus a restart is a rare compound reopen; a fail-closed flag is available); the agent heartbeat loop has no backoff leg yet.

engagement ENG_01M3WS3FTHXGWC5A3RASXGWC5A

Certifies

No secret or cross-tenant data leaks into logs, responses or transcripts, and every deployed artifact's provenance is verifiable or named with a remediation path, with install integrity failing closed.

Attack

Hunt for secret leakage across logs, responses and transcripts, and audit the supply chain: dependency pinning, install integrity, artifact provenance.

Fixed live

Credentials resolve by reference and are never returned, receipts are content-free, mandatory audit is always stored. One real leak fixed (raw tool-input logging, which was live in production) and one unpinned dependency pinned; install integrity already fails closed.

Honest debt

Build-provenance observability: most service health endpoints return a version number, not a git commit. The remediation spec is written; it is a supervised build-pipeline change, not an overnight one.

engagement ENG_01M3X1XBG75GX72VJCVA5GX72V

Certifies

Assume the reading model is fully compromised: it cannot reach an interpreter, expand recipients or permissions, exfiltrate to an unbounded destination, or let untrusted content carry authority. This is not a claim of universal injection immunity (a stated non-goal); it is a claim that the enforcement boundary sits outside the model.

Attack

Treat every model output as hostile: try to reach a shell, SQL or template interpreter, widen recipients, exfiltrate, or smuggle authority through content.

Fixed live

A single governance chokepoint gates every tool call by effect and not by provenance, no model output reaches an interpreter, and approved email recipients are fingerprint-bound. One escalation fixed: a navigation tool let a model-controlled URL reach loopback, private and cloud-metadata addresses ungated (a server-side request forgery), now blocked.

Honest debt

DNS-rebinding (a hostname that resolves to a private address) is not yet blocked; two URL validators to unify.

engagement ENG_01M3X30DKDFJB6D76W1FFJB6D7

Certifies

The audit trail cannot be forged, omitted, reordered or edited without detection, the commitment binds the effective action (no attacker-writable field verifies green), and an independent recompute fails closed on tamper.

Attack

The most on-thesis bar: attack the evidence itself. Forge an entry, delete one, reorder, tamper the tip, rewrite a field outside the hash.

Fixed live

The chain binds sequence, previous hash and payload hash; verification detects forgery, omission, reorder and tip-tamper with no swallowed errors, and no mutation path exists on the ledger. The witness commitment binds the effective action (the historical payload-exclusion bug is fixed). An independent recompute refuses to publish on mismatch. A clean exam, with the missing gap-detection test added.

Honest debt

Two ledger columns (org and tags) sit outside the chain hash, so a raw database rewrite could mis-attribute tenant visibility without breaking chain verification (the authoritative org is still hash-bound in the commitment). Supervised fix: cross-check the columns against the hash-committed values.

engagement ENG_01M3X425XKMGQPRS5PCYMGQPRS

Certifies

An authorization cannot be stretched past its expiry, replayed, used after revocation, or widened beyond its capability, grant or credential scope, proven under adversarial reuse.

Attack

Attack the grant lifecycle: reuse a spent approval, use one past expiry, use one after revocation, widen a grant's scope.

Fixed live

Approvals are single-use via an atomic claim, expiry is revalidated at use time on both the collector and bastion layers, revocation runs the same atomic deny gate, capability scope denies unknown agents and binds grants to tool, parameters and targets, and credentials are type-scoped with expiring just-in-time leases. A clean exam; the core invariants were already pinned.

Honest debt

The bastion replay nonce is in-memory (a restart inside the time window reopens a narrow replay window); no standalone grant-revoke primitive yet (mitigated by short lifetimes).

engagement ENG_01M3X4VXWXPVCBZF1PVVPVCBZF

Certifies

A compromised or runaway caller cannot exhaust money, compute (concurrency, rate, time, output) or queues, the bounds are durable, and every recurring loop carries failure-accounting, backoff and retirement.

Attack

Attack with volume: hammer paid APIs, run unbounded commands, flood queues, spin loops.

Fixed live

Compute is bounded by per-org and per-route rate limiters, an agent loop cap, connector timeouts and size caps. Three missing bounds found and fixed: unbounded paid-API spend (now propose-first), unbounded remote-command time and output (a timeout plus a one-megabyte cap), and an uncapped outbound queue (now depth-limited). Completes the first ladder.

Honest debt

No real per-org spend ceiling yet (propose-first is the interim); the outbound queue is in-memory (the depth cap bounds the live process; persist for cross-restart durability).

engagement ENG_01M3X5EAMEKZYA6YZX53KZYA6Y