Security baseline evidence

Verified activation: 22 September 2026

The owner separately approved the limited default-branch workflow activation. PR #461 was squash-merged as 5890a1d165aea3b713ed5da59f6d71cdfbde95d6 on release. The coordinator and reusable worker use reviewed scanner controls at e852442ab2801388e06d420ca6c389031c8bdd14, with clean, separate source checkouts.

Hosted run	Event	Scanned development commit	Scanned release commit	Result
35586505063, 2026-09-21 10:01 UTC	Scheduled	99f1b1a2dcfdc03e3d90d17555f64e4b37d4a61c	5890a1d165aea3b713ed5da59f6d71cdfbde95d6	All 11 jobs passed
35752339515, 2026-09-22 16:10 UTC	Manual	9bff2ce3a41d0da413dd5fa77909a959db1b860a	5890a1d165aea3b713ed5da59f6d71cdfbde95d6	All 11 jobs passed

Each run selected RustSec, SDK/ecosystem advisories, redacted full-snapshot secrets and source/workflow rules for both refs, plus the real-scanner failure canaries and required aggregate. Both RustSec and SDK advisory results reported zero findings and zero advisory exceptions. Scanner observations bind exact lockfiles, tool/rule digests and OSV response identities; no package build or install is substituted for advisory evidence.

The scheduled RustSec database commit was fd3051c5d26d1fad531e8cd7dc3cc6c7a90986af; the manual run independently fetched eac8bd26b6593aafeb228d0f7adeb12c373e9f84. Both passed the database freshness check. The release lock remained 14f6fa9e9a8a069695c2f2292ccb24ee028c3b80c3c99645c990613630419418 across these different database observations. This demonstrates scanning an unchanged lock against updated advisory data, without manufacturing a dependency change.

An operator API refresh at 2026-09-22 16:15:24 UTC verified:

• Vulnerability alerts, unpaused Dependabot security updates, private reporting, secret scanning and push protection are enabled.
• The scheduled coordinator exists on default release.
• development requires both CI result and Security baseline result, each bound to GitHub Actions application ID 15368; existing strict:false was preserved.
• The default workflow token remains read-only and cannot approve PR reviews.
• CodeQL default setup remains unconfigured; the explicitly scoped custom source/workflow checks provide the documented static coverage. Non-provider secret patterns and live credential-validity probes remain disabled.

This completes the deployment and monitoring evidence for #282. It does not certify runtime isolation or close the wider Phase 3 gate. A live fork execution and an actual server-side rejected secret push were not performed; the retained permission fixtures, scanner canaries and enabled-service API observations have those explicit limits. The earlier implementation and failure records follow unchanged as historical evidence.

Initial implementation record: 19 September 2026

This is compact, redacted milestone evidence for #282 and PR #363, not an acceptance/merge or runtime-security certificate. The parent must refresh checks for the final exact PR head; the observations below are deliberately dated. Operation, limits and triage are in the runbook.

Revisions and repository settings

• Original implementation milestone, before integration rebase: 68d60404417a8262bc62ab44896dffe98a6a331e.
• Original legacy-ref/dirty-observation correction: 8de6441ca7f6640be717a4c6fae1dbd7d7a6393c.
• Current integration base: 13d94f021dcce9bed2abf3e5231dd20f246c1312 (development, including #343/#335/#336).
• Rebased implementation tested before this evidence update: f110b5300756e69f12aa43f738aece75d7cc7a1f.
• Independently scanned maintained release: 44891f4158a663de5c08b177431686ec70c0bdf3.
• Settings refreshed via operator API at 2026-09-19T14:36:48.110758+00:00.

Setting	Verified observation
Vulnerability alerts	Enabled (HTTP 204)
Dependabot security updates	Enabled, not paused
Secret scanning / push protection	Both enabled
Private vulnerability reporting	Enabled
Non-provider secret patterns / live validity checks	Both disabled; no credential-validity probes
CodeQL default setup	Not configured; custom source/workflow checks are used instead
Default workflow token / PR review approval	Read / false
Default branch	release
Coordinator on default branch	Absent; periodic activation pending normal promotion
Required development contexts	CI result only; security aggregate protection pending deployment
Repository auto-merge capability	Already enabled at repository level; no baseline auto-approval/merge workflow exists or was used

Settings can drift. python tools/security_settings.py refreshes this inventory; admin visibility is required to distinguish disabled state from permission loss. No account token or raw secret findings are retained in this ledger.

Representative hosted workflow

Initial failure detected

Security run 35447295927 is a pull_request run for exact PR head 68d60404417a8262bc62ab44896dffe98a6a331e. GitHub scanned its synthetic merge revision addd7e14a0bc3ec1ed433504cd360966ca1ef3ab, not an unnamed branch tip.

Job	Result
Scope	Pass, all checks selected for control changes
RustSec	Pass
Changed-present redacted secrets	Pass
Source/workflow rules	Pass with one exact compatibility exception, pending owner approval
Fail-closed canaries	Pass with actual Linux scanner releases and fresh RustSec data
SDK advisories	Fail, the three real matches listed below
Security baseline result	Fail, correctly propagates the SDK result

This is positive evidence that detection and the aggregate fail closed, not a fully green baseline. No failing job was rerun until green by suppression. The ordinary CI and final-head checks must be consulted independently on the PR. No scheduled/manual both-ref hosted run is claimed while the coordinator is absent from default release.

Actual advisory remediation passes

Security run 35448635149 passes every selected job, including SDK advisories and Security baseline result, at exact PR head eefa978f0ebc3c2b0670173986c41ae74c254c44; its synthetic merge revision is 49cd9f39524674b2d2770b1777ff149a863f927c. Hosted Linux runs all 34 security tests without skips and all eight real-scanner canary categories pass. This closes the actual SDK failure from run 35447764981 without an advisory exception. The corresponding ordinary CI run 35448635129 was still running when integration advanced to #336; full Linux renderer qualification is not inferred from the security pass.

The four implementation milestones rebased cleanly onto 13d94f02. Fresh dependency and static scans pass at f110b530 (zero dependency findings, one unchanged exact static compatibility exception), with both source and controls recorded clean. These are local integration checks, not hosted checks of the subsequent documentation commit. The parent must inspect the final pushed head; the delivery does not wait idly for CI or claim a pending result is green.

Local bounded checks

• At rebased f110b530, 34 security unit/workflow/settings tests run: 33 pass and one Windows symlink construction test is skipped. The hosted Linux result above has no skip; final-head Linux status remains a separate check.
• Existing CI-profile/action-policy suite: 30 tests run, 29 pass and one host skip.
• Action policy: 82 immutable/local references across seven workflows validate.
• Documentation validation after #336: 293 documents, five SVGs, 1,969 local links and 87 anchors, with no errors.
• Parsed ci.yml equals base 13d94f02 after removing only the eight new persist-credentials: false checkout settings: profiles, caches, permissions, commands and aggregate logic are otherwise identical.
• Eight real canary categories passed locally and in the representative hosted job. Known-vulnerable dependencies and synthetic secrets remained fixture data; no runtime dependency graph was changed.
• Development lock RustSec scan: 432 packages, 1,251 database advisories, no match; lock SHA-256 59b2b6ad36257d13ffd951e8aa0405275c8273b41cec96faf6801447a74f8327.
• Fresh RustSec DB identity for both local lock scans: d5c17953a895cf19e8d3ce66eaa42b6fcfe1fb16, commit timestamp 1789807347. Development verification was at 13:58:27 UTC, release at 14:02:43 UTC.
• A clean detached release source scan inventories all its shipped SDK manifests and passes OSV. It explicitly records the absent renderer/control source directories while still querying caller scanner dependencies. This is not evidence that the release's Rust graph or workflows pass.

Findings, remediation and acceptance gaps

Development renderer dependency

The initial local and hosted OSV scans match npm:decompress@4.2.1 in examples/renderer-profile/package-lock.json, transitively introduced by @bytecodealliance/weval@0.4.1:

• GHSA-h39j-r5qq-r9mm.
• GHSA-jwp9-9v96-94mx.
• GHSA-mp2f-45pm-3cg9.

Official advisory lookup on 2026-09-19 gives no patched version of the unscoped decompress package. A differently scoped package is not an automatic safe substitution. On the parent's explicit request to resolve the failing SDK job, this delivery adds the narrow upstream remediation below rather than a finding exception. The initial match is not a claim of an LSF exploit.

The official weval 0.5.0 release, published 2026-09-10, resolves to full upstream commit 04191f69e9cdf624a272be01887dfbe5cf306bfa. Its reviewed npm wrapper replaces the old decompress family with tar and fflate, keeping the default getWeval export. The renderer manifest now pins that exact transitive override; the lockfile resolves tar 7.5.22 and fflate 0.8.3. The npm archive integrity is retained in the lock. ComponentizeJS remains 0.22.0 and the existing renderer profile still disables AOT, so the native weval compiler is not selected.

Only weval changes version among retained package entries. Seven entries are added and 77 unused extractor-related entries removed, reducing the resolved renderer graph from 344 to 274 entries. The resulting lock SHA-256 is 86e664dcd26735c9e7ca655442c1f3c957eab2a0a10da005e63432ef5105cd0a. It was regenerated from the existing lock in an isolated ignored directory with package scripts disabled, then applied as a focused patch. A clean npm ci --ignore-scripts succeeds, a fresh full npm audit reports zero vulnerabilities, and the fresh repository OSV scan reports zero matches. No unrelated retained package versions, runtime/SDK/provider code or parent Node worktree were changed. Final exact-head hosted checks still require review. The added import smoke checks the real pinned weval/ComponentizeJS modules; it does not claim a full Windows build. An attempted Windows componentization probe failed in existing Wizer default-cache configuration. Full compatibility must pass the existing Linux renderer CI, with the profile and engine unchanged.

Additional security tests prevent reintroduction of the unpatched extractor and verify inventory of the parent's pinned Node runtime @bufbuild/protobuf 2.15.0 and development @types/node 24.13.6 with 24.19.x engines. Both dependency kinds are queried; the inventory does not drop development packages or run Node code. Central toolchain changes select all lightweight security analyses. The parent #365 toolchain/setup-node changes are preserved through normal integration, not duplicated in this worktree.

Older maintained release

The fresh RustSec scan of unchanged release lock a3bbfde83d057cc90f0968aa397de8d86ecc64b10f585be62de53df381209a1e finds RUSTSEC-2026-0268 and RUSTSEC-2026-0269 on wasmtime@47.0.3, plus RUSTSEC-2026-0285 on rustls@0.23.44. Existing #279/Rustls fixes on development still need normal promotion; a development pass does not erase release findings. There are no release-only suppressions.

The legacy release static scan also fails with workflow-action-pin-policy: its older workflow definitions do not meet the already-reviewed #281 policy. Normal promotion must carry those controls too; the scanner does not relax the pin policy for an older maintained branch.

Full-snapshot secret triage

The initial local full development snapshot scanned 4,073 text files and counted 222 unscanned binary/archive files. It reported 16 unsuppressed generic-rule occurrences across three paths. A changed-file PR pass did not clear them; the subsequent complete parent review is recorded below.

• A benchmark README occurrence is consistent with an API-journal digest.
• A local-secret test occurrence is consistent with an environment-variable name.
• Fourteen occurrences in a historical benchmark aggregate needed complete private review. Private in-memory follow-up maps every matched value to runs[*].direct_execution.prepared_handle; none of these fourteen is a decoded finding. A digest-shaped preparation identifier is not, by shape alone, proof that publication is harmless or that a finding can be waived.

Only redacted positions/fingerprints and counts were retained locally; no raw matches, credential tests, blanket path/rule ignores or secret exceptions were published. These matches do not establish that a credential was found or leaked.

After fixing Windows extended-length input handling without relaxing link/path validation, the unchanged legacy-release snapshot also completes: 3,259 text files, 222 counted binaries/archives and 15 unsuppressed generic-rule occurrences. Its missing newer local-secret test explains the lower count; neither snapshot is described as secret-clean. The control-worktree observations and final hosted revision must be distinguished when reviewing these local receipts.

Central acceptance work

#282 acceptance area	Implemented or verified	Remaining acceptance evidence
Coherent pinned dependency baseline	Existing RustSec worker reused; both-ref schedule selection, fresh identities and stale/unavailable rejection tested	Promote coordinator to default release; capture actual periodic both-ref run
SDK inventory and repository alerts	Resolved runtime/development dependencies inventoried, real renderer advisory removed, alerts and security proposals enabled	Promote existing release dependency fixes; review future manifest changes
Secret/static coverage and protection	Reviewed scoped rules, redacted evidence, enabled secret scanning/push protection, complete private triage and exact static exception review	Final deployed both-ref hosted scan
Relevant PR scope and isolation	Docs/SVG profile, read-only permissions, no security caches, complete diff and fail-closed aggregate tested	Parent checks final hosted head; no real fork run claimed
Ownership and exceptions	Named owner, exact finding/package/path/fingerprint, maximum 30-day expiry, fail-closed tests and parent review	Review or retire every exact waiver before 2026-10-03
Harmless pass/fail evidence	34 hosted tests and eight native canary categories; unchanged-lock scheduling and fork permissions validated as fixtures	Actual both-ref hosted schedule/manual evidence and any required server push-rejection exercise
Runbook and phase gates	Current settings, historical failure/pass runs, #279/#238 links and #240 requirement recorded	Deploy required security aggregate alongside CI result, then parent acceptance review

The parent retains authority to review the exact compatibility exception (expires 2026-10-03), triage/remediate findings, audit final-head CI, promote the coordinator/config normally to default release, and require Security baseline result without removing CI result. Then capture actual manual and periodic both-ref runs with unchanged locks, plus any required real fork/server-push protection evidence. The #240 completion gate and #238 integrated tests remain separate. No PR was merged and no issue was closed by this delivery.

Parent review and clean snapshot follow-up

The parent approved the exact local reusable-workflow compatibility exception in review 5742811649, then completed all sixteen private noncredential classifications in review 5742881993. Raw scanner matches remained in memory only; no credential was probed.

The preparation matches were compared in memory against every historical runs[].direct_execution.prepared_handle. The recorded producer at 7e03a2fafe1d3b2e42546140c8c22113a6998638 is authenticated_handle. It hashes the release/engine/target profile and ArtifactPreparationIdentity::cache_digest, which includes artifact metadata and a process-local epoch. This is an internal lookup identity, not a credential or executable authorization token; cache hits still need the separately owned exact identity and verified artifact. None of the fourteen findings was decoded. The other matches exactly equal the labelled API-journal SHA256 and the synthetic denied environment-variable name, not a secret value. Digest shape alone was not the basis of review.

Commit 78093342c3d3ee94df7ca803819ce0c0327bb221 adds only exact content/scanner-location-bound exceptions and a regression for changed content, path, rule, location and expiry. All 35 security tests run locally: 34 pass and the Windows symlink-construction case is skipped. The sixteen secret-rule exceptions and one static compatibility exception all expire exclusively at UTC midnight on 2026-10-03. No frozen evidence bytes, scanner rule or advisory exception were changed.

Selected snapshot	Observation UTC	Text / counted binary files	Unexcepted / exact exceptions	Source and controls
Development integration 78093342	2026-09-19 15:02:38	4,084 / 222	0 / 16	Both clean at 78093342
Maintained release 44891f41	2026-09-19 15:04:45	3,259 / 222	0 / 15	Clean release source; clean 78093342 controls

Both are complete selected-text snapshot scans using verified Gitleaks 8.30.1, not history/binary scans or hosted results. The release does not contain the newer synthetic environment test, so fifteen exact exceptions apply there. Its previously detected Rust advisories and workflow-policy failures remain unresolved until normal promotion; a secret-rule pass does not clear them. Final-head CI, coordinator promotion, both-ref hosted coverage and required aggregate protection remain acceptance work for #282.