{"schema":"quox.evidence.query/1","index_schema":"quox.evidence.index/1","generated_from":"2026-10-23","manifest_hash":"572ed796ea8207a2c1a95b523229172dee5b1aad4a8fbec033280bfce9a8e04d","query":{"limit":50,"offset":0},"total_matching":127,"returned":50,"counts":{"items":127,"by_kind":{"claim":6,"protocol":4,"cycle":14,"finding":101,"artifact":2},"by_independence":{"self":125,"visitor-recomputable":1,"external":1},"claims":{"published":10,"owner_approved":10,"computed_verified":2,"open_findings_referenced":2,"withheld_findings":0},"cycles":14,"findings":{"total":101,"open":15,"resolved":86,"refuted":0,"other":0,"by_outcome":{"fixed":86,"open_confirmed":8,"open_reported":7}},"stale_items":0,"note":"Counts are recomputable from items[]. OWNER-APPROVED is owner-curated wording, not a computed VERIFIED status. Draft and pending claims are not published and not counted."},"items":[{"claim_id":null,"computed_status":null,"status_history":[],"issuer":"Quox","open_findings":[],"withheld_findings":0,"citations":[],"id":"artifact:public-facts","kind":"artifact","statement":"The public machine-readable facts file (facts.json), witnessed in a WARD chain with an offline-verifiable receipt.","not_claimed":"Not a claim that every statement inside it is independently verified; each claim carries its own status.","status":"published","status_note":"28 claim(s) indexed in the registry; only owner-approved evidence is attached.","independent":{"kind":"self","note":"Witnessed by a Quox-held WARD signer; external corroboration (TSA token, public git history) is named in facts.json witness block."},"dates":{"first":"2026-10-23","latest":"2026-10-23","as_of":"2026-10-23"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/facts.json","label":"facts.json"},{"type":"ward-receipt","url":"/facts.receipt.json","label":"WARD receipt"}],"limitations":"The receipt embeds its own signing key; out-of-band witnesses (RFC-3161 token, public git history) corroborate it.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the claims listed inside facts.json are true.","capabilities":["facts","artifact"],"verify":{"method":"ward-receipt","artifact_url":"/facts.json","receipt_url":"/facts.receipt.json","public_key":null,"public_key_source":"embedded in /facts.receipt.json (WARD tip signer; corroborated out of band by the public TSA token and git history named in facts.json witness)","locator":{"file":"/facts.json","path":"$"},"verifier_cmd":null,"reproduction":"Fetch /facts.json and /facts.receipt.json. sha256(facts.json bytes) must equal receipt.facts_sha256 and ward_entry.payload_hash. Recompute ward_entry.chain_hash per WARD SPEC section 4.4 (canonical JSON of the ten hash-body fields). Verify ward_tip.sig is an Ed25519 signature over the raw bytes of ward_tip.tip_chain_hash by receipt.public_key. Then confirm the item exists in facts.json at the locator with the same claim_id. A match proves the record is unmodified since witnessing, not that the claim is correct.","browser_verifiable":true},"human_url":"/evidence/explore#artifact:public-facts","machine_url":"/evidence/items/artifact:public-facts.json","api_url":"/api/evidence/artifact:public-facts"},{"id":"claim:registry_claims.file_search","kind":"claim","claim_id":"quox.file_search.v1","statement":"Quox searches your files on a running install. It is proven on our dev install and is not yet proven on fresh clean-VM installs, where it currently fails.","not_claimed":null,"status":"OWNER-APPROVED","status_note":"Owner-approved for publication. Computed status REVIEW comes from proof-engine runs and is reported separately in computed_status.","computed_status":"REVIEW","status_history":[{"status":"OBSERVED","date":"2026-10-16","cause":"files/t3-search-files first passing on the current checks (dev)"},{"status":"VERIFIED","date":"2026-10-17","cause":"passes dev on >=2 UTC days on the current checks; SEER signoff files/t3-search-files equivalent"},{"status":"REVIEW","date":"2026-10-17","cause":"run_mvcjr7fi"}],"independent":{"kind":"self","note":"Issued by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-17","latest":"2026-10-17","as_of":"2026-10-17"},"freshness":{"staleness_days":30,"stale":false,"expires":"2026-11-16","as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/facts.json","label":"Recompute from /facts proof-engine-evidence.json: the files/t3-search-files rows at checks 046769154e07; the projection hash and WARD receipt make the snapshot independently checkable."},{"type":"ward-receipt","url":"/facts.receipt.json","label":"WARD receipt witnessing /facts.json, which records this claim"}],"limitations":"Proven on our dev install only; currently fails on fresh clean-VM installs.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. The status was computed from Quox's own proof-engine runs on Quox's own installs; it is not a third-party test.","open_findings":[],"withheld_findings":0,"capabilities":["file_search"],"verify":{"method":"ward-receipt","artifact_url":"/facts.json","receipt_url":"/facts.receipt.json","public_key":null,"public_key_source":"embedded in /facts.receipt.json (WARD tip signer; corroborated out of band by the public TSA token and git history named in facts.json witness)","locator":{"file":"/facts.json","path":"registry_claims.file_search","claim_id":"quox.file_search.v1"},"verifier_cmd":null,"reproduction":"Fetch /facts.json and /facts.receipt.json. sha256(facts.json bytes) must equal receipt.facts_sha256 and ward_entry.payload_hash. Recompute ward_entry.chain_hash per WARD SPEC section 4.4 (canonical JSON of the ten hash-body fields). Verify ward_tip.sig is an Ed25519 signature over the raw bytes of ward_tip.tip_chain_hash by receipt.public_key. Then confirm the item exists in facts.json at the locator with the same claim_id. A match proves the record is unmodified since witnessing, not that the claim is correct.","browser_verifiable":true},"citations":[{"url":"/facts.json","label":"Quox"}],"human_url":"/evidence/explore#claim:registry_claims.file_search","machine_url":"/evidence/items/claim:registry_claims.file_search.json","api_url":"/api/evidence/claim:registry_claims.file_search"},{"id":"claim:registry_claims.vault_health","kind":"claim","claim_id":"quox.vault_health.v1","statement":"Quox's secret vault reports its own health as a machine-proven check; an earlier regression was caught red on the matrix and fixed.","not_claimed":null,"status":"OWNER-APPROVED","status_note":"Owner-approved for publication. Computed status VERIFIED comes from proof-engine runs and is reported separately in computed_status.","computed_status":"VERIFIED","status_history":[{"status":"CONTRADICTED","date":"2026-10-15","cause":"vault-health failing/partial on the prior checks hash"},{"status":"VERIFIED","date":"2026-10-17","cause":"fixed; passes on dev on >=2 UTC days (2026-10-16, 2026-10-17) on the current checks; SEER signoff vault/vault-health equivalent (rule B)"}],"independent":{"kind":"self","note":"Issued by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-17","latest":"2026-10-17","as_of":"2026-10-17"},"freshness":{"staleness_days":30,"stale":false,"expires":"2026-11-16","as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/facts.json","label":"Recompute from /facts proof-engine-evidence.json: the vault/vault-health rows at checks 294e3221f797; the projection hash and WARD receipt make the snapshot independently checkable."},{"type":"ward-receipt","url":"/facts.receipt.json","label":"WARD receipt witnessing /facts.json, which records this claim"}],"limitations":"Proven on our dev install only; the earlier failure is preserved in the status history, not erased.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. The status was computed from Quox's own proof-engine runs on Quox's own installs; it is not a third-party test.","open_findings":[],"withheld_findings":0,"capabilities":["vault_health"],"verify":{"method":"ward-receipt","artifact_url":"/facts.json","receipt_url":"/facts.receipt.json","public_key":null,"public_key_source":"embedded in /facts.receipt.json (WARD tip signer; corroborated out of band by the public TSA token and git history named in facts.json witness)","locator":{"file":"/facts.json","path":"registry_claims.vault_health","claim_id":"quox.vault_health.v1"},"verifier_cmd":null,"reproduction":"Fetch /facts.json and /facts.receipt.json. sha256(facts.json bytes) must equal receipt.facts_sha256 and ward_entry.payload_hash. Recompute ward_entry.chain_hash per WARD SPEC section 4.4 (canonical JSON of the ten hash-body fields). Verify ward_tip.sig is an Ed25519 signature over the raw bytes of ward_tip.tip_chain_hash by receipt.public_key. Then confirm the item exists in facts.json at the locator with the same claim_id. A match proves the record is unmodified since witnessing, not that the claim is correct.","browser_verifiable":true},"citations":[{"url":"/facts.json","label":"Quox"}],"human_url":"/evidence/explore#claim:registry_claims.vault_health","machine_url":"/evidence/items/claim:registry_claims.vault_health.json","api_url":"/api/evidence/claim:registry_claims.vault_health"},{"id":"claim:registry_claims.witness_health","kind":"claim","claim_id":"quox.witness_health.v1","statement":"Quox continuously witnesses the health of its own evidence chain, and that self-witnessing check is itself machine-proven on the proof matrix.","not_claimed":null,"status":"OWNER-APPROVED","status_note":"Owner-approved for publication. Computed status VERIFIED comes from proof-engine runs and is reported separately in computed_status.","computed_status":"VERIFIED","status_history":[{"status":"IMPLEMENTED","date":"2026-10-14","cause":"first witness-health runs on the current checks"},{"status":"VERIFIED","date":"2026-10-17","cause":"SEER signoff receipts/witness-health equivalent (rule B); passes across dev and clean-vm on >=2 UTC days"}],"independent":{"kind":"self","note":"Issued by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-17","latest":"2026-10-17","as_of":"2026-10-17"},"freshness":{"staleness_days":30,"stale":false,"expires":"2026-11-16","as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/facts.json","label":"Recompute from /facts proof-engine-evidence.json: the receipts/witness-health rows at checks ed0ee30fa935; the projection hash and WARD receipt make the snapshot independently checkable."},{"type":"ward-receipt","url":"/facts.receipt.json","label":"WARD receipt witnessing /facts.json, which records this claim"}],"limitations":"Proven on our own dev box and clean throwaway VMs, not yet on a third-party-operated install.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. The status was computed from Quox's own proof-engine runs on Quox's own installs; it is not a third-party test.","open_findings":[],"withheld_findings":0,"capabilities":["witness_health"],"verify":{"method":"ward-receipt","artifact_url":"/facts.json","receipt_url":"/facts.receipt.json","public_key":null,"public_key_source":"embedded in /facts.receipt.json (WARD tip signer; corroborated out of band by the public TSA token and git history named in facts.json witness)","locator":{"file":"/facts.json","path":"registry_claims.witness_health","claim_id":"quox.witness_health.v1"},"verifier_cmd":null,"reproduction":"Fetch /facts.json and /facts.receipt.json. sha256(facts.json bytes) must equal receipt.facts_sha256 and ward_entry.payload_hash. Recompute ward_entry.chain_hash per WARD SPEC section 4.4 (canonical JSON of the ten hash-body fields). Verify ward_tip.sig is an Ed25519 signature over the raw bytes of ward_tip.tip_chain_hash by receipt.public_key. Then confirm the item exists in facts.json at the locator with the same claim_id. A match proves the record is unmodified since witnessing, not that the claim is correct.","browser_verifiable":true},"citations":[{"url":"/facts.json","label":"Quox"}],"human_url":"/evidence/explore#claim:registry_claims.witness_health","machine_url":"/evidence/items/claim:registry_claims.witness_health.json","api_url":"/api/evidence/claim:registry_claims.witness_health"},{"claim_id":null,"computed_status":null,"status_history":[],"issuer":"Quox","open_findings":[],"withheld_findings":0,"citations":[],"id":"artifact:security-audit-log","kind":"artifact","statement":"The signed log of Quox's published security audit cycles and findings (schema quox.security-audit-log.v1).","not_claimed":"Not a complete list of every issue that exists, and not a third-party audit.","status":"published","status_note":"14 cycle(s), 101 finding(s); one Ed25519 signature covers the whole canonicalized log.","independent":{"kind":"self","note":"Signed by the Quox publisher key; anyone can verify it offline, no third party has audited it."},"dates":{"first":"2026-09-19T15:11:18.624Z","latest":"2026-10-02T12:57:23.224Z","as_of":"2026-10-02T12:57:23.224Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"securityAudits.json"},{"type":"artifact","url":"/evidence/quoxtrust-verify.mjs","label":"Dependency-free offline verifier"}],"limitations":"Authenticity of the publisher key rests on the committed public key; the log lists allowlisted fields only.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the log is complete or that the findings are correctly graded.","capabilities":["security-audit","artifact"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"$"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"human_url":"/evidence/explore#artifact:security-audit-log","machine_url":"/evidence/items/artifact:security-audit-log.json","api_url":"/api/evidence/artifact:security-audit-log"},{"id":"cycle:9","kind":"cycle","claim_id":null,"statement":"v1.1, Parity & Repeatability (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"2 published finding(s); 1 open, 1 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-10-02T00:27:50.535Z","latest":"2026-10-02T12:57:23.224Z","as_of":"2026-10-02T12:57:23.224Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":["finding:FND_01M3X13AE5F0CZER6Z93F0CZER"],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[8]","cycle":9},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#cycle:9","machine_url":"/evidence/items/cycle:9.json","api_url":"/api/evidence/cycle:9"},{"id":"cycle:10","kind":"cycle","claim_id":null,"statement":"v1.4, Confidentiality & Supply-chain (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"3 published finding(s); 1 open, 2 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-10-02T00:58:30.058Z","latest":"2026-10-02T02:14:07.924Z","as_of":"2026-10-02T02:14:07.924Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":["finding:FND_01M3X2HMA7BZD68KFGWPBZD68K"],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[9]","cycle":10},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#cycle:10","machine_url":"/evidence/items/cycle:10.json","api_url":"/api/evidence/cycle:10"},{"id":"cycle:11","kind":"cycle","claim_id":null,"statement":"v1.5, Injection / Containment (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"1 published finding(s); 0 open, 1 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-10-02T01:17:38.805Z","latest":"2026-10-02T02:14:07.924Z","as_of":"2026-10-02T02:14:07.924Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[10]","cycle":11},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#cycle:11","machine_url":"/evidence/items/cycle:11.json","api_url":"/api/evidence/cycle:11"},{"id":"cycle:12","kind":"cycle","claim_id":null,"statement":"v1.6, Evidence Tamper-Evidence (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"1 published finding(s); 1 open, 0 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-10-02T01:36:06.478Z","latest":"2026-10-02T02:14:07.924Z","as_of":"2026-10-02T02:14:07.924Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":["finding:FND_01M3X4JCBHM63HPTH6F9M63HPT"],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[11]","cycle":12},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#cycle:12","machine_url":"/evidence/items/cycle:12.json","api_url":"/api/evidence/cycle:12"},{"id":"cycle:13","kind":"cycle","claim_id":null,"statement":"v1.7, Authorization Depth (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"1 published finding(s); 1 open, 0 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-10-02T01:50:09.076Z","latest":"2026-10-02T02:14:07.924Z","as_of":"2026-10-02T02:14:07.924Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":["finding:FND_01M3X59AD9G0KX1TBS03G0KX1T"],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[12]","cycle":13},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#cycle:13","machine_url":"/evidence/items/cycle:13.json","api_url":"/api/evidence/cycle:13"},{"id":"cycle:14","kind":"cycle","claim_id":null,"statement":"v1.8, Resource & Abuse Bounds (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"3 published finding(s); 0 open, 3 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-10-02T02:00:12.144Z","latest":"2026-10-02T02:14:07.924Z","as_of":"2026-10-02T02:14:07.924Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[13]","cycle":14},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#cycle:14","machine_url":"/evidence/items/cycle:14.json","api_url":"/api/evidence/cycle:14"},{"id":"finding:FND_01M3X65RZFGAJ2NF42RYGAJ2NF","kind":"finding","claim_id":null,"statement":"RB4: telegramPro outboundQueue no lane depth cap (unbounded in-memory growth)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 14.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T02:13:00Z","latest":"2026-10-02T02:14:07Z","as_of":"2026-10-02T02:14:07Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[13].findings","cycle":14,"finding_id":"FND_01M3X65RZFGAJ2NF42RYGAJ2NF"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X65RZFGAJ2NF42RYGAJ2NF","machine_url":"/evidence/items/finding:FND_01M3X65RZFGAJ2NF42RYGAJ2NF.json","api_url":"/api/evidence/finding:FND_01M3X65RZFGAJ2NF42RYGAJ2NF"},{"id":"finding:FND_01M3X65PVJZQB66DSBGGZQB66D","kind":"finding","claim_id":null,"statement":"RB3: remote_ssh/ssh_exec unbounded exec time + output","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 14.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T02:12:57Z","latest":"2026-10-02T02:14:06Z","as_of":"2026-10-02T02:14:06Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[13].findings","cycle":14,"finding_id":"FND_01M3X65PVJZQB66DSBGGZQB66D"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X65PVJZQB66DSBGGZQB66D","machine_url":"/evidence/items/finding:FND_01M3X65PVJZQB66DSBGGZQB66D.json","api_url":"/api/evidence/finding:FND_01M3X65PVJZQB66DSBGGZQB66D"},{"id":"finding:FND_01M3X65GVMGPQ8Y5CZHQGPQ8Y5","kind":"finding","claim_id":null,"statement":"RB2: paid-API tools (gemini/perplexity) had no spend bound (free-call loop)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 14.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T02:12:51Z","latest":"2026-10-02T02:14:05Z","as_of":"2026-10-02T02:14:05Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[13].findings","cycle":14,"finding_id":"FND_01M3X65GVMGPQ8Y5CZHQGPQ8Y5"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X65GVMGPQ8Y5CZHQGPQ8Y5","machine_url":"/evidence/items/finding:FND_01M3X65GVMGPQ8Y5CZHQGPQ8Y5.json","api_url":"/api/evidence/finding:FND_01M3X65GVMGPQ8Y5CZHQGPQ8Y5"},{"id":"finding:FND_01M3X59AD9G0KX1TBS03G0KX1T","kind":"finding","claim_id":null,"statement":"AU-residuals: bastion grant replay-nonce in-memory + no standalone revoke primitive (low)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"open_confirmed","status_note":"Severity low; filed status confirmed; part of cycle 13.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T01:57:27Z","latest":"2026-10-02T01:57:27Z","as_of":"2026-10-02T01:57:27Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[12].findings","cycle":13,"finding_id":"FND_01M3X59AD9G0KX1TBS03G0KX1T"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X59AD9G0KX1TBS03G0KX1T","machine_url":"/evidence/items/finding:FND_01M3X59AD9G0KX1TBS03G0KX1T.json","api_url":"/api/evidence/finding:FND_01M3X59AD9G0KX1TBS03G0KX1T"},{"id":"finding:FND_01M3X4JCBHM63HPTH6F9M63HPT","kind":"finding","claim_id":null,"statement":"ET3(b): ward_entries.org_id/tags bare columns not bound into chainHash","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"open_confirmed","status_note":"Severity low; filed status confirmed; part of cycle 12.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T01:44:55Z","latest":"2026-10-02T01:44:55Z","as_of":"2026-10-02T01:44:55Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[11].findings","cycle":12,"finding_id":"FND_01M3X4JCBHM63HPTH6F9M63HPT"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X4JCBHM63HPTH6F9M63HPT","machine_url":"/evidence/items/finding:FND_01M3X4JCBHM63HPTH6F9M63HPT.json","api_url":"/api/evidence/finding:FND_01M3X4JCBHM63HPTH6F9M63HPT"},{"id":"finding:FND_01M3X3JQP7CK17WA9REZCK17WA","kind":"finding","claim_id":null,"statement":"IN3: browser_navigate SSRF — model-controlled URL reaches private/metadata IPs ungated","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 11.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T01:27:38Z","latest":"2026-10-02T01:38:55Z","as_of":"2026-10-02T01:38:55Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[10].findings","cycle":11,"finding_id":"FND_01M3X3JQP7CK17WA9REZCK17WA"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X3JQP7CK17WA9REZCK17WA","machine_url":"/evidence/items/finding:FND_01M3X3JQP7CK17WA9REZCK17WA.json","api_url":"/api/evidence/finding:FND_01M3X3JQP7CK17WA9REZCK17WA"},{"id":"finding:FND_01M3X2HJ4Z6ZTAR92J4M6ZTAR9","kind":"finding","claim_id":null,"statement":"T-ART: collector Dockerfile dependency @anthropic-ai/claude-code unpinned","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 10.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T01:09:31Z","latest":"2026-10-02T01:19:07Z","as_of":"2026-10-02T01:19:07Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[9].findings","cycle":10,"finding_id":"FND_01M3X2HJ4Z6ZTAR92J4M6ZTAR9"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X2HJ4Z6ZTAR92J4M6ZTAR9","machine_url":"/evidence/items/finding:FND_01M3X2HJ4Z6ZTAR92J4M6ZTAR9.json","api_url":"/api/evidence/finding:FND_01M3X2HJ4Z6ZTAR92J4M6ZTAR9"},{"id":"finding:FND_01M3X2HGKA090E3JQ21J090E3J","kind":"finding","claim_id":null,"statement":"CF1: collector logged raw tool input (secret leak into logs)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 10.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T01:09:30Z","latest":"2026-10-02T01:19:05Z","as_of":"2026-10-02T01:19:05Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[9].findings","cycle":10,"finding_id":"FND_01M3X2HGKA090E3JQ21J090E3J"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X2HGKA090E3JQ21J090E3J","machine_url":"/evidence/items/finding:FND_01M3X2HGKA090E3JQ21J090E3J.json","api_url":"/api/evidence/finding:FND_01M3X2HGKA090E3JQ21J090E3J"},{"id":"finding:FND_01M3X2HMA7BZD68KFGWPBZD68K","kind":"finding","claim_id":null,"statement":"CA1: build provenance not verifiable on collector/auth/dashboard/bastion","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"open_confirmed","status_note":"Severity medium; filed status confirmed; part of cycle 10.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T01:09:34Z","latest":"2026-10-02T01:09:34Z","as_of":"2026-10-02T01:09:34Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[9].findings","cycle":10,"finding_id":"FND_01M3X2HMA7BZD68KFGWPBZD68K"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X2HMA7BZD68KFGWPBZD68K","machine_url":"/evidence/items/finding:FND_01M3X2HMA7BZD68KFGWPBZD68K.json","api_url":"/api/evidence/finding:FND_01M3X2HMA7BZD68KFGWPBZD68K"},{"id":"cycle:8","kind":"cycle","claim_id":null,"statement":"v1.3, Resilience (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"1 published finding(s); 0 open, 1 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-10-01T22:24:33.626Z","latest":"2026-10-02T00:58:32.658Z","as_of":"2026-10-02T00:58:32.658Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[7]","cycle":8},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#cycle:8","machine_url":"/evidence/items/cycle:8.json","api_url":"/api/evidence/cycle:8"},{"id":"cycle:7","kind":"cycle","claim_id":null,"statement":"v1.2, Complete Mediation (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"4 published finding(s); 0 open, 4 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-10-01T18:40:27.951Z","latest":"2026-10-02T00:44:45.759Z","as_of":"2026-10-02T00:44:45.759Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[6]","cycle":7},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#cycle:7","machine_url":"/evidence/items/cycle:7.json","api_url":"/api/evidence/cycle:7"},{"id":"finding:FND_01M3X138J7MG75JM4TCPMG75JM","kind":"finding","claim_id":null,"statement":"PB3: CommanderQ compliance tools trusted caller-supplied org_id (cross-tenant read+write)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 9.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T00:44:14Z","latest":"2026-10-02T00:44:43Z","as_of":"2026-10-02T00:44:43Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[8].findings","cycle":9,"finding_id":"FND_01M3X138J7MG75JM4TCPMG75JM"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X138J7MG75JM4TCPMG75JM","machine_url":"/evidence/items/finding:FND_01M3X138J7MG75JM4TCPMG75JM.json","api_url":"/api/evidence/finding:FND_01M3X138J7MG75JM4TCPMG75JM"},{"id":"finding:FND_01M3X13AE5F0CZER6Z93F0CZER","kind":"finding","claim_id":null,"statement":"PA5: fleet cannot observe running build generation (heartbeat hardcoded 0.1.0)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"open_confirmed","status_note":"Severity medium; filed status confirmed; part of cycle 9.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-02T00:44:16Z","latest":"2026-10-02T00:44:16Z","as_of":"2026-10-02T00:44:16Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[8].findings","cycle":9,"finding_id":"FND_01M3X13AE5F0CZER6Z93F0CZER"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3X13AE5F0CZER6Z93F0CZER","machine_url":"/evidence/items/finding:FND_01M3X13AE5F0CZER6Z93F0CZER.json","api_url":"/api/evidence/finding:FND_01M3X13AE5F0CZER6Z93F0CZER"},{"id":"finding:FND_01M3WSZK7CX10CBBSY7HX10CBB","kind":"finding","claim_id":null,"statement":"RR5: quoxagent replay seen-set was in-memory only (replay window reopens on restart)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 8.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-01T22:39:54Z","latest":"2026-10-01T23:50:14Z","as_of":"2026-10-01T23:50:14Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[7].findings","cycle":8,"finding_id":"FND_01M3WSZK7CX10CBBSY7HX10CBB"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3WSZK7CX10CBBSY7HX10CBB","machine_url":"/evidence/items/finding:FND_01M3WSZK7CX10CBBSY7HX10CBB.json","api_url":"/api/evidence/finding:FND_01M3WSZK7CX10CBBSY7HX10CBB"},{"id":"finding:FND_01M3WCBE2FST2677X7C2ST2677","kind":"finding","claim_id":null,"statement":"MF-4: quoxagent /dev/invoke verified freshness before signature","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 7.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-01T18:41:42Z","latest":"2026-10-01T18:42:13Z","as_of":"2026-10-01T18:42:13Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[6].findings","cycle":7,"finding_id":"FND_01M3WCBE2FST2677X7C2ST2677"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3WCBE2FST2677X7C2ST2677","machine_url":"/evidence/items/finding:FND_01M3WCBE2FST2677X7C2ST2677.json","api_url":"/api/evidence/finding:FND_01M3WCBE2FST2677X7C2ST2677"},{"id":"finding:FND_01M3WCBBNA0MNKQ4ZK5Z0MNKQ4","kind":"finding","claim_id":null,"statement":"MF-3: github-proxy write routes bypassed the governance choke","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 7.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-01T18:41:40Z","latest":"2026-10-01T18:42:09Z","as_of":"2026-10-01T18:42:09Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[6].findings","cycle":7,"finding_id":"FND_01M3WCBBNA0MNKQ4ZK5Z0MNKQ4"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3WCBBNA0MNKQ4ZK5Z0MNKQ4","machine_url":"/evidence/items/finding:FND_01M3WCBBNA0MNKQ4ZK5Z0MNKQ4.json","api_url":"/api/evidence/finding:FND_01M3WCBBNA0MNKQ4ZK5Z0MNKQ4"},{"id":"finding:FND_01M3WCB9QP0KFY9ZJ7CW0KFY9Z","kind":"finding","claim_id":null,"statement":"MF-2: native externalEffect tools had no default HITL","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 7.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-01T18:41:38Z","latest":"2026-10-01T18:42:06Z","as_of":"2026-10-01T18:42:06Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[6].findings","cycle":7,"finding_id":"FND_01M3WCB9QP0KFY9ZJ7CW0KFY9Z"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3WCB9QP0KFY9ZJ7CW0KFY9Z","machine_url":"/evidence/items/finding:FND_01M3WCB9QP0KFY9ZJ7CW0KFY9Z.json","api_url":"/api/evidence/finding:FND_01M3WCB9QP0KFY9ZJ7CW0KFY9Z"},{"id":"finding:FND_01M3WCAG0WSTRF2FKBR4STRF2F","kind":"finding","claim_id":null,"statement":"MF-1: bastion DELETE /keys/{id} revoke was ungated (F6 sibling)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 7.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-10-01T18:41:11Z","latest":"2026-10-01T18:42:02Z","as_of":"2026-10-01T18:42:02Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[6].findings","cycle":7,"finding_id":"FND_01M3WCAG0WSTRF2FKBR4STRF2F"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3WCAG0WSTRF2FKBR4STRF2F","machine_url":"/evidence/items/finding:FND_01M3WCAG0WSTRF2FKBR4STRF2F.json","api_url":"/api/evidence/finding:FND_01M3WCAG0WSTRF2FKBR4STRF2F"},{"id":"cycle:6","kind":"cycle","claim_id":null,"statement":"v1, Release Gate (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"33 published finding(s); 3 open, 30 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-09-30T02:19:50.581Z","latest":"2026-10-01T03:46:06.305Z","as_of":"2026-10-01T03:46:06.305Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":["finding:FND_01M3R1TX7ES2ZDTR6YBSS2ZDTR","finding:FND_01M3ST59E9252CVE8C6F252CVE","finding:FND_01M3R9X647CMRA4NBBXFCMRA4N"],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5]","cycle":6},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#cycle:6","machine_url":"/evidence/items/cycle:6.json","api_url":"/api/evidence/cycle:6"},{"id":"finding:FND_01M3R1V2MGS07VB3SATDS07VB3","kind":"finding","claim_id":null,"statement":"job envelope has no nonce and optional expiry (replay)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T02:21:02Z","latest":"2026-10-01T03:46:06Z","as_of":"2026-10-01T03:46:06Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3R1V2MGS07VB3SATDS07VB3"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3R1V2MGS07VB3SATDS07VB3","machine_url":"/evidence/items/finding:FND_01M3R1V2MGS07VB3SATDS07VB3.json","api_url":"/api/evidence/finding:FND_01M3R1V2MGS07VB3SATDS07VB3"},{"id":"finding:FND_01M3R1V0K9Y5FSQGAV8TY5FSQG","kind":"finding","claim_id":null,"statement":"keys/deploy + sudo/setup skip requireApprovalGrant (parallel enforcement path)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity critical; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T02:21:00Z","latest":"2026-10-01T03:46:04Z","as_of":"2026-10-01T03:46:04Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3R1V0K9Y5FSQGAV8TY5FSQG"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3R1V0K9Y5FSQGAV8TY5FSQG","machine_url":"/evidence/items/finding:FND_01M3R1V0K9Y5FSQGAV8TY5FSQG.json","api_url":"/api/evidence/finding:FND_01M3R1V0K9Y5FSQGAV8TY5FSQG"},{"id":"finding:FND_01M3ST59E9252CVE8C6F252CVE","kind":"finding","claim_id":null,"statement":"HARDENING: GOV-1 policy routes trust org_id from query/body for internal authorization (beyond route-level auth)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"open_reported","status_note":"Severity low; filed status candidate; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T18:45:17Z","latest":"2026-09-30T18:45:17Z","as_of":"2026-09-30T18:45:17Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3ST59E9252CVE8C6F252CVE"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3ST59E9252CVE8C6F252CVE","machine_url":"/evidence/items/finding:FND_01M3ST59E9252CVE8C6F252CVE.json","api_url":"/api/evidence/finding:FND_01M3ST59E9252CVE8C6F252CVE"},{"id":"finding:FND_01M3SPCJY2PEDNR9PZEHPEDNR9","kind":"finding","claim_id":null,"statement":"Org-scope cross-tenant is PLATFORM-WIDE: vault-credential exposure (agents/invoke), cross-org dev-host build/backup/restore/tmux, cross-org read of dev-session events, aee attribution, unauthed GOV-1 policy CRUD","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity critical; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T17:39:22Z","latest":"2026-09-30T18:45:13Z","as_of":"2026-09-30T18:45:13Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SPCJY2PEDNR9PZEHPEDNR9"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SPCJY2PEDNR9PZEHPEDNR9","machine_url":"/evidence/items/finding:FND_01M3SPCJY2PEDNR9PZEHPEDNR9.json","api_url":"/api/evidence/finding:FND_01M3SPCJY2PEDNR9PZEHPEDNR9"},{"id":"finding:FND_01M3SRMADJ54NH52VFJ154NH52","kind":"finding","claim_id":null,"statement":"T-AUTH expiry gap: the inbox-driven approval resume path executes without re-checking approval expiry / current policy (stale approval still fires)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T18:18:33Z","latest":"2026-09-30T18:44:22Z","as_of":"2026-09-30T18:44:22Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SRMADJ54NH52VFJ154NH52"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SRMADJ54NH52VFJ154NH52","machine_url":"/evidence/items/finding:FND_01M3SRMADJ54NH52VFJ154NH52.json","api_url":"/api/evidence/finding:FND_01M3SRMADJ54NH52VFJ154NH52"},{"id":"finding:FND_01M3SQJPK91CMB37A8M51CMB37","kind":"finding","claim_id":null,"statement":"WARD witness degradation is silent: /health reports ready:true when witnessing is dead (initWardHooks failed), runtime witness errors uncounted, unsigned tips unaccounted (T3/T8 evidence-integrity)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T18:00:11Z","latest":"2026-09-30T18:09:54Z","as_of":"2026-09-30T18:09:54Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SQJPK91CMB37A8M51CMB37"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SQJPK91CMB37A8M51CMB37","machine_url":"/evidence/items/finding:FND_01M3SQJPK91CMB37A8M51CMB37.json","api_url":"/api/evidence/finding:FND_01M3SQJPK91CMB37A8M51CMB37"},{"id":"finding:FND_01M3SNE0F59MD0WSV63S9MD0WS","kind":"finding","claim_id":null,"statement":"Header-based cross-tenant: ~8 routes derive org as 'req.user?.org_id || req.headers[x-org-id]' with no req.service gate (SM0Q class via header, missed by the body/query fix); + toolsmith sandbox route bypasses GOV-4","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T17:22:40Z","latest":"2026-09-30T17:29:58Z","as_of":"2026-09-30T17:29:58Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SNE0F59MD0WSV63S9MD0WS"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SNE0F59MD0WSV63S9MD0WS","machine_url":"/evidence/items/finding:FND_01M3SNE0F59MD0WSV63S9MD0WS.json","api_url":"/api/evidence/finding:FND_01M3SNE0F59MD0WSV63S9MD0WS"},{"id":"finding:FND_01M3SM0Q0KHJQYWQGFCVHJQYWQ","kind":"finding","claim_id":null,"statement":"Security-engagement/compliance routes derive org as 'req.user?.org_id || req.body/query.org_id' without the req.service gate the safe sibling routes use (potential cross-tenant)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T16:57:56Z","latest":"2026-09-30T17:15:11Z","as_of":"2026-09-30T17:15:11Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SM0Q0KHJQYWQGFCVHJQYWQ"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SM0Q0KHJQYWQGFCVHJQYWQ","machine_url":"/evidence/items/finding:FND_01M3SM0Q0KHJQYWQGFCVHJQYWQ.json","api_url":"/api/evidence/finding:FND_01M3SM0Q0KHJQYWQGFCVHJQYWQ"},{"id":"finding:FND_01M3SK5C5P17ZFQRG05317ZFQR","kind":"finding","claim_id":null,"statement":"UNGATED shell injection in bastion_ssh executor (bastionSshExecutor.js) - a parallel shadow of the native fleet tools running off agent args; plus quoxagentExecutor hostId","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity critical; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T16:43:00Z","latest":"2026-09-30T16:50:48Z","as_of":"2026-09-30T16:50:48Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SK5C5P17ZFQRG05317ZFQR"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SK5C5P17ZFQRG05317ZFQR","machine_url":"/evidence/items/finding:FND_01M3SK5C5P17ZFQRG05317ZFQR.json","api_url":"/api/evidence/finding:FND_01M3SK5C5P17ZFQRG05317ZFQR"},{"id":"finding:FND_01M3SJS9FY5GC1ZW7NPH5GC1ZW","kind":"finding","claim_id":null,"statement":"docker_extended 'restart' is an ungated container MUTATION duplicating the gated docker_fleet_container_action (parallel-enforcement bypass)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T16:36:24Z","latest":"2026-09-30T16:50:46Z","as_of":"2026-09-30T16:50:46Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SJS9FY5GC1ZW7NPH5GC1ZW"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SJS9FY5GC1ZW7NPH5GC1ZW","machine_url":"/evidence/items/finding:FND_01M3SJS9FY5GC1ZW7NPH5GC1ZW.json","api_url":"/api/evidence/finding:FND_01M3SJS9FY5GC1ZW7NPH5GC1ZW"},{"id":"finding:FND_01M3SHGHZQBF8ZT9B4DDBF8ZT9","kind":"finding","claim_id":null,"statement":"Shell-injection class is wider than SGFV: 4 more UNGATED callBastion sites (network_check, docker_extended, ssl_certificates, security_audit) + 3 gated (docker_fleet_container_action, proxmox_vm_snapshot, proxmox_vm_clone)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity critical; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T16:14:09Z","latest":"2026-09-30T16:26:45Z","as_of":"2026-09-30T16:26:45Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SHGHZQBF8ZT9B4DDBF8ZT9"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SHGHZQBF8ZT9B4DDBF8ZT9","machine_url":"/evidence/items/finding:FND_01M3SHGHZQBF8ZT9B4DDBF8ZT9.json","api_url":"/api/evidence/finding:FND_01M3SHGHZQBF8ZT9B4DDBF8ZT9"},{"id":"finding:FND_01M3SGFVZDN94PP8F9X0N94PP8","kind":"finding","claim_id":null,"statement":"Shell command injection in native bastion tools: system_admin (path/unit/priority/since/user), docker_fleet_logs + docker_fleet_stats (container_id)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity critical; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T15:56:18Z","latest":"2026-09-30T16:04:59Z","as_of":"2026-09-30T16:04:59Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SGFVZDN94PP8F9X0N94PP8"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SGFVZDN94PP8F9X0N94PP8","machine_url":"/evidence/items/finding:FND_01M3SGFVZDN94PP8F9X0N94PP8.json","api_url":"/api/evidence/finding:FND_01M3SGFVZDN94PP8F9X0N94PP8"},{"id":"finding:FND_01M3SF9CH1TR2XNHG2XZTR2XNH","kind":"finding","claim_id":null,"statement":"Arbitrary shell/SQL executes without human approval: ssh_exec ungated; remote_ssh/db_query approval-path is theatre","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity critical; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T15:35:17Z","latest":"2026-09-30T15:48:22Z","as_of":"2026-09-30T15:48:22Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SF9CH1TR2XNHG2XZTR2XNH"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SF9CH1TR2XNHG2XZTR2XNH","machine_url":"/evidence/items/finding:FND_01M3SF9CH1TR2XNHG2XZTR2XNH.json","api_url":"/api/evidence/finding:FND_01M3SF9CH1TR2XNHG2XZTR2XNH"},{"id":"finding:FND_01M3SCFPRGSSP06ZPPYWSSP06Z","kind":"finding","claim_id":null,"statement":"remote_ssh (arbitrary shell) and db_query writes execute with no default approval gate","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T14:46:19Z","latest":"2026-09-30T15:09:43Z","as_of":"2026-09-30T15:09:43Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SCFPRGSSP06ZPPYWSSP06Z"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SCFPRGSSP06ZPPYWSSP06Z","machine_url":"/evidence/items/finding:FND_01M3SCFPRGSSP06ZPPYWSSP06Z.json","api_url":"/api/evidence/finding:FND_01M3SCFPRGSSP06ZPPYWSSP06Z"},{"id":"finding:FND_01M3SC1WEZ9BAZ6R4M8Z9BAZ6R","kind":"finding","claim_id":null,"statement":"VOLT GOLD certifies a self-signed (embedded-key) signature as identity-verified","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T14:38:46Z","latest":"2026-09-30T14:42:56Z","as_of":"2026-09-30T14:42:56Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SC1WEZ9BAZ6R4M8Z9BAZ6R"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SC1WEZ9BAZ6R4M8Z9BAZ6R","machine_url":"/evidence/items/finding:FND_01M3SC1WEZ9BAZ6R4M8Z9BAZ6R.json","api_url":"/api/evidence/finding:FND_01M3SC1WEZ9BAZ6R4M8Z9BAZ6R"},{"id":"finding:FND_01M3SB5J4FQY704DHWR7QY704D","kind":"finding","claim_id":null,"statement":"WARD witness hooks silently no-op when not initialised (evidence receipts vanish untraced)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T14:23:18Z","latest":"2026-09-30T14:31:49Z","as_of":"2026-09-30T14:31:49Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SB5J4FQY704DHWR7QY704D"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SB5J4FQY704DHWR7QY704D","machine_url":"/evidence/items/finding:FND_01M3SB5J4FQY704DHWR7QY704D.json","api_url":"/api/evidence/finding:FND_01M3SB5J4FQY704DHWR7QY704D"},{"id":"finding:FND_01M3SAGZME5S3R531K0B5S3R53","kind":"finding","claim_id":null,"statement":"Contactability consent-grant route trusts x-org-id header over authenticated identity (cross-tenant write)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T14:12:03Z","latest":"2026-09-30T14:19:21Z","as_of":"2026-09-30T14:19:21Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3SAGZME5S3R531K0B5S3R53"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3SAGZME5S3R531K0B5S3R53","machine_url":"/evidence/items/finding:FND_01M3SAGZME5S3R531K0B5S3R53.json","api_url":"/api/evidence/finding:FND_01M3SAGZME5S3R531K0B5S3R53"},{"id":"finding:FND_01M3S9XRKKR7K8TFH2ZVR7K8TF","kind":"finding","claim_id":null,"statement":"/chat/resolve-plan swallows a pre-LLM gate throw and proceeds (fail-open)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T14:01:34Z","latest":"2026-09-30T14:07:27Z","as_of":"2026-09-30T14:07:27Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3S9XRKKR7K8TFH2ZVR7K8TF"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3S9XRKKR7K8TFH2ZVR7K8TF","machine_url":"/evidence/items/finding:FND_01M3S9XRKKR7K8TFH2ZVR7K8TF.json","api_url":"/api/evidence/finding:FND_01M3S9XRKKR7K8TFH2ZVR7K8TF"},{"id":"finding:FND_01M3S9DJDBXBYKSB9SW9XBYKSB","kind":"finding","claim_id":null,"statement":"4-eyes policy-change gate fails OPEN on an audit-write error (applies unapproved)","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity high; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T13:52:43Z","latest":"2026-09-30T14:00:52Z","as_of":"2026-09-30T14:00:52Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3S9DJDBXBYKSB9SW9XBYKSB"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3S9DJDBXBYKSB9SW9XBYKSB","machine_url":"/evidence/items/finding:FND_01M3S9DJDBXBYKSB9SW9XBYKSB.json","api_url":"/api/evidence/finding:FND_01M3S9DJDBXBYKSB9SW9XBYKSB"},{"id":"finding:FND_01M3S8Q874M0DSZK1CV2M0DSZK","kind":"finding","claim_id":null,"statement":"Outbound telephony + notification (tripwire) bypasses the GOV-4 governance choke","not_claimed":"Severity is Quox's own grading at the time of reporting, not an independent assessment.","status":"fixed","status_note":"Severity medium; filed status resolved; part of cycle 6.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Found, graded and published by Quox; not independently verified."},"issuer":"Quox","dates":{"first":"2026-09-30T13:40:32Z","latest":"2026-09-30T13:50:34Z","as_of":"2026-09-30T13:50:34Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log; this finding sits inside the signed payload"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Severity is Quox's own grading at the time of reporting.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the severity grading is right, or that the fix is complete beyond what the record states.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[5].findings","cycle":6,"finding_id":"FND_01M3S8Q874M0DSZK1CV2M0DSZK"},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"human_url":"/evidence/explore#finding:FND_01M3S8Q874M0DSZK1CV2M0DSZK","machine_url":"/evidence/items/finding:FND_01M3S8Q874M0DSZK1CV2M0DSZK.json","api_url":"/api/evidence/finding:FND_01M3S8Q874M0DSZK1CV2M0DSZK"}],"links":{"index":"/evidence/index.json","feed":"/evidence/feed.jsonl","item":"/api/evidence/{id}","verify":"/api/evidence/verify/{id}"},"contract":{"authentic_is_not_correct":"A valid signature or a recomputed hash proves a record is authentic and unmodified. It does not prove the system behaved correctly or that a finding list is complete.","independence":"self = issued by Quox and recomputable by anyone, not audited by a third party. visitor-recomputable = the reader recomputes it offline from published material. external = an outside party issued or hosts the primary record. Quox-verified is never independently verified.","curated_status":"status OWNER-APPROVED means the owner approved the wording for publication. It is not a computed VERIFIED status. computed_status, where present, is computed from proof-engine runs and is reported separately.","verify_caveat":"authentic != correct. A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly."}}