{"schema":"quox.evidence.item/1","id":"cycle:3","kind":"cycle","claim_id":null,"statement":"trust-proof-self-audit-c3","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"14 published finding(s); 1 open, 13 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-09-25T04:02:40.637Z","latest":"2026-09-25T05:17:46.369Z","as_of":"2026-09-25T05:17:46.369Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Quox auditing Quox. Not an independent third-party audit; findings carry allowlisted fields only.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":["finding:FND_01M3BC9DKE113327SVN7113327"],"withheld_findings":0,"capabilities":["security-audit","self-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[2]","cycle":3},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"detail":{"cycle":3,"cycle_kind":"self-audit","engagement_id":"ENG_01M3BBNJBH0DVJQ4BPX60DVJQ4","scope":["quoxai/quox"],"method":"A follow-on adversarial sweep after the cross-tenant isolation cycle, widening from tenant boundaries into governance and into the audit's own evidence pipeline. Fourteen findings across the collector, the screencap and local-inference services, the HITL approval path, per-agent access enforcement, and the /security publish gate itself. Each was traced to a root cause, fixed test-first, and re-verified on the running deployment. The launch-blocking cross-tenant routes were proven live, an unauthenticated request returning another org's data with HTTP 200, before the fix and confirmed refused after it.","summary":"Third witnessed self-audit. Fourteen findings, thirteen fixed and one published open on purpose. The open one is the audit turned on its own publish path: the /security CI gate recomputed each WARD receipt only from fields already committed to this file and never re-queried the live evidence store, so a hand-fabricated finding with a self-consistent fake receipt would have passed the automated gate and been stopped only by human diff review. It is stated here as confirmed, not fixed, and the signing work this cycle ships is the response: the published log is now Ed25519-signed and the signature is verified both in CI and in the production build, so a forged entry needs the signing key, not merely an internally consistent shape. Three of the resolved findings were cross-tenant data-loss launch blockers, unauthenticated collector routes that let any caller read, register or delete another org's data, one of them proven live. The rest span an approval gate that failed open on destructive actions, a HITL path that did not enforce its own declared approvers, a per-agent access check bypassable for up to sixty seconds on a lookup failure, a bulk approve and deny that was a silent no-op, and a real host prefix that leaked into placeholder copy. The counts are read live from the engagement store; an audit log that only ever shows green is indistinguishable from no audit at all.","controls_held":["The fixes were verified test-first and on the running deployment, not only in unit tests; the three launch-blocking routes were re-checked live and refused another org's data after the fix","Where the collector authentication gate was present it held; the cross-tenant findings were routes that lacked the gate or trusted a client-supplied org id, never the gate itself being defeated","The publish-path evidence check held: recomputing each cycle's WARD chain against the live store at publish time is intact, and the allowlist projection that lets only title, severity and status reach the page is unchanged","Once fixed, the approval path and per-agent RBAC refused the escalations they had allowed: an under-approved bulk response and a destructive action on the legacy gate now stop rather than proceed","No secret values were disclosed by the findings above; the one leak was a host prefix in placeholder copy, corrected, not a credential"],"totals":{"critical":0,"high":0,"medium":0,"low":0,"fixed":13,"open":1,"refuted":0,"info":14},"ward":{"chain_id":"ward:org/quox/env/production","hash_recipe":"sha256(prev_chain_hash|chain_id|seq|ward_entry_id|witnessed_at|source_kind|source_id|payload_hash), hex","receipts":2}},"human_url":"/evidence/explore#cycle:3","machine_url":"/evidence/items/cycle:3.json","api_url":"/api/evidence/cycle:3","contract":{"authentic_is_not_correct":"A valid signature or a recomputed hash proves a record is authentic and unmodified. It does not prove the system behaved correctly or that a finding list is complete.","independence":"self = issued by Quox and recomputable by anyone, not audited by a third party. visitor-recomputable = the reader recomputes it offline from published material. external = an outside party issued or hosts the primary record. Quox-verified is never independently verified.","curated_status":"status OWNER-APPROVED means the owner approved the wording for publication. It is not a computed VERIFIED status. computed_status, where present, is computed from proof-engine runs and is reported separately.","verify_caveat":"authentic != correct. A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly."}}