{"schema":"quox.evidence.item/1","id":"cycle:4","kind":"cycle","claim_id":null,"statement":"trust-proof-quoxtrust-conformance-c1","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"7 published finding(s); 0 open, 7 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-09-26T00:05:42.924Z","latest":"2026-09-26T00:07:44.309Z","as_of":"2026-09-26T00:07:44.309Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"Quox auditing Quox. Not an independent third-party audit; findings carry allowlisted fields only.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit","self-audit"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[3]","cycle":4},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"detail":{"cycle":4,"cycle_kind":"self-audit","engagement_id":"ENG_01M3DGGCTA8AX3MZVQJA8AX3MZ","scope":["quoxai/quox"],"method":"A conformance cycle, distinct from the hostile-lane self-audits of cycles one through three. Its subject is not an intruder but our own trust guarantees: does each promise hold under a dependency failure, a crash, an exception, and every caller path. It was driven by an unsweetened outside worthiness study that rated the platform four out of ten and proved that trust-invariant violations had shipped undetected, because the checks that existed only asked whether a control was wired, never whether it held. Seven findings across the evidence witness, the governance gate, the audit and execution durability paths, and complete mediation. Each was reproduced with a failing test first, fixed at the root, and re-verified on the running deployment, then pinned by a permanent regression in a required CI gate that is proven to refuse a broken candidate rather than merely to exist.","summary":"Fourth witnessed self-audit, and the first that audits the trust guarantees themselves rather than an attacker. Seven findings, all fixed and all verified on the running deployment. The evidence witness hashed only envelope metadata, so two different commands produced identical intact receipts; it now binds the action payload. The governance gate read a failed policy store as no matching rule and allowed the action; it now fails closed, separating unavailable from no rule, with a positive allowlist so an unknown tool defaults to denied. Audit-envelope write failures were silent; they are now accounted and surfaced on the health and metrics endpoints. A crash mid-dispatch left no record of an in-flight external effect; a durable execution ledger now records intent before dispatch, reconciles in-flight work on restart, and never auto-retries an ambiguous send. Two complete-mediation gaps let an effect run ungated, one in the chat widget on a policy exception and one on every connector path where the org policy check was skipped; both now pass a single reference monitor. The seventh finding is the guardrail against all of the above returning: a new effect-producing tool could previously be added with no gate decision, and the coverage invariant now fails the build unless every effect tool sits in a reviewed gate bucket. What is deliberately not claimed: the coverage invariant pins the tool surface, not every future entry point, and two boundaries are stated open rather than hidden, per-command mediation of a human terminal session and the in-browser behaviour of hostile third-party plugin code, neither of which a backend can witness. The counts are read live from the engagement store; an audit log that only ever shows green is indistinguishable from no audit at all.","controls_held":["Every fix is pinned by a required, non-continue-on-error CI gate that runs the invariant suites across two packages and is proven to exit non-zero on a deliberately broken candidate, so a reopened fail-open gate, an unwitnessed receipt or an ungated effect path goes red before it can merge","The reference monitor now sits at both the native and the connector choke, and a governance deny takes precedence over the entitlement and rate checks, so no connector caller, direct route or delegated agent, can reach an effect the org policy forbids","The durable execution ledger reconciles in-flight effects on boot and refuses to dispatch when its own durable write fails, so an ambiguous external send is recorded as outcome-unknown rather than silently lost or blindly retried","The fixes were verified test-first and on the running deployment, not only in unit tests; each of the six runtime findings was re-checked in the running collector after its fix","No secret values were disclosed by any finding in this cycle; the findings are structural properties of the enforcement path, not leaked credentials","The published log recomputes each WARD receipt at publish time and is Ed25519-signed and verified in CI and in the production build, so a fabricated entry needs the signing key, not merely an internally consistent shape"],"totals":{"critical":0,"high":4,"medium":3,"low":0,"fixed":7,"open":0,"refuted":0},"ward":{"chain_id":"ward:org/quox/env/production","hash_recipe":"sha256(prev_chain_hash|chain_id|seq|ward_entry_id|witnessed_at|source_kind|source_id|payload_hash), hex","receipts":2}},"human_url":"/evidence/explore#cycle:4","machine_url":"/evidence/items/cycle:4.json","api_url":"/api/evidence/cycle:4","contract":{"authentic_is_not_correct":"A valid signature or a recomputed hash proves a record is authentic and unmodified. It does not prove the system behaved correctly or that a finding list is complete.","independence":"self = issued by Quox and recomputable by anyone, not audited by a third party. visitor-recomputable = the reader recomputes it offline from published material. external = an outside party issued or hosts the primary record. Quox-verified is never independently verified.","curated_status":"status OWNER-APPROVED means the owner approved the wording for publication. It is not a computed VERIFIED status. computed_status, where present, is computed from proof-engine runs and is reported separately.","verify_caveat":"authentic != correct. A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly."}}