{"schema":"quox.evidence.item/1","id":"cycle:8","kind":"cycle","claim_id":null,"statement":"v1.3, Resilience (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"1 published finding(s); 0 open, 1 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-10-01T22:24:33.626Z","latest":"2026-10-02T00:58:32.658Z","as_of":"2026-10-02T00:58:32.658Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":[],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[7]","cycle":8},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"detail":{"cycle":8,"cycle_kind":"trust-bar","engagement_id":"ENG_01M3WS3FTHXGWC5A3RASXGWC5A","scope":{"covered":"Resilience under dependency failure + restart across collector (evidence/policy/dispatch), quoxagent (replay seen-set), and bastion (grant verification).","excluded":["Secret/data confidentiality sweeps (T-CONF), v1.4.","Supply-chain / artifact integrity (T-ART), v1.4.","Prompt-injection / untrusted-model containment (T5/T6), v1.5.","Hostile third-party plugin runtime isolation, v2.0.","Performance/latency SLOs under load (this bar is correctness-under-fault, not throughput)."]},"method":null,"summary":"Bar v1.3 is the resilience bar: a bounded adversarial sweep fault-injected every mandatory dependency across 5 surfaces and asked whether each gate still holds when its dependency is down, slow, or the process dies mid-effect. The collector's fail-closed evidence/policy gates, durable executionLedger (crash -> outcome_unknown, no retry), and atomic single-use claim were verified LIVE in the running container. One real code must-fix (quoxagent replay seen-set was in-memory only) was fixed with a durable seen-set, red-proven-pinned, and deployed.","controls_held":["RR5 (the must-fix): quoxagent replay seen-set is now DURABLE (persisted to DataDir atomically, restored at boot), a restart no longer reopens the 15-min replay window on /jobs or /dev/invoke. Best-effort write so a disk fault cannot DoS the agent. Deployed as v84780f4.","RR1 evidence/WARD store down: collector counts + surfaces audit-write failures (recordAuditWriteFailure, /health + /metrics) instead of a silent skip, verified in the running quox-collector.","RR2 policy store down: collector fails closed on storeResult.unavailable (approvalGate) and returns policy_unavailable on governance exception (quoxchat), verified in the running container.","RR3 external-effect crash-after-send: executionLedger durable claim before dispatch; reconcileOnBoot flips dispatched -> outcome_unknown, no retry, states enumerated, verified live.","RR4 restart mid-dispatch: toolApprovalStore single atomic claim (SQLite-durable, replay -> null), reconciled at boot, verified live.","RR2-bastion grant verification: fails closed on zero trusted keys / verify error (internal/approval/grant.go)."],"totals":{"critical":0,"high":1,"medium":0,"low":0,"fixed":1,"open":0,"refuted":0},"ward":{"chain_id":"ward:org/quox/env/production","hash_recipe":"sha256(prev_chain_hash|chain_id|seq|ward_entry_id|witnessed_at|source_kind|source_id|payload_hash), hex","receipts":2},"version":"v1.3","bar_name":"Resilience","verdict":"PASS","known_debt":["RR5 residual: persist is best-effort, a persist FAILURE followed by a restart could still reopen the window (rare compound case). Deliberate: fail-closed-on-persist-error would couple job acceptance to disk health. A fail-closed flag is available if wanted.","RR2 residual (collector): approvalGate checkStorePolicies !_voltDb pre-init branch returns allow-posture not 'unavailable'. UNREACHABLE at runtime (setApprovalGateDb precedes server.listen; running container passed RR2). v1.3 hardening: distinguish pre-init from intentionally-no-GOV-4-store.","RR1 residual (collector): effect executes before the receipt is guaranteed (re-emit recovery, by design). Ordering -> v1.4.","RR6 residual (quoxagent): heartbeat loop counts+logs failures (visible) but has no backoff (fixed ticker). Scheduler-triad backoff leg missing. Hardening.","Process: shared quox-dashboard working tree (gtm-p2-topbar, e0213cca) is ~142 commits behind origin/main on collector files, merge-regression risk; the DEPLOYED collector is current."],"passed_date":"2026-10-01","contract_version":"1.0.0"},"human_url":"/evidence/explore#cycle:8","machine_url":"/evidence/items/cycle:8.json","api_url":"/api/evidence/cycle:8","contract":{"authentic_is_not_correct":"A valid signature or a recomputed hash proves a record is authentic and unmodified. It does not prove the system behaved correctly or that a finding list is complete.","independence":"self = issued by Quox and recomputable by anyone, not audited by a third party. visitor-recomputable = the reader recomputes it offline from published material. external = an outside party issued or hosts the primary record. Quox-verified is never independently verified.","curated_status":"status OWNER-APPROVED means the owner approved the wording for publication. It is not a computed VERIFIED status. computed_status, where present, is computed from proof-engine runs and is reported separately.","verify_caveat":"authentic != correct. A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly."}}