{"schema":"quox.evidence.item/1","id":"cycle:9","kind":"cycle","claim_id":null,"statement":"v1.1, Parity & Repeatability (verdict PASS)","not_claimed":"Not an independent third-party audit, and not a claim that no other issues exist.","status":"published","status_note":"2 published finding(s); 1 open, 1 fixed at publication.","computed_status":null,"status_history":[],"independent":{"kind":"self","note":"Issued by Quox about Quox systems (or customer sites tested under proof of control); signed by the Quox publisher key; not audited by a third party."},"issuer":"Quox","dates":{"first":"2026-10-02T00:27:50.535Z","latest":"2026-10-02T12:57:23.224Z","as_of":"2026-10-02T12:57:23.224Z"},"freshness":{"staleness_days":null,"stale":null,"expires":null,"as_of":"2026-10-23"},"evidence":[{"type":"artifact","url":"/evidence/securityAudits.json","label":"Signed security audit log (quox.security-audit-log.v1)"},{"type":"page","url":"https://quox.ai/security","label":"The /security audit band"}],"limitations":"A Quox release-gate pass over a frozen surface, with known debt listed in the record. Not an independent third-party audit.","cannot_establish":"A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly. It does not establish that the findings are complete, correctly graded, or that no other issues exist.","open_findings":["finding:FND_01M3X13AE5F0CZER6Z93F0CZER"],"withheld_findings":0,"capabilities":["security-audit","trust-bar"],"verify":{"method":"ed25519-log","artifact_url":"/evidence/securityAudits.json","receipt_url":null,"public_key":"fIQ/oPZSVq30nXqR5yU0Ny47QhHVNrD/PDqxkoIyEck=","public_key_source":"committed in the repository (scripts/security-audit-public-key.mjs) and in public/evidence/quoxtrust-verify.mjs","locator":{"file":"/evidence/securityAudits.json","path":"cycles[8]","cycle":9},"verifier_cmd":"node quoxtrust-verify.mjs ./securityAudits.json","reproduction":"Download /evidence/securityAudits.json and /evidence/quoxtrust-verify.mjs (dependency-free, Node 18+). Run the verifier command. It recomputes every WARD receipt chain_hash under the published recipe and verifies the Ed25519 signature over the canonicalized log with the committed public key. Exit 0 means authentic and unmodified; it does not mean the findings are complete or correct.","browser_verifiable":true},"citations":[{"url":"https://quox.ai/security","label":"Quox security audit log"}],"detail":{"cycle":9,"cycle_kind":"trust-bar","engagement_id":"ENG_01M3X057C151EGY8PMZE51EGY8","scope":{"covered":"Parity of release-critical platform components (collector verified live; quoxagent/bastion parity by exe-sha/deploy + named observability); repeatability of v1's RB invariants on the running system.","excluded":["Reaching all 17 unreached quoxagent hosts this cycle (deploy-tooling plumbing; gripe filed).","Container git-stamp + collector fleet-view display (the collector half of observability), named remediation, next.","Website (separate deploy surface).","Resilience (v1.3, banked), confidentiality (v1.4), injection (v1.5), hostile plugins (v2.0)."]},"method":null,"summary":"v1.1 asks whether what was AUDITED is what is RUNNING, provably, and whether the v1 PASS REPEATS. The second independent pass (PART B) re-confirmed F6/F7-RR5/fail-closed-gates on the running system AND caught a HIGH cross-tenant hole (PB3) the first pass missed: CommanderQ compliance tools trusted a caller-supplied org_id. Fixed, deployed, verified live, red-proven. Parity itself verified on the collector (running sha == origin/main); the cross-cutting gap is build-provenance observability, with the quoxagent heartbeat half fixed and the rest named.","controls_held":["PB3 (must-fix): commanderq compliance/governance tools route org through resolveToolOrgId(ctx,input) (authenticated org wins), verified LIVE in quox-collector (0 inverted patterns, resolveToolOrgId present).","PB1 F6 bastion key grant fail-closed (origin/main).","PB2 F7/RR5 quoxagent replay freshness + durable seen-set (origin/main).","PB4 fail-closed collector gates, running container sha byte-identical to origin/main.","PA5 half: quoxagent heartbeat reports the real build version (Options.AgentVersion wired; red-proven pin)."],"totals":{"critical":0,"high":1,"medium":1,"low":0,"fixed":1,"open":1,"refuted":0},"ward":{"chain_id":"ward:org/quox/env/production","hash_recipe":"sha256(prev_chain_hash|chain_id|seq|ward_entry_id|witnessed_at|source_kind|source_id|payload_hash), hex","receipts":2},"version":"v1.1","bar_name":"Parity & Repeatability","verdict":"PASS","known_debt":["PA5 collector half: fleet-view/CLI should display agent.version (ingested server-side), observability not complete until shipped + quoxagent redeployed. Finding FND_01M3X13AE5F0CZER6Z93F0CZER left CONFIRMED (partial).","No container git-sha label (collector/auth/dashboard) + bastion --version prints nothing, provenance stamps are the full observability remediation.","quoxagent fleet 20/37 at current generation; 17 unreached (deploy-tooling gripe).","Shared quox-dashboard working tree ~142 commits behind origin/main (parity hazard; deployed collector is current)."],"passed_date":"2026-10-02","contract_version":"1.0.0"},"human_url":"/evidence/explore#cycle:9","machine_url":"/evidence/items/cycle:9.json","api_url":"/api/evidence/cycle:9","contract":{"authentic_is_not_correct":"A valid signature or a recomputed hash proves a record is authentic and unmodified. It does not prove the system behaved correctly or that a finding list is complete.","independence":"self = issued by Quox and recomputable by anyone, not audited by a third party. visitor-recomputable = the reader recomputes it offline from published material. external = an outside party issued or hosts the primary record. Quox-verified is never independently verified.","curated_status":"status OWNER-APPROVED means the owner approved the wording for publication. It is not a computed VERIFIED status. computed_status, where present, is computed from proof-engine runs and is reported separately.","verify_caveat":"authentic != correct. A valid signature proves this record is authentic and unmodified; it does NOT prove the system behaved correctly."}}