@mstar-harness/dsh 3.10.2 → 3.11.0

package/harness-skills/mstar-audit/references/security-review.md

@@ -15,10 +15,20 @@ Method behind the Security category. Load when the category focus is `security`,
 
 - Every security finding must state a concrete attack scenario: **who the attacker is, what they send or do, and what they gain** — "An unauthenticated caller sends `POST /api/orders` with `qty=0`, gets a negative-balance order."
 - "Potentially exploitable" / "theoretically" means the research is not done — name the actor, the request, and the effect, or downgrade the finding.
-- **Severity = likelihood × impact**, both judged from code evidence. A famous vulnerability class on an unreachable path is a hardening note, not a HIGH.
+- **Severity is a likelihood × impact calibration, not a numeric multiplication** — judge each axis from code evidence, then place the finding on the anchor scale below; there is no formula to compute.
 - **Likelihood is judged from the repo's reality:** an endpoint behind a corporate VPN with no external callers is lower likelihood than the same shape on a public API; the code evidence stays the same, the rating does not.
 - **Impact is judged on the data, not the class:** SQL injection into a read-only lookup table is MEDIUM; the same class on a payment mutation is HIGH. Name what the attacker actually gains.
-- **HIGH vs MEDIUM discriminator:** the flaw defeats an explicit security boundary (authentication, authorization, tenant isolation, sandbox, trust boundary between components) → HIGH. It needs privileged access, a confined blast radius, or uncommon preconditions → MEDIUM.
+- **Severity anchors — rank the confirmed effect, not the vulnerability class.** Rank order is `informational` < `low` < `medium` < `high` < `critical`:
+  - `informational` — a substantiated minimal-impact observation. **Informational anchors do not promote hardening notes or unverified security leads into findings** — those stay in the audit index (hardening rule above, §12 Needs verification).
+  - `low` — a demonstrated minimal gain or non-secret internal disclosure.
+  - `medium` — a demonstrated boundary violation with limited blast radius or uncommon preconditions.
+  - `high` — a demonstrated defeat of an explicit security boundary (authentication, authorization, tenant isolation, sandbox, inter-component trust boundary) **with substantial consequences** — a lower-trust principal performs an action it must not, and real damage follows. An explicit-control defeat without substantial consequences stays `medium`.
+  - `critical` — demonstrated unauthenticated code execution, full data-store access or arbitrary account takeover.
+- **Anti-strengthening — never upgrade the effect class:**
+  - A crash or single-request denial is availability disruption, not code execution — do not rate it as execution-class.
+  - Ordinary load (large but bounded requests) is not shared-service harm; escalation requires cost imposed on other principals or shared infrastructure.
+  - Behavior affecting only the same principal (the user corrupts their own data, self-XSS, confusion over their own token) is not privilege escalation — an effect on another principal or protected shared state is required.
+- **Scaffold field gate:** the finding scaffold enforces `severity.overall ≤ severity.impact` as a rank comparison (engine gate in `packages/engine/src/audit.ts`, violation `audit.finding.severity.overall-exceeds-impact`). It validates field consistency only — it does not verify that the impact is real; that stays reviewer judgment.
 - **A defense-in-depth gap where another layer already prevents exploitation is a Hardening note in the audit index's "Hardening & checked notes" section, not a findings row** — never severity-inflate it. Hardening notes get one index line and no plan unless the user asks.
 - **Confidence is per-claim, not per-category:** a repo with one sloppy auth check is not "insecure" — each row stands on its own evidence.
 - A finding needs both halves: the vulnerable pattern at `file:line` *and* a confirmed attacker-controlled input reaching it (§4). Either half unproven → keep researching (§3) or park it in the audit index's **Needs verification** section (§12).
@@ -82,6 +92,7 @@ Scan committed configs, CI workflows, Dockerfiles, and IaC for credential *patte
 - **Provider key shapes, never-commit file list, CI/IaC leak shapes, safe-placeholder exclusions — mechanical scan:**
 > **Engine check (when available):** run `mstar audit secret-scan [path]` (or `import { scanSecrets } from "@mstar-harness/engine"` in a host hook) to scan git-tracked files under a path for credential patterns — it prints `{file, line, type}` findings and exits 1 on any hit. The engine pattern tables (`WHOLE_MATCH_PATTERNS` / `VALUE_PATTERNS` / `NEVER_COMMIT_FILENAMES` / `CI_IAC_LEAK_SHAPES` in `packages/engine/src/audit.ts`) are the SSOT; do not re-enumerate patterns here. On `fail` -> do not proceed; fix and re-run. Skill text below remains authoritative when the runtime is absent.
 - **Entropy heuristic (reviewer judgment):** an assignment context (`=`, `:`, `KEY = value`) holding a 20+ character high-variety string — verify by context; entropy alone is noise.
+- **Symbolic names are not secrets:** a public identifier named `key`, or a config field naming a secret reference (env-var name, secret-manager path, symbolic reference), is not a finding on its own — a finding requires credential authority (the name resolves to a live credential the holder can use) or actual value exposure to a lower-trust reader. Neither shown → Hardening/index note, not a finding.
 - Findings cite `file:line` + credential type only ("Stripe live key at `config.ts:12`"); the fix sketch always includes rotation, never just removal.
 
 ## 7. Cross-file data-flow sweep
@@ -97,21 +108,21 @@ Per-file scanning misses flows. After the per-file pass:
 
 Each angle is a reading lens, not a claim:
 
-- **Attack the sad path:** error, fallback, and retry branches skip validation — read the catch, the default case, the failure handler.
-- **Boundary values:** token expiry moment, exactly-at-limit sizes, multibyte vs byte limits, pagination edges.
-- **Implicit trust between components:** DB assumes API validated, worker assumes service A authorized, renderer assumes sanitize-on-write.
-- **Wrong order / replay:** flows that assume sequence — reuse-after-consume tokens, replayable webhooks, unbounded resend.
-- **Concurrency two-at-once:** double-spend, check-then-act, idempotency races on concurrent initialization.
-- **Parser disagreement:** router vs app normalization, extension vs MIME vs magic bytes, double URL-decoding.
-- **Trust in derived values:** cache keys built from user input, lookup tables keyed by attacker-chosen strings, IDs exposed in URLs that also gate authorization.
-- **Delegated checks:** validation that runs in the client, the test suite, or a sibling service but not on the production path — the enforcement point must be where the request lands.
-- **Round-trip survival:** stored → retrieved escaping drift that defeats earlier sanitization.
-- **Config posture:** missing config falling back to insecure defaults, env overriding a security control, first-run setup defaults, feature-flag defaults.
-- **Follow the money/privilege:** parallel paths to the same state change with weaker checks (alias routes, second entrypoints with fewer guards).
-- **Leaked context:** differential errors, timing, or response sizes → enumeration of users, resources, internal structure.
-- **Params overriding security-relevant defaults:** `debug=1`, `skip_auth`, `allow_*` knobs on request paths.
-- **Unhandled input shapes:** arrays where scalars are expected, extra keys in JSON bodies, oversized/malformed encodings reaching parsers that fail open.
-- **Unverified claims driving decisions:** client-set headers trusted server-side, `is_admin` hardcoded client-side, signature-verified but actor-unchecked tokens.
+- **Attack the sad path:** error, fallback, and retry branches skip validation — read the catch, the default case, the failure handler. `Signal:` grep `catch` / `except` / `else` branches adjacent to `validate` / `verify` calls that return a default instead of rejecting.
+- **Boundary values:** token expiry moment, exactly-at-limit sizes, multibyte vs byte limits, pagination edges. `Signal:` comparison operators at limits — `<=` vs `<` against `max*` / `limit` / `exp` / `length` / `count` identifiers.
+- **Implicit trust between components:** DB assumes API validated, worker assumes service A authorized, renderer assumes sanitize-on-write. `Signal:` cross-module parameters or fields named `trusted*`, `verified*`, `sanitized*`, `checked*` consumed downstream without a re-check.
+- **Wrong order / replay:** flows that assume sequence — reuse-after-consume tokens, replayable webhooks, unbounded resend. `Signal:` `consumed` / `used` / `redeemed` state columns or `eventId` / `idempotencyKey` dedup lookups that are read without an atomic claim (compare-and-set, unique constraint).
+- **Concurrency two-at-once:** double-spend, check-then-act, idempotency races on concurrent initialization. `Signal:` a read (`SELECT`, `.get(`) of balance/quota/state followed by a later write with no transaction, lock, or version check in between; `getOrCreate` / upsert on init paths.
+- **Parser disagreement:** router vs app normalization, extension vs MIME vs magic bytes, double URL-decoding. `Signal:` two decode/normalize calls over the same input — repeated `decodeURIComponent` / `urldecode`, `path` vs `url.parse().pathname` splits, `extname` vs `mimetype` vs content-sniff checks.
+- **Trust in derived values:** cache keys built from user input, lookup tables keyed by attacker-chosen strings, IDs exposed in URLs that also gate authorization. `Signal:` template-literal key construction — `` `${ `` interpolations feeding `cacheKey` / `key` / `Map` / dict indexing from request fields.
+- **Delegated checks:** validation that runs in the client, the test suite, or a sibling service but not on the production path — the enforcement point must be where the request lands. `Signal:` an authorization predicate (`is_admin`, `can_edit`, role checks) present in client bundles or `*.test.*` files with no corresponding server-side check at the handler.
+- **Round-trip survival:** stored → retrieved escaping drift that defeats earlier sanitization. `Signal:` `escape` / `sanitize` / `encodeURIComponent` at the write path with a raw render read later at `innerHTML` / `v-html` / `dangerouslySetInnerHTML` sinks.
+- **Config posture:** missing config falling back to insecure defaults, env overriding a security control, first-run setup defaults, feature-flag defaults. `Signal:` env reads with fallback defaults — `process.env` / `os.environ` followed by `||` / `or` / `??`, and flag names containing `DEBUG`, `SKIP`, `INSECURE`, `DISABLE`, defaulting truthy.
+- **Follow the money/privilege:** parallel paths to the same state change with weaker checks (alias routes, second entrypoints with fewer guards). `Signal:` a second writer to the same target — another route/RPC/job issuing `UPDATE` / `.save(` / `.update(` on the same table or state the guarded path writes, with fewer middleware layers.
+- **Leaked context:** differential errors, timing, or response sizes → enumeration of users, resources, internal structure. `Signal:` distinct outcomes for missing vs forbidden (`NotFound` vs `Unauthorized` branches), `err.message` interpolated into client responses, and secret comparisons using `===` / `==` instead of `timingSafeEqual` / constant-time compare.
+- **Params overriding security-relevant defaults:** `debug=1`, `skip_auth`, `allow_*` knobs on request paths. `Signal:` request query/body keys matched against security-named flags — `debug`, `skip`, `bypass`, `allow`, `admin`, `impersonate` read on handler paths.
+- **Unhandled input shapes:** arrays where scalars are expected, extra keys in JSON bodies, oversized/malformed encodings reaching parsers that fail open. `Signal:` `...body` / `...request.data` spread into model/ORM constructors, `JSON.parse` without schema validation, scalar-typed fields consumed in loops/queries without `Array.isArray` guards.
+- **Unverified claims driving decisions:** client-set headers trusted server-side, `is_admin` hardcoded client-side, signature-verified but actor-unchecked tokens. `Signal:` `jwt.decode` (not `verify`) or a signature check whose payload fields (`sub`, `user_id`, `scope`) are then trusted without binding to the presenting principal.
 
 ## 9. Category expansions beyond playbook § 2
 
@@ -123,23 +134,38 @@ Apply where the repo actually has the surface. Absence is not a finding.
 - Password-reset tokens must be bound to the account, single-use, and expiring; token logged, unbound, or non-expiring is a finding.
 - Session fixation: no session rotation on privilege change (login, privilege escalation) — the pre-auth session survives privilege gain.
 - Session lifecycle: cookies without expiry or sliding refresh, sessions never invalidated server-side on logout, tokens valid after password change — stale credentials outlive the privilege change that should kill them.
+- OAuth/OIDC callback binding: check each protection is present AND bound — `state` matches the initiating session, PKCE `verifier`/`challenge` pair, `nonce` inside the ID token, `redirect_uri` exact-match validated, and multi-IdP login picks the account the flow started for. A callback that accepts the code without tying it to the session that began the flow (login CSRF, code swap between accounts) is the finding; the protocol being present is not.
+- SAML response binding: the identity consumed must be the verified object — the signed element (Response vs Assertion) is the one whose NameID/attributes are read, canonicalization is specified, validity window and audience/recipient (`Audience`, `Recipient`, `Destination`) match the service. Signature on one element while consuming the other is the finding; "SAML is complex" is not.
+- MFA enrollment & assurance: enrollment or reset paths that a first-factor-only caller can reach, downgrade of a declared assurance level on sensitive actions, and step-up challenges not bound to the specific action being approved (a generic re-auth that approves a different, attacker-chosen operation). **Exclusion:** enrollment/recovery reachable only after a full first+second factor, or a step-up challenge bound to the exact approved action, refutes; MFA being optional for a low-risk tier is Hardening, not a finding.
+- WebAuthn/passkey verification: challenge must be fresh and server-generated, RP ID / origin must match the relying party, credential ID must belong to the authenticating user, and `userHandle` must be checked on resident-key flows. Skipping any of these server-side is the finding; WebAuthn used on a plain password field adds nothing either way.
+- Account linking & identity collision: linking flows keyed on email or a provider-supplied identifier that can match an existing account the caller does not own (pre-verify the identifier at each provider before auto-link); recovery paths that trust the same collision-prone match. **Exclusion:** a link that re-verifies ownership of the identifier at each provider (fresh challenge/pre-verify) before auto-linking, or keys on a provider-attested unique ID, refutes; an unmerged duplicate account is a UX bug, not a finding.
+- Recovery surface breadth: audit every reset path, not just the public form — support/admin tools, backup codes, device/email/phone changes. Contact-info changes and code issuance that do not invalidate existing sessions/backup codes leave the attacker's foothold intact; that is the finding.
+- API keys: key scope must bind to the resource set it is used against (a key scoped to project A reading project B is a finding); publishable-vs-secret distinction — a publishable key reaching a server-side-only context is noise, a secret key reaching a client bundle is a finding (§6 for values).
+- mTLS & certificate lifecycle: the verified peer certificate must map to the application identity the request claims (a valid cert for any tenant is not tenant auth); revocation/expiry checks that fail open on a fetch error are the finding. "Uses OAuth/SAML/MFA" is never itself a finding, and a protocol mentioned in config without a reachable code path is not a surface. **Exclusion:** a documented fail-closed revocation/expiry path — or a cert-to-identity binding enforced at request time — refutes.
 
 ### Web protocol
 
 - Request smuggling needs TWO components disagreeing over bytes (edge proxy vs app, front server vs backend); a single-server repo has no surface — mark as a lead only when deployment adds a proxy/queue.
-- Host / `X-Forwarded-*` trust: password-reset links built from the `Host` header (host-header poisoning); `X-Forwarded-For` used for authz decisions without a trusted-proxy boundary.
-- Cache poisoning via unkeyed input: request headers that alter the response but are missing from the cache key.
-- Method/path normalization: routing that distinguishes `GET` vs `POST` where middleware runs on one method only; trailing-slash and case-insensitive duplicates of the same route with different checks.
+- Host / `X-Forwarded-*` trust: password-reset links built from the `Host` header (host-header poisoning); `X-Forwarded-For` used for authz decisions without a trusted-proxy boundary. **Exclusion:** links generated from a fixed configured base URL, or the header used only for logging/rate-bucketing with no authorization effect, refutes.
+- Cache poisoning via unkeyed input: request headers that alter the response but are missing from the cache key. **Exclusion:** a header that influences only per-request values (not the cached representation) — or that the cache itself keys on — refutes the concrete path.
+- Method/path normalization: routing that distinguishes `GET` vs `POST` where middleware runs on one method only; trailing-slash and case-insensitive duplicates of the same route with different checks. **Exclusion:** route variants that all resolve to handlers with the same checks — or a normalizer that canonicalizes before middleware — refutes.
+- Cache deception / private-response caching: an authenticated (or cookie-bearing) response stored by a shared cache under a path an attacker can make the victim request — look for cache keys that strip query strings/extension normalization (`.js`/`.png` suffix tricks) and `Cache-Control` on authed responses. Not a finding when the authed response is explicitly non-cacheable, the path is not attacker-choosable, or an effective upstream control separates private from cacheable responses.
+- Response-header injection: attacker-controlled values flowing into header-setting calls (`Set-Cookie`, `Location`, custom headers) carrying CR/LF or other control characters. A framework that strips/rejects control characters in header values refutes the concrete path.
+- CSRF inventory breadth: cover every cookie-authenticated mutation — legacy endpoints predating the CSRF layer, `method-override` parameters that swap methods around middleware, login CSRF (attacker logs the victim into the attacker's account). A safely rejected request (origin check, token bound to session) or an effective upstream control refutes the concrete path; absence of a token on a same-site-only, non-mutating route is not a finding.
 
 ### Business logic & abuse
 
-- Workflow state-machine bypass: skip, go backwards, or replay completed steps; check the flow state, not just entry validation.
-- Price/discount client-trust: price math, coupons, or quotes computed client-side and trusted server-side.
-- Export / import / search as exfil-oracle: unbounded export scopes, cross-tenant export filters, search as enumeration.
-- Enumeration via side effects: signup/login/reset responses that leak account existence through timing or message differences.
+- Workflow state-machine bypass: skip, go backwards, or replay completed steps; check the flow state, not just entry validation. **Exclusion:** a transition guard on every entry point to the state (not just the happy-path route) — or a transition with no privilege/value consequence — refutes.
+- Price/discount client-trust: price math, coupons, or quotes computed client-side and trusted server-side. **Exclusion:** the server recomputing price from its own records at settlement refutes; a client-supplied value used only for display is noise.
+- Export / import / search as exfil-oracle: unbounded export scopes, cross-tenant export filters, search as enumeration. **Exclusion:** export/search scoped and filtered to the requesting principal's own records refutes.
+- Enumeration via side effects: signup/login/reset responses that leak account existence through timing or message differences. **Exclusion:** uniform responses and work-equivalent timing across existing/non-existing accounts — or a public, by-design directory (the account list is the product) — is not a finding.
 - Missing rate limits on auth/reset/expensive endpoints — respecting the deployment model: a CDN-layer or API-gateway rate limit is valid architecture, do not flag its absence at the service layer when it exists elsewhere.
-- **Idempotency and replay:** retried webhooks, replayed requests, and double-submission on payment/order paths — check the idempotency key is bound to the actor, not just present.
-- **Mass action surfaces:** bulk update/delete/export endpoints that skip the per-item checks single-item endpoints enforce.
+- **Idempotency and replay:** retried webhooks, replayed requests, and double-submission on payment/order paths — check the idempotency key is bound to the actor, not just present. **Exclusion:** a key bound to the actor and atomically claimed (compare-and-set/unique constraint) refutes; a present-but-unbound key is the finding, not a mitigated one.
+- **Mass action surfaces:** bulk update/delete/export endpoints that skip the per-item checks single-item endpoints enforce. **Exclusion:** a bulk endpoint applying the same per-item check to every item refutes.
+- Numeric manipulation: sign flips, zero/negative quantities, integer overflow, floating-point precision, string-to-number coercion on price/quantity/credit paths — reachable only when the computed value is trusted downstream (balance, limit, entitlement). Unusual arithmetic on a display-only value is not a finding.
+- Partial-failure rollback: multi-step writes (payment + order, transfer legs, quota + record) where one side commits and the other fails or is retried — the surviving half must not confer value. A transaction boundary or compensating action on the failure path refutes it.
+- Time boundaries: expiry comparisons (`<` vs `<=`), clock-skew tolerance windows, timezone-dependent "end of day" cutoffs, backdated/future timestamps accepted from input where the server's clock is the intended authority. The effect must be an unauthorized state reached through the time gap, not a stylistic preference.
+- Default & fallback posture: missing config, disabled flags, or dependency outages that fall back to allow/open/zero-cost instead of deny; migration-era code paths still reachable. The failure branch must be reachable and grant something real; a closed fallback is not a finding. **Exclusion:** require reachable unauthorized state or financial effect — an odd-but-bounded computation with no trust consequence is noise.
 
 ### Client-side
 
@@ -150,6 +176,12 @@ Apply where the repo actually has the surface. Absence is not a finding.
 - CORS: reflected origin with `Access-Control-Allow-Credentials: true` → flag; a bare `*` wildcard without credentials is not a finding.
 - Client-stored state: tokens in `localStorage` are a note in most apps (XSS is the real boundary); flag only when a CSRF-exposed or multi-origin surface makes them reachable.
 - History and referrer: sensitive identifiers in URLs leak through `Referer` to third parties; flag when the identifiers gate access.
+- DOM clobbering: attacker-retained markup (an injection sink that persists in the page) whose named elements/ids collide with script-referenced globals or `document.*` lookups — requires BOTH the retained markup AND a security-relevant consumer (a config value, permission flag, or sink argument read through the clobbered name). Clobbered names with no consumer are not a finding.
+- Cross-site WebSocket: `new WebSocket(url)` on a cookie-authenticated endpoint without origin validation on the handshake — the browser sends cookies cross-site. A server that validates `Origin` (or the app is not cookie-authenticated) refutes it.
+- Service workers: registration scope wider than the pages it intercepts, and cache-identity confusion — a worker serving cached responses keyed without URL/version/tenant discrimination can serve one user's or one version's response to another. Not a finding when scope is narrowly registered and cache keys are complete.
+- Cross-context storage: `localStorage`/`sessionStorage`/`BroadcastChannel`/shared workers reachable from other same-origin contexts (other apps on the same origin, stale tabs continuing to act after logout). Flag when a lower-privilege same-origin app reads another's data or a stale tab retains authorization; same-app session restoration is not.
+- `window.name` and URL fragments: values carried across navigations/origins (`window.name`, `#fragment`) consumed as configuration, redirect targets, or rendered content. Consumption as page data with the page's own trust is not a finding; crossing a trust boundary into a sink is.
+- XS-Leaks: requires a concrete secret-bearing predicate a cross-site principal can evaluate — an error/size/status/timing difference that answers yes/no about another user's data (e.g. search results distinguishing "exists", cross-origin frame counting a protected page). Generic timing variance or response-time jitter without the predicate is not a finding.
 
 ### AI/LLM features
 
@@ -163,16 +195,37 @@ Apply where the repo actually has the surface. Absence is not a finding.
 - Guardrail prompts are not security controls; the enforcement boundary is the handler, not the system prompt.
 - Model-scope escalation: a model that can read more than its user (shared tool session, service-account context) turns any prompt into a privilege edge — name the capability the user lacks.
 - Streaming and caching: LLM responses cached or logged without redaction can persist PII beyond the request lifecycle; check the cache key and retention like any other store.
+- Persistent memory poisoning: injected content written to durable memory (saved notes, learned preferences, stored summaries) only counts when a reachable consumer later acts on it — name the reader and the action it drives. Memory nothing reads back is not a finding.
+- Role / provenance confusion: content from a lower-trust source rendered or treated as system/developer role (tool output formatted as system messages, retrieved docs injected above user turns). Name the lower-trust author and the privilege the role label grants it. **Exclusion:** content kept in its declared role (tool/user) with no privilege attached to the label refutes.
+- Action & approval binding: confirmations must bind to the specific action payload — a "yes" approving a different tool call than the one shown, or an approval captured before the action is finalized, is the finding. **Exclusion:** an approval bound to the exact finalized payload and captured after finalization refutes; the user approving the action actually shown is not a defect.
+- Tool-schema vs dispatcher disagreement: the declared tool schema (params, constraints) differing from what the dispatcher actually passes/executes — the dispatcher's path is the real attack surface; a correct schema with a diverging executor is the finding. **Exclusion:** a dispatcher that executes exactly the declared schema — or a divergence with no capability difference — refutes.
+- Sub-agent & MCP trust inheritance: a sub-agent or MCP server inheriting the parent's authority (service identity, tenant scope, credentials) without its own checks — name the execution principal and the capability it gains beyond its caller's intent. **Exclusion:** a sub-agent running under a scoped principal whose capabilities match its caller's stated intent, re-checking its own inputs, refutes.
+- Peer identity & metadata-as-policy: peer-supplied identity claims or metadata (agent names, labels, capability announcements) treated as authorization decisions. Metadata describes; it does not authorize — a policy decision made from attacker-writable metadata is the finding. **Exclusion:** metadata used only for display/routing while authorization comes from a verified credential refutes.
+- Cross-session / cross-tenant context bleed: conversation history, cached context, or workspace state shared across sessions or tenants — the query/retrieval boundary must enforce isolation (§9h applies to the store). **Exclusion:** a retrieval query that enforces session/tenant isolation as a filter (not metadata labels or client-supplied IDs) refutes.
+- **Exclusion:** for every fold above, name the lower-trust author, the execution principal, and the capability gained. "Prompt injection is possible" alone remains insufficient — the existing first bullet governs.
 
 ### Supply chain & CI/CD
 
-- Exactly one authoritative lockfile at the install boundary: missing, gitignored, or bypassed lockfile is a reproducibility + supply-chain finding.
+- Exactly one authoritative lockfile at the install boundary: missing, gitignored, or bypassed lockfile is a reproducibility + supply-chain hygiene finding — but reporting it as exploitable still requires naming a reachable trust/authority failure (closing exclusion below): reproducibility alone is not authenticity.
 - Unreviewed dependency lifecycle scripts: install/postinstall scripts from new or low-signal dependencies.
 - Typosquat signals: near-squat names, freshly-published packages, zero-download "familiar" packages.
 - Unpinned CI actions (`@main` / `@latest`) and `pull_request_target` that checks out the PR head — the two together execute untrusted code with privileged secrets.
 - Never recommend forced remediation (`audit fix --force`, `npm audit fix --force`) — it bumps majors without review.
 - Registry scope: private registries used for public packages, registry mixing in one manifest, and packages pulled from unauthenticated mirrors.
 - Publish provenance: npm/GitHub provenance attestations absent on release-critical packages is a note, not a finding, unless the supply chain is the repo's product.
+- CI configuration is authorization code: read workflow files as policy — what untrusted input (`pull_request_target`, `issue_comment`, forks) can trigger, what secrets/capabilities/checkouts each trigger reaches. Compare untrusted-event triggers against protected-event triggers; a privileged step reachable from an untrusted trigger is the finding. **Exclusion:** an untrusted trigger reaching only unprivileged steps (no secrets, read-only or no checkout) refutes.
+- Cache/artifact/workspace trust mixing: caches or artifacts written by untrusted runs restored into privileged ones (`actions/cache` keyed on branch an attacker can push to, artifacts downloaded without run-source checks, workspace state persisting across jobs with different trust). **Exclusion:** caches keyed on immutable refs/content hashes, or artifacts consumed only after run-source verification, refutes.
+- Expression/command confusion: `workflow_run`/event JSON fields (`title`, `branch`, `head_commit.message`) interpolated into `run:` shell or script contexts; matrix values derived from untrusted event payloads. `${{ }}` in a `run:` block is untrusted input at a shell sink. **Exclusion:** untrusted fields interpolated only into non-executing contexts (job/step names, labels) or passed as arguments to a step that does not eval them refutes.
+- Build-context inclusion: secrets or env needed by one build stage placed in a context (Docker build context, artifact upload scope) readable by a wider stage/consumer than intended. **Exclusion:** secrets scoped to the exact consuming stage (BuildKit secrets, per-stage mounts, scoped uploads) refutes.
+- Promotion digest binding: the digest attested/built must equal the digest promoted/deployed — promotion flows that re-resolve a tag instead of pinning the built digest lose the binding. **Exclusion:** promotion that pins and re-verifies the built digest refutes.
+- Attestation claims: signature/attestation verification must check identity claims (subject, repo, workflow, issuer), not just that a signature exists; verifying an attacker-attested artifact is not verification. **Exclusion:** verification matching subject/repo/workflow/issuer against the promotion policy refutes.
+- Fail-closed lifecycle: expiry, revocation, and rotation of tokens/signing keys that fail open on fetch/refresh errors; an updater that accepts metadata when the timestamp/rotation check errors is the finding. **Exclusion:** a documented fail-closed path — reject or hold on fetch/refresh error — refutes.
+- Updater integrity: update metadata verification (signer, version monotonicity, rollback acceptance) and atomic install — a partially applied update executable on the failure path is the finding. **Exclusion:** an updater verifying the signer, rejecting non-monotonic versions, and installing atomically (staged swap) refutes.
+- Extension/plugin hooks: hooks or plugin entry points that run before trust checks (pre-install scripts, extension init with host credentials) — order of execution vs order of validation is the check. **Exclusion:** hooks running after trust checks, or under an unprivileged identity, refutes.
+- Error-path policy: failure branches of CI steps and deploy scripts that retry open, skip verification, or dump secrets into logs/artifacts on error. **Exclusion:** failure branches that fail closed and redact secrets refutes.
+- Source/namespace confusion: dependency resolved from a different registry/source/namespace than the manifest declares (scope squatting on internal namespaces, mirror override, `--registry` on the CLI but not in the lock). **Exclusion:** a lockfile/resolution pinning the declared source, with no registry override reachable on the install path, refutes.
+- Mutable build inputs: floating refs (`@main`, `latest`, branch pins) in actions, base images, or dependency specs feeding privileged builds. **Exclusion:** a mutable dependency alone is not a finding — the float must feed a privileged build or a shipped artifact.
+- **Exclusion:** reproducibility is not authenticity — a reproducible build of attacker-chosen inputs proves nothing. Dependency mutability, a CVE, or missing least privilege alone is not proof of a reachable exploit; name the trust/authority failure an attacker reaches.
 
 ### Infra configs
 
@@ -181,14 +234,102 @@ Apply where the repo actually has the surface. Absence is not a finding.
 - Debug modes and default credentials in production config: actuator/debug endpoints exposed, default admin passwords, verbose stack traces.
 - Network exposure: services binding `0.0.0.0` without a stated reason, admin/management ports on public interfaces, health or metrics endpoints answering unauthenticated requests with internal state.
 - Backend service config: database connections over plaintext, missing auth on internal caches/queues (Redis, RabbitMQ), and service-to-service credentials embedded in source.
-
-### Privacy / retention
+- Workload identity / IAM: role or service-account permissions judged against what the workload actually calls, not the class "too broad"; an unused permission without a reachable abuse path is a Hardening note.
+- Cross-account role binding: assume-role/impersonation paths must bind external ID / audience / tenant condition — a role assumable by any principal in the trusted account is the finding. **Exclusion:** a checked-in trust policy requiring the external ID/audience/tenant condition (and the caller's config showing it is passed) refutes.
+- Application trust in metadata: platform-injected headers/labels/annotations (mesh headers, task metadata, k8s labels) consumed for authorization inside the application — the platform attests placement, not permission; an app-level decision made from them is the finding. **Exclusion:** metadata used only for display/routing while the authorization decision comes from a verified credential refutes.
+- Mesh/proxy escapes: alternate ports bypassing the sidecar, health/readiness paths exempt from auth but serving state, fail-open modes on the mesh or proxy config. **Exclusion:** the alternate path enforcing the same auth chain as the primary (same interception, authenticated health path, fail-closed mesh config) refutes.
+- Metadata-service reachability: workloads that can reach the cloud metadata service (IMDS) with credentials-returning routes, and IMDSv2-style mitigations absent where the runtime supports them. **Exclusion:** checked-in config showing the mitigation enforced (token-required IMDS option, hop limit, or a network policy blocking IMDS) refutes.
+- Admission & restore/upgrade paths: policy that enforces at admission but not on restore-from-backup, upgrade, or direct-API mutation of the same objects — the object can enter through a path the policy does not gate. **Exclusion:** the same policy demonstrably enforced on every mutation path (a controller reconciling all entry paths, or admission coverage of restore/upgrade) refutes.
+- Namespace/label trust: isolation or authorization derived from namespace names or labels an unprivileged principal can create or relabel. **Exclusion:** authorization bound to verified credentials rather than namespace/label names — or a policy restricting those labels to principals the policy already trusts — refutes.
+- Security-control precedence: two controls of different strength covering the same path (a restrictive NetworkPolicy plus an allow-all default, an RBAC deny plus a wildcard role) — the effective weakest control governs; name which one the request actually meets. **Exclusion:** the weaker control not being on the request's actual path (the allow-all default unreachable for these routes, the wildcard role ungrantable to this principal) refutes.
+- Credential renewal & outage fallback: token/secret renewal paths that on outage fall back to the previous (or unauthenticated) credential instead of failing closed. **Exclusion:** checked-in config/code showing a fail-closed fallback — reject or queue on renewal failure — refutes.
+- Signed references & object policies: signed URLs / pre-signed objects scoped wider than the feature that issues them (wildcard resources, long TTLs, no method restriction); object/store ACLs disagreeing with the application's tenant model. **Exclusion:** signatures scoped to exactly the issuing feature's resources with restricted methods and TTLs, and store ACLs matching the tenant model, refutes.
+- Event-source identity: consumers trusting event payloads' claimed identity without verifying the source binding; replay of already-processed events; dead-letter queues readable or retained beyond the source's trust scope. **Exclusion:** consumers verifying a source binding (signature/envelope identity) before acting, replay dedup, and DLQ ACLs scoped to the source's trust refutes.
+- Edge vs origin mismatch: CDN/edge runtime behavior (rewrites, header normalization, auth at edge) that the origin does not assume — origin trusting an edge-only header, or edge passing paths the origin router normalizes differently. **Exclusion:** the origin deriving decisions only from values it independently verifies — or edge and origin config showing identical normalization — refutes.
+- **Evidence discipline:** inspect already-available effective configs/manifests and source precedence (repo files, rendered artifacts checked in, `kubectl get -o yaml` output committed into the repo); **never run** deployment/render/build commands during an audit. Manifest-only assumptions or unknown provider defaults remain **requires runtime verification** (§12), not lower-severity confirmed findings.
+
+### Data isolation & lifecycle
 
 - PII classification: name the fields that are PII here (identity, credentials, money, contact, content) before assessing.
-- Retention: personal-data stores need a TTL and a working deletion path — backups, caches, and indexes included; a deletion function that misses any of these is a finding.
 - Sensitive fields in API responses or logs: tokens, money fields, PII in debug output, structured logs without redaction.
-- Deletion-path verification: an API that deletes the record but leaves the file, the blob, or the analytics event is a retention finding even when the primary store is clean.
 - Export surfaces: bulk export, backup, and data-portability endpoints that return more than the requesting tenant owns are both a privacy and an IDOR risk.
+- Record lineage: trace one record's copies across write/query/cache/index/event/export/backup/delete/restore — every hop must carry the original's access boundary. A hop that drops or widens it (cache keyed without tenant, index without ACL filter, export without scope) is the finding.
+- Composite-key & namespace collision: keys/namespaces combining tenant + resource where attacker-chosen components can collide across tenants (string concatenation without separator or escaping, shared global sequences) — the collision must let a lower-trust principal read or write the other tenant's record to count.
+- Policy vs query disagreement: the declared isolation policy (RLS, row filter, tenant middleware) differing from what the actual query path enforces — a raw-query or admin-code path skipping the tenant filter is the finding even when the standard ORM path is clean.
+- Blob & signed-reference scope: stored objects reachable through references (signed URLs, IDs, paths) granting wider access than the owning record's ACL; derived copies (thumbnails, exports, embeddings) inheriting store defaults instead of the source's ACL.
+- Import/restore authority expansion: import or restore flows executing with more authority than the calling user (system identity, cross-tenant targets, unvalidated ownership on the imported records) — the imported data must land inside the caller's boundary.
+- Migration & backfill ownership: migrations/backfills/rollbacks that read or write across tenant boundaries, or set ownership/tenant fields by assumption rather than source-of-truth lookup; rollback code is code — audit it like a write path.
+- Backup/replication drift: replicas or backups with a different access boundary than the primary (broader readers, weaker auth, longer retention) — data whose protection ends where the replica begins is a boundary breach, not a lifecycle preference.
+- Tombstones & re-registration: soft-deleted records resurrected by ID reuse or re-registration, or visible through views/queries that don't filter the tombstone; deletion must survive the identifier's reuse.
+- Stale authorization beyond sessions: authorization state cached outside the session — grants materialized in tokens, group membership in long-lived jobs, capability URLs issued before a revocation that never reach them. Revocation must propagate to every consumer of the grant, or the finding stands.
+- Retention & deletion guarantees: missing TTL alone is **not** a finding — it is a Hardening note. A retention finding requires an explicit access/deletion/revocation guarantee the code claims plus a demonstrated breach: an unauthorized reader, or a subsequent operation the guarantee said was impossible. Incomplete deletion (record deleted, blob/cache/index/analytics copy left) remains a finding when it demonstrably breaches the declared boundary — which copy, which reader.
+
+### 9i. Desktop, mobile & local IPC
+
+Reportable path requires a **lower-trust caller, a privileged consumer, and an unauthorized effect** — all three. Same-user arbitrary plugin/app installation is not a boundary (any user can run code as themselves); look for a distinct protected principal or a capability boundary the caller should not cross.
+
+**Webview & renderer surfaces**
+
+- Webview navigation & privileged bridges: a webview granted bridge/native-API access (`addJavascriptInterface`, `WKScriptMessageHandler`, Electron `ipcRenderer` in the renderer) that can be steered by navigation to attacker-influenced content — the bridge must be gated on a verified, first-party origin/page, not on "the webview exists". **Exclusion:** bridge messages validated against an origin allowlist checked at message time, or the bridge exposing no capability beyond what the page already has, refutes.
+- Renderer/process isolation: privileged work (file access, token handling) executed in the same process/trust domain as untrusted rendered content — name the capability the renderer process gains. Site-process isolation or contextIsolation enabled with no node/IPC escape refutes.
+
+**Entry & address handling**
+
+- Deep-link ownership & account binding: a custom-scheme/universal-link handler that accepts an action (login confirm, token consumption, account switch) without binding the link to the expecting account/session — an attacker-sent link acting on the victim's account is the finding. **Exclusion:** the handler re-verifying the acting account against the link's target before executing refutes.
+- URI normalization: scheme/host/path parsed differently by the entry handler and the privileged consumer (scheme confusion on `intent://`-style URIs, case/percent-encoding surviving into an allowlist check). The effect must be reaching a consumer the declared scheme excludes; a canonicalizing parser refutes.
+
+**Local IPC channels**
+
+- Named pipe / socket access controls: a locally exposed pipe/socket performing privileged work with peer checks absent or checkable by connection alone (filesystem permissions on the socket path as the only gate, world-accessible service sockets). **Exclusion:** the server verifying peer credentials/uid at accept time and binding them to the request's authority refutes.
+- Binder/D-Bus/XPC interfaces: exported/registered IPC methods whose validators check the *caller-claimed* parameter but not the *caller* — privileged method reachable from any app/session. **Exclusion:** per-caller policy (`XPCConnection` audit, Binder `checkCallingPermission`/uid checks, D-Bus policy) enforced on the interface refutes.
+- IPC peer credentials vs payload identity: the peer's OS-level credential (uid, pid, connection attestation) is the only caller identity; identity *claimed in the payload* (a username, tenant ID, "admin" flag field) is an assertion, not authentication. A privileged consumer trusting the payload's claim while the peer credential belongs to a lower-trust sender is the finding. **Exclusion:** the consumer comparing the verified peer credential against the payload claim and rejecting mismatch refutes.
+
+**Secrets, files & installation**
+
+- Keychain/keystore access groups: credentials stored under an access group/keychain-sharing entitlement readable by other apps/binaries of the same team signing different products — name the second consumer. Distinct access groups or single-consumer storage refutes.
+- Shared-file & temp-path ownership: privileged code reading/writing a predictable world-writable or group-writable path (temp file symlink swap, cache poisoning feeding a privileged read). **Exclusion:** `O_CREAT|O_EXCL`/`O_NOFOLLOW`-style creation or a user-private directory refutes.
+- Installer/updater authority: an installer, updater, or privileged helper executing payloads (scripts, binaries, package contents) whose placement a lower-trust writer can influence (writable staging dir, unsigned payload, mutable download verified only at first run). Unknown or indeterminate signing or device policy is **requires runtime verification** — a **Needs verification** lead (§12). **Exclusion:** signature verification at execution time by the privileged side, over a path the untrusted writer cannot write, refutes.
+- Merged manifest/entitlement overrides: the effective policy is the merge of platform manifest, build config, and overlay files — an override layer (build type, product flavor, debug overlay) adding a permission, exported component, or entitlement the source declaration does not show. Inspect the merged effective artifact in the repo; a merge you cannot determine from checked-in files is **requires runtime verification** — a **Needs verification** lead (§12). **Exclusion:** an inspectable effective artifact (merged manifest/entitlement output) showing no permission, exported component, or entitlement beyond the source declaration — no unauthorized override — refutes.
+- Extension permissions: a browser/editor/agent extension granted host permissions whose content or background code can act with the host app's authority beyond the permission's stated scope (all-URLs permission plus message-passing bridge to any page). **Exclusion:** the extension's privileged paths verifying message origin/sender against the declared scope refutes.
+
+**Cross-app actions**
+
+- Clipboard consumers: privileged features auto-consuming clipboard contents (token/OTP paste, "open link from clipboard") where any lower-trust app controls the clipboard. The check is the privileged action on attacker-chosen content; clipboard access being common is not itself a finding.
+- Intent forwarding/redirection: an exported component forwarding attacker-supplied intents/bundles to privileged internals (intent redirection, nested `Intent` extras executed with the app's identity). **Exclusion:** the forwarding component re-granting only its own (unprivileged) permissions or validating the target refutes.
+- Exported background services: exported services/receivers performing sensitive work (sync, backup, account ops) invocable by another app with attacker-chosen parameters. **Exclusion:** permission-protected exports, or parameter validation binding the action to the caller's own account, refutes.
+- Notification actions: action buttons/quick replies executed with app privileges but content influenceable by another app's notifications (action routed by notification extras an attacker's notification also carries). **Exclusion:** the handler verifying the notification's identity/ownership before executing its action refutes.
+
+### 9j. Memory safety & binary
+
+Source review only — no sanitizer/fuzzer execution steps. Trace untrusted data from the parser/FFI boundary through **size/unit conversion → allocation → ownership transfer → alias use → release**; a finding names the broken step and the supported effect.
+
+- Integer boundaries: subtraction underflow (length minus length), size multiplication without overflow check, narrowing conversions (`size_t` → `u32`), negative-to-unsigned casts, and sentinel values (`-1` as length/count) flowing into allocation or copy sizes. The converted value must reach an allocation/copy/index to count; a rejected or clamped path refutes.
+- Ownership & lifetime: stale aliases after transfer (use-after-free), double-free, observers draining a collection while a worker iterates, reference-count manipulation on shared objects across threads (racy `retain`/`release`), and TOCTOU where the file/handle is re-validated then reopened. Name the second use or second release; a single-owner discipline refutes.
+- ABI & layout: cross-language structs/enums whose layout, size, or discriminants disagree across the boundary (`#[repr(C)]` mismatch, enum value out of the declared range, unwind across an FFI frame, thread-affinity violations when passing handles). The effect must be a real misread/misdispatch, not a stylistic portability note.
+- Loader & image trust: dynamic-loader search order trusting a writable directory (`PATH`/`LD_LIBRARY_PATH`/relative rpath), verify-then-open mismatches (signature checked on one path, file loaded from another), and malformed metadata/relocations trusted by a custom loader. Classify as unauthorized image load only when the writable path reaches the load; an unverifiable runtime search order stays **requires runtime verification**.
+- JIT & double-fetch: generated code consistency with the data it validates (bounds check compiled against one snapshot, executed against another), and double-fetch/user-copy patterns where shared or user memory is read twice with the size/bounds check between reads. A single read or kernel-side copy-in refutes.
+
+**Effect classification:** claim only the effect the source shows — invalid read/write, stale alias reuse, wrong-object dispatch, uninitialized output, unauthorized image load, deadlock, or safe termination. Unprovable effects downgrade to a **Needs verification** lead (§12), never to confirmed.
+
+**Exclusions (each on its own terms):**
+- Stack allocation alone is not a leak — stack memory is reclaimed by return; a leak claim needs the buffer's address or contents escaping the frame.
+- Language-permitted output variance (unspecified iteration order, float reassociation, hash seed differences) is not a vulnerability without a security-relevant consumer of the variance.
+- Safe malformed-input rejection (parse error → clean abort) is not corruption; the finding requires malformed input accepted or misparsed into a wrong-but-valid state.
+
+### 9k. Availability & resource exhaustion
+
+A finding requires the full chain: an **input → cost path**, an **absent effective upper bound**, and **harm to another principal, a shared service, or shared spend**. A bounded same-user cost alone is hardening. Check the whole path for existing bounds before blaming the missing service-local rate limiter — another layer (gateway limit, queue cap, DB constraint, tenant quota) bounding the path refutes.
+
+- Input-to-cost bounds: body/message/file size limits, parse depth/complexity caps, and effective (not declared) upper bounds — a config constant that the actual path bypasses is absence, not a bound. **Exclusion:** an effective size/depth/complexity cap that the actual input path cannot bypass (the configured limit is enforced on the exact path the input takes, not an adjacent one) refutes.
+- Superlinear parsing & ReDoS: quadratic string handling, backtracking regexes on user input (`(a+)+$` shapes on request paths), nested decode loops. A linear parser or a pre-size-gated input refutes.
+- Decompression & amplification: multi-stage/multiplier decompression without output caps, query/fan-out amplification (one request triggering N upstream calls with attacker-chosen N). Bounded fan-out or an output-side cap refutes.
+- Aggregate buffering & cardinality: per-item bounded but aggregate unbounded (unbounded in-memory accumulation, session/map growth, metric cardinality explosion from attacker-chosen label values). Eviction or a global cap refutes.
+- Leak families: shared FD/handle/temp-file leaks on error paths, and work that survives cancellation (abandoned requests still consuming DB/worker capacity — a cancelled request whose query keeps running is the finding). Cleanup on the error/cancel path refutes.
+- Asymmetric & pre-auth work: expensive operations (crypto, signature verification, password hashing) reachable pre-authentication where the cost ratio favors the attacker. Existing early cheap rejection refutes.
+- Quota & reset semantics: quota windows/reset boundaries the caller can exploit (quota reset mid-burst, per-request quota ignoring aggregate spend), mismatch between the metered unit and the actual cost unit. Aligned metering refutes.
+- Pool & supervisor scope: pool starvation by one tenant's slow work (connection/worker pools without per-principal fairness), fatal errors taking down a shared supervisor, retry storms on failure (unbounded retries amplifying an outage), poison records or head-of-line blocking (one malformed/repeatedly-failing item requeued ahead of healthy work, blocking or crashing the shared queue/worker pool — the finding is the poisoned item starving or cycling other principals' work), fail-open recovery, and capacity rollback that restores stale state. Fair scheduling or bounded retry with backoff — including a dead-letter/quarantine path for the poison record — refutes.
+
+Never prescribe stress-testing or pressure shared/live services — this is static review of the cost path only.
 
 ## 10. Deployment & environment caveats
 
@@ -216,4 +357,25 @@ Apply where the repo actually has the surface. Absence is not a finding.
 - **Static evidence required:** every finding carries `file:line` and the code shape — the pattern plus the attacker-controlled input. No evidence, no finding.
 - Runtime-dependent claims are labeled exactly **requires runtime verification** and go to the audit index's **Needs verification** section — never reported as confirmed.
 - Findings use the standard finding format (**`references/finding-format.md`**); the Impact field must state the concrete attack scenario ("Send this request, get this result").
-- State what was NOT audited (effort level, unread packages, deployed-version assumptions) in the report, per the playbook's audit contract.
+- Record what was and was not audited as Coverage rows in the report — one row per material review question, never a bare "not audited" disclaimer — per **`references/codebase-audit.md`** § Coverage contract.
+
+## 13. Per-class exclusion rules
+
+Residual exclusion decisions not owned by an existing section. Each rule decides a class of signal; where a section already owns the check, this section points, it does not copy (§§2/5/6/7/9/10/11/12/14, §9i–§9k). Pointers name the most specific in-document owner; where the governing spec's §4 decision map names a coarser home (stored tokens → §9d vs §9h here; rate limits adding §9c), the deviation is intentional and this section governs. A demonstrated vulnerability is never exonerated by the mere presence of a common false-positive signal — confirm the concrete untrusted path and effect, or name the missing fact.
+
+- **Self-injection / attacker's own data is not a finding alone — require an effect on another principal, origin, or protected shared state.** Self-XSS, a user corrupting their own records, or confusion over their own token affects no boundary. The decision follows §2's anti-strengthening rule (same-principal behavior is not privilege escalation); §13 applies it as the exclusion test: name the second principal, the other origin, or the protected shared state the payload reaches, or drop the finding.
+- **Some permission check exists is not a finding alone — and it does not refute a bypass either.** The check must bind *this* principal, *this* resource, *this* action, and *this* entry path. A role check on the controller does not cover the sibling route; an `is_owner` filter on the list endpoint does not cover the per-item fetch; a middleware that authenticates does not authorize. Confirm the same check governs the exact path the attacker takes (§8 delegated-checks lens), or the bypass stands.
+- **A crypto-error branch or write-only validation is not a finding alone — require untrusted data reaching the weaker read/fallback path and a resulting effect.** A failing-open encryption helper, a verify-then-use gap, or validation performed on the write path but not on a later read path is a lead until the flow is traced (§7): name the untrusted input, the path where the check is skipped or weaker, and the effect the weaker path enables. Safe failure (reject, abort, fail closed) refutes the claim; an untraced fallback stays a **Needs verification** lead (§12).
+- **Pointers — each already owned, do not re-add:** missing headers/cookie attributes/rate limits → §2 defense-in-depth rule, §9c rate limits, §9k bounds · missing MFA/assurance gaps → §9a MFA enrollment & assurance · stored tokens/continuing use after revocation or logout → §9a session lifecycle, §9h stale authorization beyond sessions · identifiers named "key"/secret references → §6 symbolic-names rule, §9a publishable-vs-secret · internal network/schema/tenant labels and protocol disagreement → §14 · manifest-only inference → §9g evidence discipline, §10 · mutable/vulnerable dependencies and reproducible builds → §9f closing exclusion · same-user plugin installation → §9i intro · missing TTL/incomplete copies → §9h retention guarantees · generic timing variance → §9d XS-Leaks predicate · framework-escaped interpolation → §5 · missing sanitizer/seccomp/read-only filesystem → §11 OWASP-deviation rule, §9j exclusions · unknown version/configuration → §12 (Needs verification, never a downgraded confirmed claim).
+
+## 14. Protocol, RPC & messaging invariants
+
+Grouped invariants for RPC frameworks, message queues, and event streams. Apply only where an RPC/queue/event surface exists; absence is not a finding. Groups contain related checks — this is not a second domain catalogue. Protocol disagreement alone is not a finding: **accepted unauthorized effect is required; safe rejection by either endpoint refutes that path.** Behavior that cannot be verified from source stays a **Needs verification** lead (§12), never a downgraded confirmed claim.
+
+- **Peer identity and authority.** An internal network location, schema validity, or successful deserialization does not authenticate the producer or principal. Compare the verified envelope identity (mTLS peer, SASL principal, signed envelope) against body-claimed identity (`user_id`, `tenant`, `on_behalf_of` fields) and control-plane authority (admin topics, management APIs). **Exclusion:** an explicit authenticated binding — envelope identity verified and bound to the operation before dispatch — refutes the claim.
+- **Endpoint coverage.** Authorization enforced on the primary method does not cover sibling surfaces: trace interceptors/middleware through streaming methods, reflection/health/metadata endpoints, and gateway-transcoded paths (REST-over-gRPC annotations, protocol bridges). **Exclusion:** absence of a reachable weaker path — every sibling route passing through the same interceptor chain or an equivalent check — refutes the bypass.
+- **Resource and stream authorization.** Per-item authorization on unary calls must also hold per-item within continuing streams (server/client/bidi streams, batch consumers), and topic/queue ACLs must match the tenant model (a shared topic readable by any tenant's consumers). Payload tenant labels alone are not isolation — **but** a consumer that itself enforces tenant checks on every delivered message closes the path; an enforcing consumer refutes.
+- **Correlation and ordering.** Correlation/request IDs must bind to the originating request and principal, not merely be present; then examine ack/commit ordering — accepting a stale, out-of-order, or replayed message into authorized state (idempotency-key without principal binding, offsets committed before the side effect, out-of-order writes winning). **Exclusion:** accepted *unauthorized* state is required — mere parser disagreement or rejected duplicates refutes.
+- **Failure channels.** Dead-letter queues, error topics, and retry buffers inherit producers' sensitive payloads and are frequently readable by wider audiences than the source topic; retained secrets/PII in DLQs past the source's retention scope is the finding. **Exclusion:** private, correctly scoped diagnostics (DLQ ACLs matching or tighter than the source, redacted payloads) refutes disclosure.
+- **Two-sided protocol enforcement.** Trace both producer and consumer sides of the contract, including replay and ordering validation on the consuming side — a producer that signs and a consumer that ignores the signature is an unenforced contract. **Exclusion:** safe rejection on *either* side (producer refusing to emit malformed frames, or consumer validating and dead-lettering them) blocks confirmation of the path; where the repo shows only one side, unverified behavior of the other stays a **Needs verification** lead (§12).
+

package/harness-skills/mstar-branch-worktree/SKILL.md

@@ -234,11 +234,12 @@ Default process artifacts are **gitignored** (`mstar-conventions`「Git 跟踪
 生命周期末端的物理回收（feature/integration worktree、本地/远端分支删除）的 ownership 与守卫规则**只在本节**；两条时序车道的 call site（Phase-2 同轮 / Phase-6 收尾）只引用本节，不复制规则。命令（**dry-run 默认**；无 fetch / prune / 任何写入）：
 
 ```text
-mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--remote] [--worktree <path>] [--ignore-unreadable-snapshots]
+mstar worktree cleanup --workflow <id> [--harness <path>] [--apply] [--remote] [--worktree <path>] [--all-workflows] [--verbose] [--ignore-unreadable-snapshots]
 ```
 
 - dry-run 逐候选打印 `verdict | kind | ref | reason` 后结束；`--apply` 只执行当前 `remove` 行。Exit：0 = 合法 dry-run / eligible 移除全部成功；1 = 探测/变更失败；2 = usage。失败行**永不扩大范围**；受保护/拒绝行保持可见。
-- `--worktree <path>` 可重复：既收窄 worktree 候选集，也是**操作者所有权断言**——必须匹配记录的生命周期分支与同仓 checkout 身份，不能认领其他 lifecycle 的 worktree。`--remote` 只决定是否纳入 `origin/*` 删除候选；安全探测（integration 证据）无论是否 `--remote` 都会收集。
+- **候选范围（默认 scoped）**：默认候选只来自**选中 workflow 的记录归属**（snapshot 行元数据或已验证的 `--worktree` 断言）；`--all-workflows` 恢复**全量扫**（含未记录 ref 与所有 workflow 的候选）。`--worktree <path>` 可重复：既收窄 worktree 候选集，也是**操作者所有权断言**——必须匹配记录的生命周期分支与同仓 checkout 身份，不能认领其他 lifecycle 的 worktree；带 `--worktree` 时本地分支候选进一步收窄到与保留断言 owner 精确同属的分支（无命中的断言 owner ⇒ 无分支候选，**没有**全量回退；missing / 越界的断言路径只产出一条 note，不构造目标）。
+- `--remote` 只决定是否纳入 `origin/*` 删除候选；**本地**合并证据（`git branch --merged <base>` 成员资格）**无论是否 `--remote` 都会无条件收集**，**远端** integration 证据仅在使用 `--remote` 时收集。证据探测**有界**：base 解析一次、每个去重 base OID 至多一组 membership sweep + pass 内不可变备忘录，`--verbose` 追加逐对 ancestry 诊断（不改变候选与判定）。
 - **信任模型**：`--harness <path>` 为操作者提供且受信——dry-run 与 `--apply` 的全部状态事实（snapshot、lease、行归属元数据、protected 锚点）均读自该目录。
 - **坏 sibling 不再阻塞，且不丢保护**：扫描 `workflows/*/snapshot.json` 时，**非选中**的坏 snapshot 不会让命令失败（exit 1）。**JSON 可解析但校验失败**者以**降级保守形态**入安全集：只携带具保护性的声明（`branch.base` / `branch.integration` / `branch.target`、lifecycle worktree path、merge / execution lease、行 ownership 元数据），且 lifecycle 与行状态一律强制为非终态——故只会**增加** keep/refuse 判定，绝不减少（它保护的分支/worktree 会被 `cleanup.keep.protected-ref` 或 `cleanup.refuse.*` 拦住）。**完全不可解析**者声明不可知：默认 **withhold 全部 remove**（改判 `cleanup.refuse.unreadable-snapshot`，plan 仍完整打印），仅当操作者给出 `--ignore-unreadable-snapshots` 断言时才按可读 snapshot 判定。**选中** workflow 自身 snapshot 不可读仍是探测失败（exit 1）；任何坏 snapshot 的字节**永不**被修复、改写或删除。
 

package/harness-skills/mstar-dispatch-gates/SKILL.md

@@ -44,6 +44,11 @@ description: Morning Star 派发与委派门禁 —— 仅 PM 可增派 subagent
 - **credential 不下发 leaf**：session JSON 路径、`mstar plan --session` 写凭据、`--expect <revision>` 等**只由派发方（PM/coordinator）持有**。leaf 拿到 session 路径或写凭据即视为越权 → 停止并回报（`mstar-iteration/references/plan-scoped-pm.md` §8）。
 - **`project-manager` 不是派发目标**：PM 是 primary-session 角色，无 subagent shell（规则家 → `mstar-roles/references/project-manager.md` § Plan-scoped authority；宿主派发面 → 当前宿主的 **`mstar-host` reference**（角色绑定 / 派发小节））；scoped primary drive（`/iteration-drive --assignment | --workflow --plan | --resume`）在**主会话**启动 PM，不是 subagent。任何 `Execute as: project-manager` 的 invoke = 派发缺陷。
 
+## 跨会话 primary 并发：唯一受支持形式（scoped route）
+
+- 跨**独立主会话 / 终端**的并发只有一种受支持形式：**scoped route** —— 由已准备（prepared）的 Assignment 作为**全新会话的第一条指令**启动该会话。通过终端提示词下发自拟的 leaf Assignment **不是**受支持的派发路径：它绕过 scoped 启动、lease 归属与 handoff 交接。
+- 本边界不取代宿主的原生 leaf 派发，也不重复 N-invocation 机制（→ **`mstar-host`** → `references/parallel-dispatch.md`）；该路线的操作前置清单由宿主 reference 独有承载。
+
 ## 调度防串扰（强制；leaf executor 已在上方读过反递归红线，此处为完整规则供 PM/对照用）
 
 - 只有 **`project-manager`** 可以决定增加/并行 subagent；承接方**默认不得二次分派**。
@@ -111,6 +116,7 @@ When **`Execution mode: sdd`** (`mstar-sdd`):
 当 PM 派发**文档编辑类**专业角色（如 product-manager、architect、writing-specialist）直接修订 harness 产物时：
 
 - PM 写初稿；各角色通过宿主 invoke **直接编辑**目标文件（**不**另写仅评论式 `reports/` 替代修订）。
+- **`Inputs`（Phase 1 review-and-edit Assignment）**：PM 初稿 = **骨架 + 完整上下文**；深度契约、marker 语法与 owner 词汇 → **`mstar-iteration/references/phase-1-prepare.md`** §1.3（本文件不重述其形态）。该轮 Assignment 的 **`Inputs`** 必须携带：初稿路径（+ compass 路径）；方向决策 —— 或指向 compass `## Decisions` 的指针；带 owner 的 open questions —— 或指向 `## Open Questions` 的指针；非目标理由；**该角色 own 的 marker 清单**（`TODO(owner: …)`；清除义务随清单下发 —— 承接方须在自己的 Completion Report 中报出**清除计数 / 重新归属计数**，义务全文 → **`mstar-iteration/references/phase-1-prepare.md`** §1.6）。承接方看不到 PM 会话：这些字段缺一，角色就只能从零重推它看不见的上下文。
 - **1 Assignment ⇒ 1 invoke**。
 - **Phase 1 Review & Edit chain**（`mstar-iteration` §1.6）：主产出 **`{SPECS_DIR}/`** + **`{ITERATION_DIR}/<iteration-id>/`** package；**禁止** start 链向 `{KNOWLEDGE_DIR}/` 新增。close 时 **`mstar-compound`** 提升 package → knowledge。
 - 其他彼此独立、无先后依赖的文档编辑任务：可并行（同条消息发满 N），见 **`parallel-dispatch.md`**。
@@ -127,6 +133,7 @@ When **`Execution mode: sdd`** (`mstar-sdd`):
 - 递归同角色 subagent；把 Handoff / 多轨编排措辞当 invoke。
 - Review-and-edit 链未完成即 commit integration 分支；PM 代做专业角色编辑而不 invoke。
 - Phase 1 review-and-edit 链三角色并行派发，或未等上一角色返回即派发下一角色。
+- 派发 Phase 1 编辑角色时不给方向决策 / open questions（或只写「见 compass」而不给路径）⇒ 承接方被迫重推它看不到的上下文，且其 own 的 marker 无人清除。
 - Assignment 已写、invoke 为零（paste-only）却进入下一 gate。
 - Task/subagent item 漏写角色绑定字段（字段名与静默回退行为以当前宿主的 `mstar-host` reference 为准）⇒ **静默回退 generic worker**，却因 count=N 通过而误判「派发完成」；属 paste-only 同级的 **dispatch-incomplete**。N=1 顺序 Review-&-Edit 链最易在此漏字段。
 

package/harness-skills/mstar-harness-core/SKILL.md

@@ -43,8 +43,8 @@ description: Morning Star (启明星) harness **生命周期 / 授权语义权
 | 角色 | 始终 | 按任务追加（典型） |
 |------|------|-------------------|
 | **全部** | 加载选择 → **`mstar-roles`**（hub § Load Order；本 skill = 生命周期/授权权威，`mstar-roles` hub bootstrap 是 core-first 的唯一例外） | — |
-| **`@project-manager`** | 本 skill | `mstar-dispatch-gates`、`mstar-phase-gates`、`mstar-conventions`、`mstar-roles`；implement 波次 `mstar-sdd`；派 QC 前 `mstar-review-qc`；并行/审查 `mstar-branch-worktree`；plan/status/review bundle `mstar-artifacts`；UI 类 plan Prepare 阶段 `mstar-design-md`（DESIGN.md 门禁）；新建/大改 skill 时 `mstar-skill-authoring`；迭代管理 `mstar-iteration`（Phase 1–5）；战略性工作 `mstar-strategy`；`audit` 类请求 `mstar-audit`（执行归 `@code-reviewer`）。**不**读 `mstar-coding-behavior` |
-| **实现/审查/运维** | 本 skill + `mstar-coding-behavior` + 角色 ref | 有 git 写：`mstar-branch-worktree`；有 plan 路径：`mstar-conventions`；**PM** 派 QC 前：`mstar-review-qc`；**`qc-specialist*`**：`mstar-roles` → `references/qc-specialist/`；`qa-engineer`：`references/qa-engineer/`；改 status/residual：`mstar-artifacts`；UI：`mstar-design-md`；知识库：`mstar-compound`（PM） |
+| **`@project-manager`** | 本 skill | `mstar-dispatch-gates`、`mstar-phase-gates`、`mstar-conventions`、`mstar-roles`；implement 波次 `mstar-sdd`；派 QC 前 `mstar-review-qc`；并行/审查 `mstar-branch-worktree`；plan/status/review bundle `mstar-artifacts`；UI 类 plan Prepare 阶段 `mstar-design-md`（DESIGN.md 门禁）；新建/大改 skill 时 `mstar-skill-authoring`；迭代管理 `mstar-iteration`（Phase 1–5）；战略性工作 `mstar-strategy`；`audit` 类请求 `mstar-audit`（执行归 `@code-reviewer`）；跑/解读 CLI 命令时 `mstar-use-cli`。**不**读 `mstar-coding-behavior` |
+| **实现/审查/运维** | 本 skill + `mstar-coding-behavior` + 角色 ref | 有 git 写：`mstar-branch-worktree`；有 plan 路径：`mstar-conventions`；**PM** 派 QC 前：`mstar-review-qc`；**`qc-specialist*`**：`mstar-roles` → `references/qc-specialist/`；`qa-engineer`：`references/qa-engineer/`；改 status/residual：`mstar-artifacts`；UI：`mstar-design-md`；知识库：`mstar-compound`（PM）；跑/解读 CLI 命令时（各 leaf 角色按任务）：`mstar-use-cli` |
 | **leaf 承接方** | 上栏 + **`mstar-dispatch-gates`**（反递归节） | — |
 
 Routing eval（宿主插件内回归用，**非**运行时必读）→ `.cursor/skills/mstar-routing-eval/`。
@@ -91,6 +91,7 @@ PM 在 Assignment 写 **`Task category`**（主类 + 可选 `secondary`）：
 | Skill | 职责 |
 |-------|------|
 | `mstar-harness-core` | 本文件：入口、状态机、Task category、explore、索引、护栏 |
+| `mstar-use-cli` | CLI 契约（agent 面向）：任务→命令族索引、前置条件阶梯、两条协议序列、退出码 0 / 1 / 2 与稳定拒绝码读法；flags 一律以命令自身 `--help` 为准 |
 | `mstar-phase-gates` | per-plan 双阶段门禁：Prepare/Execute、意图门禁、hotfix、可验证编辑 |
 | `mstar-iteration` | 迭代管理：Phase 1–5（start / Autonomous Execute / iteration-close / PR delivery / PR merge-ready loop） |
 | `mstar-dispatch-gates` | 派发、Delegation、反递归、依赖与隔离驱动并行、SDD 路径 plan QC 强制 tri |

package/harness-skills/mstar-host/references/cursor.md

@@ -100,7 +100,7 @@ Cursor’s live **Task** tool expects a **flat** JSON argument object. `prompt`
 | `prompt` | yes | Full Assignment Markdown string (IDENTITY, gates, Plan Path, Working branch, …) |
 | `subagent_type` | yes | Must equal Assignment `Execute as` (Morning Star role id when using custom agents) |
 | `description` | recommended | Short UI title only (3–5 words); never the Assignment body |
-| `model` | optional | Host slug from Assignment **Model tier** mapping |
+| `model` | optional | Host slug for the **session's own model policy** — host-owned and optional; mstar prescribes no tier. Omit to inherit the host default |
 | `run_in_background` | optional | Default false unless PM intentionally backgrounds |
 | `resume` | sticky continue only | Omit on fresh dispatch; see sticky section |
 
@@ -169,18 +169,6 @@ Implementation roles use `mstar-coding-behavior` for RCA, test-first checks, rev
 - Single-seat and tri-review need identical `plan_id` and review scope fields.
 - Task parallelism does not relax branch/worktree isolation.
 
-## Model tier (SDD + QC)
-
-Map Assignment **`Model tier`** to Task `model` (host-specific slugs):
-
-| Tier | Typical use |
-|------|-------------|
-| `fast` | Transcription tasks; 1–2 file mechanical edits |
-| `standard` | SDD prose implementer; task reviewer floor; plan QC tri seats |
-| `capable` | Large branch QC diff; integration judgment |
-
-**Turn count beats token price** — reviewers and prose implementers use `standard` floor minimum. See `mstar-sdd` SKILL.
-
 ## Project rules
 
 Project `AGENTS.md` / `CLAUDE.md` upward from cwd override global harness defaults when they conflict with Cursor-side rules; user instructions win.