Security review & test-suite report.

What it is: a self-directed adversarial code review across the subsystems below, plus the actual, re-run counts from each subsystem's automated HOST test suite (the tests that run on a developer machine or CI — no phone, no hardware attestor, no box required). Where a bug was found, it was fixed and a regression test was added so it cannot silently return.

What it is not: a third-party security audit; a penetration test by an outside firm; a formal verification; a certification of any kind; a claim that the software is "secure," "hardened," or "production-ready." None of those words apply here. UNAUDITED is the correct word, and it is the one this page uses.

The review ran as a wave of specialized adversarial passes over the currently-integrated feature branches (see Methodology) — not one branch that contains every fix merged together yet; that consolidation is itself a listed open item. Each number in the table below states which branch it was measured on.

Every number below was produced by actually re-running the suite (cargo test / node --test / the project's own runner script) in this session, not carried over from an old log. Counts are what the suite itself reports as passed. One suite — the reproducible-build two-builder check — has a single test that only passes on a host with Nix installed; this host has none, so it fails honestly rather than being skipped or faked. That is disclosed, not hidden.

The review ran as roughly twenty parallel, specialized adversarial passes over the integrated feature branches, each with a narrow mandate:

• A crypto-usage sweep — every call site touching Ed25519, XChaCha20-Poly1305, ML-KEM, Argon2id, and the SNP/TPM attestation chain, checked for nonce reuse, missing authentication, wrong key sizes, and non-constant-time comparisons on secret material.
• A fail-closed / test-integrity sweep (mutation testing) — deliberately break the code under test (flip a comparison, remove a check, widen a permission) and confirm the corresponding test goes red. A test suite that stays green when the code is broken is worse than no test suite: it is a false assurance. This is how several of the "found & fixed" bugs below were actually located — a mutation that should have been caught wasn't, which is what sent a reviewer into that code path in the first place.
• A repo-wide honesty sweep — the same trust-label discipline this site enforces mechanically (scripts/check-trust-labels.sh): hunting for attestation-grade or audited/secure/hardened language bleeding onto a surface that hasn't earned it.
• Per-subsystem adversarial red-teams — one pass per subsystem (Depot, Terem, NoporIS/Porog, gramota-kyc, sloboda-gate, comms) attempting the specific attacks that subsystem's threat model implies: record replay, consent forgery, path-traversal evasion, cross-repo CRL confusion, and so on.

Every fix below shipped with a proof-of-concept demonstrating the bug, a patch, and a new regression test — the mutation-testing discipline applied to the fix itself: the new test must fail against the old code and pass against the new one.

The crypto-usage sweep did not surface a break in any core primitive. Specifically, across the crates above:

• Real, standard primitives — Ed25519 signatures, XChaCha20-Poly1305 AEAD, Argon2id at the RFC 9106 tier, ML-KEM-1024 (FIPS-203) for Courier's sealed drop — not custom or home-rolled cryptography.
• CSPRNG nonces — nonce generation for the AEAD constructions goes through the OS CSPRNG, not a counter or a weak PRNG; no nonce-reuse pattern was found.
• Constant-time comparison on secret material — the checks that matter (signature verification inputs, key material) use constant-time equality, not a branching byte-compare.
• Fail-closed defaults — the review's mutation-testing pass specifically hunts for fail-open defaults (a missing check that defaults to "allow"); the gate, consent, and audit code paths reviewed default to refusal, not permission, on an unrecognized or malformed input.

"Sound" describes what the review did not break, on the branches it reviewed, at this point in time — it is not a certification, and it does not extend to code the review did not cover. See known open items below for what has not yet been exercised at all.

This is the part a marketing page would omit. We include it because a review that found nothing worth naming isn't credible, and a review that names its findings — with the PoC, the fix, and the regression test — is the honest version of "we looked."