[aien-spark]

Findings

• SECNET-03: Repository A read grants could dereference repository B changesets in a shared store. Repository-qualified store lookup now gates get, provenance, tree (including recursive parents), history ancestry, explicit conflict IDs, advisory lineage, and evidence-base reads. Foreign IDs are indistinguishable from unknown IDs.
• SECNET-04: Repeated untrusted Submit refusals grew the shared audit vector. The enforcer now backpressures before auth checks consume nonce/rate state; the audit has a 4,096-entry cap and bounded string fields with explicit digest commitments for oversize values. Wire Submit checks audit capacity before envelope decode and closes after 64 refusals or audit exhaustion. Nothing is silently evicted.

Local regression evidence

• Before fix (81ce993): mixed-repository API regression returned B StoredChangeset under A credentials; audit cap test retained 4,097 refusal entries; wire repeated-refusal test kept the session open after 65 untrusted submissions.
• After fix (0d1d83e): nice -n 19 cargo test --locked -j2 -p synapse-api repository_grant_cannot_read_foreign_changesets_in_mixed_store PASS (1); nice -n 19 cargo test --locked -j2 -p synapse-auth audit PASS (4); nice -n 19 cargo test --locked -j2 -p synapse-wire audit PASS (2); nice -n 19 cargo test --locked -j2 -p synapse-auth chained_authorization_backpressures_before_evaluating_request PASS (1). Existing own-repository get/provenance, virtual-tree Git parity, valid wire have-want/accepted durable submission, and audit chain verification serve as positive controls. Unknown changeset yields the same not-found as a foreign ID. Full audit rejects before nonce/rate mutation and before Submit envelope decode.

Limitations

Audit is hash-chained and in-memory, not automatically persisted or signed. On full audit it refuses all further authorization until the operator durably preserves and inspects the complete log and starts a fresh enforcer. Reconnecting peers cannot grow audit without bound but can cause fail-closed availability refusal; no deployed listener or durable audit sink was qualified. No merge or deployment is requested.

SecCiReceipts S3: pinned verifier build isolation

Both PR checks and Alpha jobs move the pinned verifier source outside the candidate tree before Cargo runs, build from that external working directory, and explicitly select $RUNNER_TEMP/aien-test-target. The installed executable comes only from that path. The cache retains registry/git dependencies only, not compiled targets, and uses the new aien-test-isolated-v1 namespace so old candidate-configured build caches cannot restore verifier output. Candidate portable gates, trust anchors, verifier pin and Alpha full-bundle requirements are unchanged.

Offline regression proof

Local shell replay with Cargo 1.98.1 and rustc 1.98.1 used a dependency-free aien-test fixture, CARGO_NET_OFFLINE=true, CARGO_BUILD_JOBS=2, and nice -n 19. It replayed the exact workflow move/build shell in each of the checks and alpha jobs.

Case (both jobs)	Observed
Before: candidate .cargo/config.toml sets a marker-writing, exit-87 build.rustc-wrapper and redirects build.target-dir	Cargo exit 101; candidate wrapper marker created; no installed verifier
After: same candidate configuration	Exit 0; no wrapper marker; installed fixture prints TRUSTED-FIXTURE; executable built under the explicit runner-temp target; candidate poison target absent
Negative control: same wrapper configuration placed inside the trusted source	Cargo exit 101; wrapper marker created; no installed verifier

Final oracle line: S3 OFFLINE WORKFLOW PROBE PASS: every before/after/negative assertion passed. These are local fixture observations, not a full pinned aien-test build, a GitHub Actions run, or Alpha/hardware qualification. The local scratch files are not a published durable receipt. No GPU, live endpoint, merge or deployment was used.

S3 source baseline: `81ce993d9045353ed61a5e096b46447f4ddac08c

Wall time: 1.33 seconds. S3 workflow commit: fa0faee`.

Pending guide update: aien-dev/omega-harness#19 documents the out-of-tree Cargo CWD, explicit target, dependency-only cache and wrapper negative-control rule.

[aien-spark]

Premerge focused host verification exposed advisory_snapshot_parity failure: the scoped lookup had changed own-repository snapshot errors and broke the retained 3d78efe transcript digest. Fixed by checking repository identity first, then retaining the established own-repository visibility diagnostic. The complete synapse-api/auth/wire/git focused suites now pass, including the original unchanged frozen transcript. Read-only review also identified GitHub PR projection lookup was unscoped; it now uses get_changeset_in_repo with a foreign-store rejection control and valid projection positive control. crumb verify passed. Alert #47 alone (deterministic nonce in a test-only helper at f1_capability_chains.rs:241) was dismissed as used in tests with explicit Drake/Main authorization and consultant evidence; no other alerts or gates changed. Local logs: /tmp/secship-b/logs/synapse-tests-fixed.log and synapse-projection.log (local observations, not published immutable receipts). No GPU, model, deployment, or historical evidence mutation.