# Full audit runbook (deep audit mode)

Every test is recorded as: **environment · command · expected · observed · evidence artifact**. Use `HUMAN_REVIEW/FINDINGS_TEMPLATE.md`.
Each section says whether you can run it from this package alone or need access arranged with the owner.

## 0. Entry gate
Run `python3 -I CHALLENGE_42S.py cain42-auditor-kit-8.3.2.zip --trust-anchor <ANCHOR> --expect-sha256 <SHA> --online --out challenge.json`.
Do not proceed with a kit that does not reach `PASS_42S` (or `PASS_OVER_BUDGET` on slow hardware). The challenge proves the kit, not the platform.

## A. Cryptography and supply chain (package-only, except A7)
| # | Test | Command / method | Expected |
|---|---|---|---|
| A1 | Ed25519 correctness | Compare `VERIFIER/cain42_verify.py:ed25519_verify` with RFC 8032 §7.1 test 1, and with an independent library if you have one | Valid vectors accept; any single-bit change rejects; S ≥ L rejects |
| A2 | Signature binds the exact manifest bytes | Read `check_signature`; fixtures `replaced_release_manifest`, `ambiguous_canonicalization_*` | Any byte change to the manifest, or a duplicate key, fails |
| A3 | Manifest binds every file, both ways | Fixtures `missing_file`, `unlisted_extra_file`, `single_byte_modification`, `sha256sums_disagrees` | All give FAIL_INTEGRITY |
| A4 | Trust bootstrap | `KEYS_AND_TRUST.md`; fixtures `wrong_signing_key`, `no_trust_anchor_supplied`, `revoked_signing_key` | The package can never supply its own anchor |
| A5 | Archive parser robustness | Fixtures for traversal, absolute path, symlink, duplicate entries, oversized entry, compression bomb, two roots, truncated, not_a_zip. Optionally fuzz `zipfile` inputs | Rejected before decompression; never extracted |
| A6 | Replay and substitution | Fixtures `old_bundle_new_metadata`, `new_bundle_old_manifest`, `substituted_download`, `stale_evidence`; `--check-result` | Rejected or downgraded |
| A7 | Reproducible build and provenance | **Needs repository access.** Check out `source_commit`, run `python3 scripts/ironclad/prompt8/build_kit.py --version 8.3.2` twice; then sign or attach the published signature | Byte-identical ZIP; equals the published hash |
| A8 | Dependencies and SBOM | The kit's runtime dependency is CPython's standard library only. Record `python3 -VV` | No third-party code in the trust path |
| A9 | Key custody | Interview the key holder: storage, backups, who can sign, rotation and revocation plan | Today: one key, no HSM, no transparency log (a known gap) |

## B. AI-agent authorization and execution path (**needs source access and an authorized test tenant**)
Trace `AGENT PROPOSES -> CAIN DECIDES -> MCPGATE ENFORCES -> SYSTEM EXECUTES -> EVIDENCE REMEMBERS` in the real code path, not in helper functions. For each request class, record whether a consequential executor is ever reached:

| Request | Expected |
|---|---|
| No credentials | Refused before any executor |
| Expired capability token (default TTL 30 s) | Refused |
| Replayed single-use token | Second use refused |
| Token whose parameters were changed after issue | Refused (parameter binding) |
| Out-of-scope tool or resource | Refused |
| Malformed JSON-RPC / MCP | Refused, with no partial execution |
| Policy-denied action | DENY, and no executor call |
| Unknown principal or error path | Never becomes ALLOW (`UNKNOWN/ERROR never become ALLOW`) |
| Direct call to the downstream service, bypassing MCPGate | Must be impossible by network design. **Check the network topology yourself, not a unit test** |

Package-only partial check: `PLATFORM_AUDIT/site_probe.py` runs two unauthenticated negative probes. They show refusal at the public edge, **not** non-bypassability.

## C. Distributed systems and Byzantine faults (**needs repository access and a non-production cluster**)
With repository access: `auditor-kit/fault-campaign/run.sh OUT --jobs 4` re-runs the 2,800-trial campaign on a disposable local cluster and recomputes its summary. See `DISTRIBUTED_SYSTEMS/FAULT_MODEL.md` for the claimed model, the evidence for it, and what is missing. Minimum test set: equivocating leader; duplicate and replayed messages; stale view; partition and heal; message drop and delay; crash and restart with WAL replay; ≥ f+1 faulty nodes (must lose liveness, never safety); divergent-state detection. Record which faults were **simulated in-process** and which ran on **separate hosts**.

## D. Operations (**needs operator cooperation and staging**)
Deployment boundaries (all three domains are one server, 45.76.60.231); tenant isolation; secret handling; audit-log retention and immutability; a backup **restore** drill (not just the backup); incident-response contacts and SLAs (`/api/v1/audit/disclosure-policy`); rollback (blue/green gateway); monitoring and alerting; resource exhaustion, **on staging only**.

## E. The three public sites
`PLATFORM_AUDIT/CAINSTUDIO.md`, `MCPGATE.md` and `CLAWX.md`, then the cross-site rows of `site_probe.py`. Compare every public claim you find with `CLAIM_EVIDENCE_MATRIX.json`. A page that loads is not a verified feature.

## F. Report
FINDINGS_TEMPLATE → REPRODUCIBILITY_WORKSHEET → FINAL_VERDICT_TEMPLATE → LIMITATIONS_AND_RESIDUAL_RISK → INDEPENDENCE_DECLARATION. To have the review recognised by the verifier, sign it with `HUMAN_REVIEW/sign_review_record.py`.