{
 "entries": [
  {
   "affected": "routers/governance_packages.runtime() (pre-commit)",
   "class": "SecurityFailure",
   "exploit_pattern": "first package request on a fresh process hangs its worker thread forever (nested non-reentrant lock)",
   "found_by": "SDK end-to-end test hung; faulthandler stack",
   "historical_event": true,
   "id": "E9-F1",
   "regression": "tests/test_governance_packages_api.py::test_regression_first_request_on_a_fresh_process_does_not_deadlock",
   "remediation": "registry() resolved before acquiring _lock",
   "root_cause": "runtime() called registry() while holding _lock; registry() takes _lock"
  },
  {
   "affected": "design of anti-rollback (pre-commit)",
   "class": "SemanticFailure",
   "exploit_pattern": "suspend the newer package, then activate an older one = rollback around the guard",
   "found_by": "self-review",
   "historical_event": true,
   "id": "E9-F2",
   "regression": "tests/test_governance_package_runtime.py::test_anti_rollback_direct_and_via_suspend",
   "remediation": "track the newest publication EVER activated (max_activated_pub_seq); older ones can never be activated again",
   "root_cause": "guard compared only with the CURRENT active package"
  },
  {
   "affected": "scripts/govreg_verify_offline.py (pre-commit)",
   "class": "VerificationFailure",
   "exploit_pattern": "clean-room verifier and runtime could disagree on a dead package's label (EXPIRED vs SUPERSEDED)",
   "found_by": "self-review",
   "historical_event": true,
   "id": "E9-F3",
   "regression": "tests/test_governance_package_runtime.py::test_registry_export_verifies_offline_and_states_agree",
   "remediation": "verifier mirrors derive(): expiry applied to views, never stored",
   "root_cause": "verifier stored expiry per event; runtime applies expiry only to the legality view and the final read"
  },
  {
   "affected": "MONITORING mode semantics (pre-commit)",
   "class": "SemanticFailure",
   "exploit_pattern": "switching PROTECTED->MONITORING broke outstanding contracts; the alternative (keep returning a bound digest for a revoked package) would fabricate validity",
   "found_by": "test failure",
   "historical_event": true,
   "id": "E9-F4",
   "regression": "tests/test_governance_package_runtime.py::test_mode_change_invalidates_outstanding_contracts_both_ways",
   "remediation": "MONITORING never binds; any mode change invalidates outstanding contracts in both directions (documented, tested)",
   "root_cause": "monitoring returned the bound digest when OK and the plain digest when not"
  },
  {
   "affected": "package_status ordering (pre-commit)",
   "class": "SemanticFailure",
   "exploit_pattern": "explain() said DENIED instead of REVOKED for a revoked package's contract",
   "found_by": "smoke test",
   "historical_event": true,
   "id": "E9-F5",
   "regression": "tests/test_governance_package_runtime.py::test_revocation_denies_next_use",
   "remediation": "look up the contract's package first and report its state",
   "root_cause": "'no active package' checked before the contract's own package state"
  },
  {
   "affected": "z3 lemma P4 path transitivity",
   "class": "VerificationFailure",
   "exploit_pattern": "monolithic query returned UNKNOWN in one run and UNSAT in an identical one (solver fragility)",
   "found_by": "proof run",
   "historical_event": true,
   "id": "E9-F6",
   "regression": "tests/test_governance_package_runtime.py::test_operator_lemmas_are_proved",
   "remediation": "case split with explicit prefix witnesses; 17/17 UNSAT stable across 3 runs",
   "root_cause": "string-theory search"
  },
  {
   "affected": "routers/subdomains.py direct product routes (committed in bcbfc49, never deployed)",
   "class": "SecurityFailure",
   "exploit_pattern": "with openshell at PROTECTED, any tenant key could still exec via POST /fabric/openshell/execute-sandboxed (and write memory / register evidence via the MemVault and SCITT direct routes) with no package, no contract and no E8 commit",
   "exploited": false,
   "found_by": "session -78 (E12 forensic coverage map) -- independent review, not self-found",
   "historical_event": true,
   "id": "E9-F7",
   "regression": "tests/test_governance_packages_api.py::test_direct_product_routes_refuse_at_a_protected_boundary, ::test_unreadable_mode_store_fails_closed_on_direct_routes",
   "remediation": "_boundary_guard on execute-sandboxed, mint-token, inspect-write, search, register-statement: 403 BOUNDARY_PROTECTED at PROTECTED/HIGH_ASSURANCE; unreadable mode store fails closed",
   "root_cause": "boundary modes were consulted only on the contract path; the direct routes never read them"
  },
  {
   "affected": "ir_leq (E8)",
   "class": "SemanticFailure",
   "historical_event": true,
   "id": "E8-F1",
   "note": "kept fixed; regression test retained in tests/test_governance_compiler.py",
   "regression": "tests/test_governance_compiler.py::test_regression_optimized_narrowing_is_not_reported_as_widening"
  }
 ],
 "generated": "2026-10-04",
 "note": "Real findings while building E9 (all fixed before commit). historical_event=true means it happened in this repo's code, not in production.",
 "schema": "cain.counterexample.corpus.v1"
}