# ODAD Independent Review Packet — Request for a Distinct Reviewer

**Status: PREPARED; REVIEW NOT PERFORMED.** This packet does not satisfy G5. The author of the implementation and internal self-review is not an independent reviewer.

## Review objective

Independently assess whether the ODAD fixture runner and evidence pipeline fail closed under adversarial inputs, whether the reported test evidence supports its claims, and what must change before any production use. Do not assume the system is production-ready.

## Scope

- `src/aicp/application/services/odad_bounded_executor.py`
- `src/aicp/application/services/odad_execution_ledger.py`
- `src/aicp/application/services/odad_task_plan.py`
- `src/aicp/application/services/odad_canonical_link.py`
- `src/aicp/application/services/opportunity_qualification.py`
- `tools/odad_e2e_qualification.py`
- `tools/odad_review_attestation.py` and `tests/unit/test_odad_review_attestation.py` (protected trust-store loading and signed-attestation verification)
- corresponding `tests/unit/test_odad_*.py` and `tests/unit/test_opportunity_*.py`
- `docs/quality/ODAD-INTERNAL-SECURITY-REVIEW.json`
- `docs/quality/ODAD-E2E-QUALIFICATION-REPORT.json`

## Reproduction commands

Run from the isolated worktree root:

```bash
python3 -m pytest -q
python3 -m compileall -q src tools tests
git diff --check
python3 tools/odad_e2e_qualification.py --help
```

The live E2E command requires explicit `--live` and performs a bounded public GitHub read. Do not run it if the review environment forbids network access. No production, publication, or paid-provider actions are in scope.

## Evidence freshness and exact scope

Immediately before reviewing, run `python3 tools/odad_review_attestation.py --manifest` and preserve its output with the review record. The manifest is the current exact SHA-256/byte-size scope; do not rely on an earlier report timestamp or an unstated branch revision. Confirm that the snapshot/script-identity regression and the current full-suite result are included. If any scoped file changes during review, regenerate the manifest and restart or explicitly re-scope the review. The latest local acceptance report is `docs/quality/ODAD-LOCAL-ACCEPTANCE-REPORT.json`; its PASS means local technical checks passed only, while delivery remains BLOCKED and unauthorized.

## Required adversarial questions

1. Can workspace path replacement, symlink/hardlink tricks, nested special files, or concurrent mutation alter the executed snapshot or escape its limits?
2. Can the child reach host secrets, host home directories, network egress, writable host paths, or unbounded CPU/memory/disk/process resources?
3. Does timeout/termination reliably reap the full process tree and clean temporary files?
4. Can ledger truncation, record tampering, duplicate idempotency keys, concurrent writers, malformed JSON, or sensitive payload fields produce false evidence?
5. Can dependency cycles, missing tasks, partial/unknown gates, stale evidence, or non-boolean authorization produce a false PASS?
6. Do tests prove the claims they are cited for? Identify missing negative tests and platform assumptions.
7. Are competitive and revenue claims properly marked as hypotheses rather than demand evidence?
8. Does the review-attestation verifier bind trust-store validation to the exact opened file, reject unsafe parent-directory permissions, enforce Ed25519-only reviewer keys, and fail closed when governance trust roots are absent?

## Findings format

For each finding record: stable ID; severity; affected file/line; reproducible evidence and exact command; exploitability/impact; required remediation; verification test; residual risk; disposition (`OPEN`, `MITIGATED`, `ACCEPTED_BY_AUTHORITY`, or `NOT_APPLICABLE`). Do not mark a finding fixed without rerunning its reproduction.

## Independence and acceptance

The reviewer must be a distinct person or independently controlled review process. Record reviewer identity/role, review date, exact source revision and patch digest, scope, tools, commands, findings, limitations, and final disposition. A second pass by the same author, a self-review, or a model attempt that returns no findings is not independent evidence.

## Latest evidence update (2026-10-12)

- Latest complete local acceptance after strict ledger JSON parsing and GitHub discovery identity/URL binding: PASS; 1,662 tests passed. Compileall, diff-check, CLI checks, ledger integrity, JSON artifacts, market-signal integrity, fail-closed delivery gate, and untracked text hygiene all PASS. This remains implementation-side evidence, not independent review.
- A reproduced ledger ambiguity was fixed: duplicate JSON object keys and non-standard constants are rejected, with regressions. GitHub discovery now rejects repository URL paths that do not match the `full_name` canonical identity, query/fragment variants, trailing/doubled slashes, percent-encoded path separators, malformed/non-default ports, and empty userinfo. The domain boundary independently enforces the same narrow contract. These are local fixes only; independent review remains open.

- Latest complete local acceptance: PASS; 1,641 tests passed, 47 focused executor/attestation tests passed, compileall and diff checks passed. This remains implementation-side evidence, not independent review.
- A real sandbox stdout-flood regression now verifies the kernel RLIMIT_FSIZE bound terminates a writer and the returned output stays within the configured cap. The executor uses separate stdout/stderr temporary files; the approximate combined backing-file ceiling remains 2 MiB at current 1 MiB per-file limits. Aggregate disk accounting is still open.
- The review-attestation loader was hardened to open the trust-store file with O_NOFOLLOW, validate the opened descriptor, and require a protected root-owned parent directory for the production trust-store path. Focused executor/attestation tests pass; complete offline acceptance rerun PASS (1,641 tests). This is implementation-side evidence only. The external trust store is still absent, so G5 remains BLOCKED. The verifier also explicitly rejects non-Ed25519 public keys; an RSA-key regression now checks this contract. Focused executor/attestation tests: 48 passed.
- Host observation (read-only): aicommander-agent.service is in /system.slice/aicommander-agent.service, Delegate=no, User=root; no cgroup or service settings were changed.

- Latest rerun after adding a simultaneous stdout/stderr flood regression: full local acceptance PASS (1,657 tests); the new adversarial test and focused executor/attestation suites pass. Both stream writers terminate under their inherited per-file RLIMIT_FSIZE, and returned text remains within the configured capture cap. This still does not establish a single aggregate disk quota; ODAD-SEC-008 remains OPEN for aggregate accounting and independent qualification.

- Review-attestation timestamp validation now rejects observation times more than five minutes in the future (allowing limited clock skew); a regression test covers a timestamp one hour ahead. This prevents a signed but implausibly future-dated review from passing timestamp validation. This is local hardening, not independent review.

## Known open issues before review

- The snapshot mitigation is newly added and has local regression coverage; concurrent mutation and platform behavior need independent scrutiny.
- Shared-host concurrency, process-tree cleanup, and denial-of-service controls are not production-qualified.
- The ledger uses POSIX advisory locking and is not distributed coordination.
- G4 is partial; G5 and G6 remain blocked. No production execution is authorized.

- Strict JSON parsing was added to the attestation verifier: duplicate object keys and non-standard constants such as NaN are rejected for both the trust registry and CLI attestation input. Regression tests cover duplicate attestation keys, duplicate trust-store schema keys, and NaN. This is implementation-side evidence; it does not establish independent review.

- Acceptance artifact validation, market-signal checks, and delivery-gate report loading now use strict JSON parsing as well: duplicate keys and non-standard constants are rejected consistently. Two regression tests cover duplicate keys and NaN. This closes a parser-semantics gap between acceptance and attestation paths; independent review remains outstanding.

- Governance-boundary regression: an otherwise valid reviewer signature cannot turn a finding dispositioned `ACCEPTED_BY_AUTHORITY` into G5 PASS without separately verifiable HAO authorization. The verifier returns BLOCKED, and a signed regression test covers the case. This preserves `ACCEPTED ≠ AUTHORIZED ≠ IMPLEMENTED`; it does not implement a HAO authorization artifact.

- Malformed-input regression: the attestation verifier now type-checks decision, severity, and disposition values before set membership, so JSON arrays/objects in enum fields return a controlled `FAIL` rather than raising `TypeError`. Parameterized tests cover malformed values.


- Canonical-link hardening: `ODADCanonicalLink` now verifies that each Task, WorkSession, and Artifact returned by repository lookup carries the exact requested identifier before accepting the lineage. Three regression cases cover mismatched returned identities and confirm no ledger append. Tracked as `ODAD-SEC-016`; locally mitigated, independent review remains open.

- Sandbox process-limit hardening: the Bubblewrap invocation now drops `CAP_SYS_ADMIN` and `CAP_SYS_RESOURCE` so `RLIMIT_NPROC=8` is not bypassed by capabilities that exempt process creation. The focused process-limit regression and full local acceptance pass as the intended unprivileged worktree owner. This is not evidence of aggregate cgroup/PID enforcement or independent production qualification.

- Zero-confidence evidence (`ODAD-SEC-018`): qualification and score checks previously accepted linked, fresh evidence even when its declared confidence was exactly zero. The local mitigation requires confidence > 0 for operational evidence gates and score evidence; six regression cases cover these paths. Confidence calibration/threshold policy and independent review remain open.
- Qualification evidence-kind matching (`ODAD-SEC-017`): arbitrary substring matching could treat `unlicensed_claim` as positive licensing evidence. Matching now tokenizes labels and rejects explicit negative/uncertain qualifiers before controlled prefix matching. Regression cases include `license_not_verified`, `revoked_license`, and `license_expired`; the licensing gate stays UNKNOWN and qualification DEFERRED. Free-form label ambiguity, the governed taxonomy, and independent review remain open. Independent review and a governed evidence-kind taxonomy remain open.

- Contradictory evidence (`ODAD-SEC-019`): a relevant positive linked record previously sufficed even if another current linked record for the same gate had an explicit negative/uncertain kind. Qualification now fails closed to UNKNOWN/DEFERRED when such a relevant contradictory record is present. Six licensing conflict regression cases added. The free-form kind taxonomy and independent review remain open.

- **ODAD-SEC-020 — VERIFIED reproduction, OPEN policy:** one compound `OpportunityEvidence` record from `github / owner/repo` with kind `license_risk_cost_demand_provider_scoring_evidence` was linked to all five operational gates and score evidence; the evaluator returned `INVESTIGATE`, all eight checks `PASS`, score `80.0`. Current contracts do not explicitly require distinct records or independent sources, so no source-independence restriction was added. HAO/governance must decide evidence granularity, source identity/independence and the controlled kind taxonomy. This is an investigation disposition only, not authorization or proof of legal/commercial validity. Independent review remains open.

- **ODAD-SEC-021 — VERIFIED reproduction, PARTIALLY MITIGATED LOCALLY, OPEN:** domain-level evidence previously accepted `source=github`, `kind=repository_metadata`, `source_record_id=owner/repo`, `url=https://github.com/other/repo`. The domain contract now binds this narrow GitHub repository-metadata kind to an HTTPS `github.com/{owner}/{repo}` URL, rejects mismatches/query/fragment/non-default ports, and requires an exact two-segment path (no trailing/doubled slashes or percent-encoded path separators). Direct-construction regressions cover these variants. At the parent Opportunity boundary, the same narrow GitHub `repository_metadata` kind must now also match the parent `source_record_id` case-insensitively; regressions cover mismatch, match, and exclusions for other sources/kinds. Other source/kind contracts, broader normalization/redirect/rename semantics, and independent review remain open. A 2026-10-14 read-only reproduction also accepted `pypi / sample-pkg / https://www.npmjs.com/package/attacker / package_metadata` and `npm / @acme/widget / https://pypi.org/project/other-package/ / package_metadata` via direct domain construction. Current adapters emit their own registry URLs; this is a domain-boundary contract gap, not evidence that adapters emitted these mismatches. Registry identity policy remains open; no implementation change was made.

- **ODAD-SEC-025 — VERIFIED reproduction, MITIGATED LOCALLY, INDEPENDENT REVIEW OPEN:** direct PyPI/npm connector failures were recorded as `source=unknown`, and transient timeout/socket exceptions were marked `retryable=false`. `PackageRegistryDiscovery` now exposes its registry as `source`, wraps HTTP/URL/timeout/OS I/O errors in `PackageRegistryDiscoveryError` with safe messages, status and explicit retryability, and the orchestrator recognizes this type. Regression coverage includes timeout, reset, URL error, HTTP 429/503 and non-retryable 404, plus source attribution. No automatic retry was added. Independent review must challenge 403 rate-limit classification and caller retry policy; this local mitigation is not G5 attestation.

## Scope extension — bounded GitHub source collector (2026-10-14)

The current verifier manifest is authoritative for exact scope and SHA-256 values. Added files: `tools/odad_github_snapshot_collector.py`, `tests/unit/test_odad_github_snapshot_collector.py`, `tools/odad_source_acquisition.py`, `tests/unit/test_odad_source_acquisition.py`, and the bilingual `ODAD-GITHUB-SOURCE-COLLECTOR-2026-10-14` docs.

Reviewer: challenge fixed-origin URL construction, redirects/final-URL checks, response status and content type, UTF-8/JSON parsing, bounded reads/timeouts, and response identity (`number`, `html_url`, `repository_url`, title, state). Inspect snapshot length/digest checks and symlink/race handling. Distinguish tamper detection from WORM storage. Verify captured data cannot become authenticated publisher claims, shortlist eligibility, execution authorization, or evidence of actual revenue. Assess information leakage and unbounded storage/logging. Treat issue text as untrusted input.

Implementation-side evidence: one bounded read-only GET for `warpspeedopen-source/warpspeed-bounties` issue `4`; saved response digest was rechecked. Its conditional bounty text does not prove funding, buyer intent, guaranteed payout, or received revenue. No candidate work, comments, PR, submission, contact, payment, commit, push, or deployment followed. Local acceptance reported 1,862 passed and 2 skipped; this is not independent review. Snapshot storage is not WORM and lacks external signature/trust root and replay protection. G4 is partial; G5/G6 are blocked; delivery remains unauthorized.

Immediately before review, run `python3 tools/odad_review_attestation.py --manifest` and preserve the complete output. Restart or re-scope if any scoped file changes. Prefer offline tests unless the review environment explicitly permits network access. Do not alter trust-root configuration as part of this review.

## Scope extension — commercial claim provenance and paid discovery (2026-10-14)

The canonical review scope was expanded from 72 to 83 files after identifying that the prior manifest omitted the claim-binding/source-snapshot contracts, commercial gate/economics/revenue-fit services, and the paid-issue discovery adapter and their regression tests. These files are now included in `REVIEW_SCOPE` and the regenerated manifest. A scope regression test requires these security-critical implementation and test paths to remain included. The current manifest is authoritative; regenerate it again after any scoped-file edit. This scope correction does not authenticate evidence, approve HAO policy, provision a trust root, or perform independent review. G5 remains BLOCKED.


## G4/G5 remediation evidence update (2026-10-15 — must be included in independent review)

The current `REVIEW_SCOPE` now additionally binds six artifacts: `ODAD-G4-SBOM-2026-10-15.cdx.json`, `ODAD-G4-PRODUCT-RUNTIME-SBOM-2026-10-15.cdx.json`, `ODAD-G4-SUPPLY-CHAIN-SCAN-2026-10-15.json`, `ODAD-G4-HOST-SECURITY-ASSESSMENT-2026-10-15.json`, and the EN/FA `ODAD-G4-G5-REMEDIATION-CHECKPOINT-2026-10-15` reports. A regression test asserts that all six remain in the signed subject. Run `python3 tools/odad_review_attestation.py --manifest` immediately before the review and verify every listed file hash/size; do not sign the prior 83-file subject.

Fresh verification: 31 attestation tests passed; complete suite 1,905 passed; `git diff --check` passed. The host-environment CycloneDX 1.6 SBOM covers 79 distributions visible to the system Python interpreter. A separate product-runtime SBOM records the single declared runtime dependency (observed PyYAML 6.0.1) and flags that it is not pinned and artifact provenance is unverified. OSV queried all 79 with no API errors and returned 116 advisory records across 17 packages; treat these as advisory records requiring triage, not as 116 confirmed unique AICP vulnerabilities. Project PyYAML 6.0.1 had zero matching records; test dependency pytest 7.4.4 had two. The scan is not a complete locked product dependency/build-provenance audit.

Host blocker is confirmed: `systemd-analyze security aicommander-agent.service` reports `9.6 UNSAFE`; service runs as root with broad capabilities and no finite CPU/memory cap. Ubuntu Pro is not attached; `pro security-status --format json` reports 0 standard security updates and 47 ESM Apps updates in `pending_attach` state, so those ESM updates are not currently enabled for installation. Exact Ubuntu package revisions were mapped for all 17 OSV-flagged Python distributions; the upstream-version OSV results must be reconciled with Ubuntu CVE/USN backports before classifying exploitability. No service changes/restarts or package upgrades were made because this is the active remote management path and a rollback/alternate control path has not been independently qualified. G4 remains BLOCKED/PARTIAL. The protected external trust store `/etc/aicp/odad-trusted-reviewers.json` remains absent; G5 remains BLOCKED. Reviewer must independently challenge host remediation, triage OSV records against Ubuntu fixed revisions, and sign the exact newly generated subject using an out-of-band provisioned Ed25519 trust root. No simulated or self-review may be accepted.