The security posture an operator is entitled to assume at a v1 tag.
Why one epic
#117 covered this and its premise is satisfied: [policy] exists and is enforced with ceilings, capabilities, an egress denylist, a cumulative total and per-component overrides.
What is left is not a policy surface, it is five unrelated leaves that each close a gap between what docs/production.md promises and what the code does.
Grouped because they share one exit condition: every security claim in the handbook is true at the tagged commit.
The gaps
A fail-open default: require_component_digest is false while the handbook instructs the operator to set it true.
An unbounded guest path: the logging seam passes a guest-supplied String straight to the router with no size cap and no rate limit.
No supply-chain gating at all: 631 resolved packages hosting untrusted guest code, with no cargo-deny, no cargo-audit, no SECURITY.md and no dependency bot.
Two contract statements that are currently neither true nor written down, on http egress and on what a green module test actually proves.
Two crates with the widest external audience skipping the workspace lint table.
Not here
Digest resolution from a name (#153) is post-v1: it inverts boot ordering and couples a venue-agnostic runtime to a chain and a resolver.
Fuzzing the attacker-facing parsers rides with the release work.
The security posture an operator is entitled to assume at a v1 tag.
Why one epic
#117 covered this and its premise is satisfied:
[policy]exists and is enforced with ceilings, capabilities, an egress denylist, a cumulative total and per-component overrides.What is left is not a policy surface, it is five unrelated leaves that each close a gap between what
docs/production.mdpromises and what the code does.Grouped because they share one exit condition: every security claim in the handbook is true at the tagged commit.
The gaps
A fail-open default:
require_component_digestisfalsewhile the handbook instructs the operator to set ittrue.An unbounded guest path: the logging seam passes a guest-supplied
Stringstraight to the router with no size cap and no rate limit.No supply-chain gating at all: 631 resolved packages hosting untrusted guest code, with no
cargo-deny, nocargo-audit, noSECURITY.mdand no dependency bot.Two contract statements that are currently neither true nor written down, on http egress and on what a green module test actually proves.
Two crates with the widest external audience skipping the workspace lint table.
Not here
Digest resolution from a name (#153) is post-v1: it inverts boot ordering and couples a venue-agnostic runtime to a chain and a resolver.
Fuzzing the attacker-facing parsers rides with the release work.