ENGINEERING REVIEW ? REMEDIATION
Implementation response to all 22 review findings. These are local workspace changes, not a deployment or a new production-readiness certification.
Open original scored review| Area | Result |
|---|---|
| SaaS backend | 507 tests, 0 failures/errors, 2 skipped. Full JaCoCo gate passed. |
| SaaS frontend | 292 tests across 62 files; lint and production build passed. Initial JS budget passed. |
| Reference wallet | 6 tests; TypeScript and Next production build passed. |
| SDK | 804 tests in 7 modules, 0 failures/errors, 3 skipped. All affected-module test and ktlint tasks passed. Starknet compiled successfully (no test sources). |
| Capability documentation | Generated catalog drift check passed. |
Gradle may reuse unchanged test results. This is an affected-module check, not the entire SDK test matrix. No live production, Linux-runner or browser interoperability certification is implied.
The original scores (TrustWeave 69/100; SaaS 58/100) remain historical. No replacement score is assigned without a fresh review.
Review finding: Holder proof does not bind the presenter to the credentials
The holder JWS signs the full presentation in its vp claim. Verified key identity, presentation holder and every credential subject must agree. Mutated presentations and another holder?s credentials are rejected.
Evidence / boundary: Real holder-signature adversarial tests in CredentialVerifierServiceTest.
Original evidenceReview finding: Requested credential types and claims are never enforced
Verified credentials must satisfy every requested type and claim. Supplied descriptor mappings are validated for definition, descriptor IDs, paths, formats and actual mapped data.
Evidence / boundary: Wrong-type and missing-claim regression tests; full server suite.
Original evidenceReview finding: Verification completion is a read–check–write race
A conditional database update permits exactly one transition out of PENDING. Competing or repeated submissions return conflict without replacing the result. Network verification occurs outside the completion transaction.
Evidence / boundary: Concurrent response and replay tests.
Original evidenceReview finding: Unanswered verification requests never become expired on reads
Reads persist overdue PENDING sessions as EXPIRED; completion also checks the deadline. The UI displays remaining time and supports restarting.
Evidence / boundary: Expired-session read regression test.
Original evidenceReview finding: Completed verification checks keep polling every two seconds
Polling decisions use current query data and stop for terminal results. Connection failures expose retry controls.
Evidence / boundary: Regression test observes that request count stays unchanged after completion.
Original evidenceReview finding: Public rate-limit identity trusts arbitrary forwarded headers
Seven public controllers use servlet remoteAddr rather than trusting arbitrary X-Forwarded-For values. Deployment instructions describe the trusted ingress boundary.
Evidence / boundary: Spoofed-header test. Production ingress configuration is deployment-specific.
Original evidenceReview finding: Rate-limiter keys accumulate without eviction
Synchronized fixed windows expire idle entries and cap live identities at 10,000. Capacity pressure refuses new identities instead of resetting existing budgets. Public presentations have an independent global budget.
Evidence / boundary: Clock-driven expiry and capacity tests. Limits remain per process.
Original evidenceReview finding: Backend tests default to a Windows Docker pipe on Linux CI
The Windows named-pipe fallback applies only on Windows. Linux leaves Docker discovery to Testcontainers unless DOCKER_HOST is explicitly configured.
Evidence / boundary: Source validation and full backend test/coverage run on Windows; Linux runner execution remains a release check.
Original evidenceReview finding: Nested modal Escape handlers can dismiss both dialogs
Only the top modal responds to keyboard dismissal; lower dialogs are inert, focus is restored, callback changes do not reset focus, and ReactNode headings label dialogs. Cancel is disabled during confirmation work.
Evidence / boundary: Nested Escape, focus restoration and input-state regression tests.
Original evidenceReview finding: Eager page imports produce a large initial JavaScript bundle
Route components load lazily under a loading boundary. Initial JS fell from 1,286.06 kB to 441.57 kB. Builds enforce a 500,000-byte initial-JS budget.
Evidence / boundary: Production build, lint, 292 frontend tests, and budget check (441,620 bytes including initial preload).
Original evidenceReview finding: CI tests against mutable library main rather than a recorded revision
CI reads .trustweave-revision and accepts only full commit-SHA overrides. Both source revisions are recorded in the job summary.
Evidence / boundary: The current pin records the reviewed SDK commit. Update it to the committed remediation revision before release; uncommitted code cannot have a usable published commit pin.
Original evidenceReview finding: Verifier drops unsupported embedded credential entries
The verifier rejects unsupported embedded representations instead of dropping them. Request metadata and the format matrix state the subject-bound JSON presentation profile.
Evidence / boundary: Verifier/session tests and explicit source validation. No generic JWT/SD-JWT presentation interoperability is claimed.
Original evidenceReview finding: A status-list reference is treated as proof of revocation
Storage distinguishes metadata presence from resolved revocation. File/database wallets accept a status resolver; unresolved status is UNKNOWN. Offline providers refuse revocation filters when status cannot be resolved. Statistics expose unknown counts.
Evidence / boundary: Updated core/testkit semantics tests and file status-resolver regression tests.
Original evidenceReview finding: Database wallet truncates before applying filters
Removed silent 1,000-record truncation. List/query paths use stable ID ordering and apply filters to the complete result.
Evidence / boundary: A 1,002-record regression proves a match beyond the former cutoff is returned. The List API still materializes results; cursor pagination is a future scalability improvement.
Original evidenceReview finding: File wallet overwrites are not atomic
Sibling temporary files are flushed and atomically moved into place. Read/replace locks coordinate wallet instances. Bounded access-denied retries handle transient Windows file handles; unsupported atomic moves fail without truncating existing data. Metadata is written before the credential.
Evidence / boundary: Concurrent read/write regression and file-wallet suite. Sidecar and credential files are not a cross-file transaction.
Original evidenceReview finding: Generated storage IDs are not embedded in anonymous credentials
CredentialRecordStorage exposes storageId separately from the signed VC. Anonymous file credentials use a content-derived stable handle; record enumeration preserves legacy sidecar handles.
Evidence / boundary: Anonymous credential reopen/deduplication regression. Signed credential contents are unchanged.
Original evidenceReview finding: OID4VCI session maps retain offers and bearer tokens indefinitely
OID4VCI exchange stores have fixed TTL, capacity, periodic cleanup and explicit cancel/purge/close. Successful issuance removes retained state and bearer secrets.
Evidence / boundary: Expiry boundary, capacity, read-lifetime and close tests plus the OID4VCI suite.
Original evidenceReview finding: Holder-side OID4VCI only accepts JSON-LD credentials
Holder receive capabilities declare ldp_vc. Incompatible advertised configurations are refused before token exchange; unsupported compact responses fail closed.
Evidence / boundary: OID4VCI suite and generated format matrix. This fixes capability ambiguity; compact receive support is not newly implemented.
Original evidenceReview finding: Reference wallet keeps exportable holder keys in localStorage
Signing and agreement keys are non-extractable CryptoKeys in IndexedDB. Existing raw seeds migrate without identity rotation and are removed from localStorage. The UI states custody and device-loss limitations.
Evidence / boundary: Key export rejection, real Ed25519 signatures and identity-preserving migration tests. Hardware custody, user verification and cross-device recovery remain outside this reference demo.
Original evidenceReview finding: Reference wallet schema mismatch silently erases identity and credentials
Supported legacy schemas migrate in place, writing version last. Unknown schemas preserve data and show export, retry and explicitly confirmed reset. Missing/corrupt keys do not cause automatic identity replacement.
Evidence / boundary: Migration and unknown-schema preservation tests; TypeScript and production build.
Original evidenceReview finding: Reference web wallet has no automated CI test gate
Added clean-install, typecheck, tests and production build to CI, with a tracked lockfile. Tests cover key custody, schema migration and a real issuer credential to signed holder-presentation round trip.
Evidence / boundary: 6 focused tests pass. They use Node WebCrypto and fake IndexedDB; a live-browser SaaS cross-profile interoperability test is not claimed.
Original evidenceReview finding: Plugin breadth needs a machine-readable capability contract
An assessed capability catalog records maturity, operations and formats; required plugin capabilities are checked before registration, and the Starknet stub is rejected on integration creation. Documentation is generated with a drift gate.
Evidence / boundary: Capability tests and generation --check. Catalog coverage is explicitly an assessed subset, not a claim that every plugin has been validated.
Original evidence