Round 4 post-remediation review of both local working trees, with full SDK JVM and SaaS backend validation plus targeted browser and storage regressions. This is not an exhaustive proof of correctness or certification.
Scores are engineering judgments against the same 30/25/20/15/10 rubric. They are not percentages of bug-free code or a security certification. Historical scores are preserved.
Category
Maximum
TrustWeave
SaaS
Security
30
29
29
Correctness
25
24
24
Architecture
20
19
19
Testing
15
15
14
Experience
10
9
9
Remaining deductions
trustweave
Security -1: browser custody lacks hardware/user-presence signing and remains exposed to trusted-bundle compromise.
Correctness -1: issuer/disclosure profiles and hosted provider behavior remain limited or unvalidated.
Architecture -1: provider maturity and legacy storage boundaries remain uneven.
Experience -1: holder-key loss requires reissuance; physical mobile camera coverage remains outstanding.
Testing receives full local-validation credit for the full JVM suite, lint, database/HTTP contracts and production browser regressions. This does not certify optional hosted providers; those limitations remain in correctness/architecture.
trustweave-saas
Security -1: exact published SDK/SaaS pair and staging admission failure boundaries remain unvalidated.
Correctness -1: live Accountly/PSP and supported legacy invoice behavior remain incomplete.
Architecture -1: release coupling and hosted recovery/alert integration remain outstanding.
Testing -1: two live-contract skips and no exact-pair remote Linux/staging evidence.
Experience -1: operator-heavy recovery and limited credential-format support.
Validation evidence
Area
Result
Scope and limits
SDK JVM suite
3,697 tests: 3,682 passed, 15 skipped; no failures/errors
Full gradlew test --continue, 79 modules with tests; optional/template skips listed separately.
Multiplatform JVM
32 tests passed (cached)
DID identifiers, wallet core and credential models; common-mp has no JVM test sources. JS/native targets not run.
SDK lint
Repository-wide ktlintCheck passed
Fixed import/format violations in three integration stubs and cloud storage. Final import-only changes followed the full test run.
Full server:test and JaCoCo verification; includes four shared-admission, two monitor and three signed-recovery/access tests. Accountly live-contract tests skipped.
Reference wallet
28 unit tests and 9 Chromium tests passed; production build passed
Final camera cleanup code, nonce policy, disclosure/import/custody/recovery paths. Fake camera; no physical mobile browser claim.
Database/storage
10,000 PostgreSQL records / 200 pages / 2,129 ms; MinIO and Azure contracts passed
Local PostgreSQL; real S3-compatible HTTP with two-object pages; Azure client against an HTTP fixture. No hosted IAM/KMS/durability claim.
SDK source gate
Fingerprint check and its regression test passed
SHA256 7a436c8e1fff33cbbd7a4b4117e8b4f9e46ed446fe727f308a6655f7bc839f72. Old published revision pin unchanged; local matching source is not a completed release.
SaaS frontend
Round 3 evidence retained: 292 tests and lint passed
No round 4 frontend edits or rerun. No new dependency audit or remote staging claim.
Results distinguish local database/HTTP fixtures from hosted-service validation. Optional tests that did not run remain reported as skips. Timing excludes fixture setup.
Dedicated PostgreSQL reservation transactions coordinate per-session, per-trust-space and global worker limits across application instances. HTTP timeout does not release a non-cooperative worker's reservation; connection loss prevents accepting its verdict.
Evidence: Four PostgreSQL admission tests passed in the full 526-test backend run, including the final transaction-scoped implementation. Two independent components exercise shared capacity, duplicate sessions, cleanup and timeout retention.
Limit: Database connection/transaction failure may release reservations while an external provider continues. Staging must verify connection budgets, proxy timeouts and ingress limits.
Added aggregate backlog, oldest-failure, sample-age and polling-error metrics. Metric endpoints require a platform admin role. Payloads are not loaded by the monitor or used as labels.
Evidence: Metric behavior tests and real HTTP authorization regression; signed HTTP/PostgreSQL recovery exercise proves rollback, retry, ledger cleanup and duplicate suppression.
Limit: Hosted alert delivery and actual provider redelivery are not exercised. The test injects the subscription-service failure; it does not make live Stripe calls.
Added per-request CSP script nonces, dynamic HTML rendering and private/no-store responses. Production rejects unauthorized inline script and unsafe-eval; framing protections remain.
Evidence: 28 wallet unit tests, final production build and nine Chromium tests pass, including parser-injected script rejection while legitimate hydration and camera use succeed.
Limit: Trusted bundle compromise and browser key loss remain outside this protection. Dynamic rendering replaces static HTML generation.
Reject missing/repeated continuation tokens; honor cancellation before fetching another page. AWS, Azure and Google adapters rethrow cancellation instead of wrapping it as an ordinary storage error.
Evidence: Malformed-token regression and cancellation regressions for all AWS/Google storage operations plus between-page cancellation.
Limit: Cancellation cannot forcibly interrupt a third-party SDK call that does not cooperate; configure provider-side request deadlines.
Replace hierarchical listing with a flat prefix-filtered listing so virtual directories do not hide credentials whose signed identifiers contain slash characters.
Evidence: An HTTP fixture exercises the actual Azure client request/response path, asserting the wallet prefix, no delimiter, and discovery of a URL-shaped credential ID.
Limit: The fixture validates protocol construction and decoding, not hosted Azure authorization or durability.
Added a pinned MinIO contract using the real AWS SDK over HTTP. It covers anonymous credential handles, multi-page listing, isolated wallet prefixes, corrupt data recovery and deletion.
Evidence: The S3 contract passed. Two-object pages exercise continuation handling; a final empty page is allowed. This is separate from the existing large-list unit test.
Limit: MinIO is not live AWS. IAM, KMS, account policy, region behavior and production scale remain unvalidated.
Added a larger real-database regression proving complete traversal, bounded page size, no duplicate IDs, rare-type filtering and wallet isolation.
Evidence: 10,000 records returned in 200 pages of 50; measured paging/filter/isolation phase took 2,129 ms, excluding fixture setup. Both database paging tests passed in the full SDK run.
Limit: This is a local measurement, not a production latency or memory SLA.
Camera cleanup survives stop and delayed permission
Handle synchronous scanner stop exceptions, release a stream acquired after cancellation, and suppress callbacks from cancelled scans. This prevents a double-stop page crash and late camera stream retention.
Evidence: Production Chromium regression uses a fake camera, confirms active video, stops normally, then delays a second permission result and confirms all returned media tracks end after cancellation.
Limit: Fake-device Chromium coverage does not replace physical mobile camera/browser testing.
The SDK remains uncommitted locally and the SaaS pin still points to the old SDK revision. Branch/staging details were requested while local work continued.
Evidence: No publication or staging execution is claimed.
Limit: A matching local fingerprint cannot substitute for a reviewed, published and tested immutable pair.
Most plugin capabilities remain unassessed. The reference wallet has no hardware/user-presence signing or recoverable holder-key service; supported issuer and disclosure profiles remain limited.
Evidence: Full local JVM suite passed with 15 optional/template tests skipped; live provider environments and hardware-backed custody remain unvalidated.
Limit: A complete product/profile definition and supported provider matrix are needed before these deductions can be closed.
docs/round-4-operations.md covers database connection budgets, failure boundaries, admin-only metrics, alert thresholds, Flyway V24, nonce-bearing HTML caching and validation scope. Staging environment and release-branch details were requested during this pass and remain prerequisites for external release checks.