Round 6 targeted review of credential restoration and the platform recovery inventory. The same weighted rubric is retained. Half-point UX credit in each repository reflects partial closure of the recovery deduction; it is a judgment, not measured precision or a guarantee. Key-loss recovery, live billing/provider operations and exact-pair release/staging remain open.
Scores are engineering judgments against the same 30/25/20/15/10 rubric. They are not percentages of bug-free code or a security certification. Historical scores are preserved.
Category
Maximum
TrustWeave
SaaS
Security
30
29
29
Correctness
25
24
24
Architecture
20
19
19
Testing
15
15
14
Experience
10
9.5
9.5
Remaining deductions
trustweave
Security -1: browser custody lacks hardware/user-presence signing and remains exposed to trusted-bundle compromise.
Correctness -1: issuer/disclosure profiles and hosted provider behavior remain limited or unvalidated.
Architecture -1: provider maturity and legacy storage boundaries remain uneven.
Experience -0.5: same-identity credential export/restore is now verified; lost device keys still require issuer-assisted reissuance, and physical mobile coverage remains outstanding.
Testing receives full local-validation credit for the full JVM suite, lint, database/HTTP contracts and production browser regressions. This does not certify optional hosted providers; those limitations remain in correctness/architecture.
trustweave-saas
Security -1: SDK pin is repaired locally, but publication, exact-pair remote Linux CI and staging failure-boundary evidence remain outstanding.
Correctness -1: live Accountly/PSP and supported legacy invoice behavior remain incomplete.
Architecture -1: release coupling and hosted recovery/alert integration remain outstanding.
Testing -1: two live-contract skips and no exact-pair remote Linux/staging evidence.
Experience -0.5: admins can inspect and page through recovery events without database/payload access; live provider redelivery still requires manual operations, and supported credential formats remain limited.
Validation evidence
Area
Result
Scope and limits
Reference wallet unit tests
33 passed
Includes five new restoration regressions. Final production build and TypeScript validation passed.
Production Chromium
10 passed
Includes new backup upload/export regression, plus prior camera, CSP, disclosure and custody checks. No physical-device/hardware claim.
SaaS backend
15 passed; zero failures/errors/skips
Five migrations, five recovery/access, three Stripe controller and two monitor tests. Targeted run excludes the full-server coverage threshold; last broad coverage result remains Round 4.
SaaS frontend
294 passed across 63 files; lint and production build passed
Two new recovery-panel regressions, existing route/API contract checks and full frontend suite. Initial JS 454,703 bytes against a 500,000-byte budget.
SDK Kotlin and providers
Runtime unchanged in this round; historical evidence retained
Round 4 full JVM/lint/storage results are not represented as a new full-suite run. No hosted provider validation performed.
Release/custody boundaries
Still open
No publication, staging deployment, hosted alert delivery or hardware-backed signing. Production custody direction was requested during this pass.
Results distinguish local database/HTTP fixtures from hosted-service validation. Optional tests that did not run remain reported as skips. Timing excludes fixture setup.
Added a home-page export/restore flow for the same holder identity and existing device key. Restore checks every issuer signature and holder binding, rebuilds labels/disclosure choices from verified content, bounds input, and commits one merged collection only after all records validate. Existing credentials win duplicates.
Evidence: 33 wallet unit tests and 10 production Chromium tests passed, including wrong-wallet and forged-signature rejection, no partial writes, ignored forged labels, input limits, production upload, duplicate suppression and key-free export.
Limit: Version 2 credential backups only, at most 5 MB/500 records. Exports contain sensitive credential details. Signing keys remain non-extractable; this does not recover a lost key or transfer holder-bound credentials to another identity.
Platform-admin recovery inventory without payload exposure
Added a bounded, oldest-first recovery API and Team Administration tab. Database projection selects only event ID, failure reason and first/latest failure times. Admin access is enforced by both request authorization and method security. The UI provides pagination, refresh and explicit failure/retry states.
Evidence: 15 targeted backend tests passed, including anonymous/user denial, admin reads, ordering, pagination bounds and payload exclusion. All 294 frontend tests passed, including recovery navigation and retry. Lint, TypeScript, production build and the initial bundle budget passed.
Limit: This is a platform-wide admin inventory. Redelivery stays with Stripe; no unsigned replay or payload-view endpoint exists. Hosted alert delivery and Accountly/legacy billing cutover remain unvalidated.
Most plugin capabilities remain unassessed. The reference wallet has no hardware/user-presence signing or recoverable holder-key service; supported issuer and disclosure profiles remain limited.
Evidence: Full local JVM suite passed with 15 optional/template tests skipped; live provider environments and hardware-backed custody remain unvalidated.
Limit: A complete product/profile definition and supported provider matrix are needed before these deductions can be closed.
docs/round-6-operations.md covers backup limits, key-loss boundaries, admin authorization, pagination and provider redelivery. Staging environment and release-branch details were requested during this pass and remain prerequisites for external release checks.