Not releasable as it stands. The GA core is close, but the pipeline that would prove it has been red for two weeks and five verified defects sit in shipped code.
The drop is not a regression in the code that the previous round scored. That round ran nothing. This one ran the build, lint, ABI check and the full test suite, and read the CI history. The suite is green. The lint gate is not, and it runs first, so no CI evidence exists for anything added since August 23.
| Category | 09-05 | 09-06 | Δ | Why it moved |
|---|---|---|---|---|
| Security and access control | 8.5 | 7.5 | −1.0 | Federation chain verified backwards with unsigned statements accepted; Verifiable Intent L3 tokens never checked for audience or nonce; round-13 findings 01 and 02 still open. Transport gating and signing enforcement credited. |
| Observability and diagnosability | 5.0 | 5.0 | 0 | 35 of 777 main-source files use a logger; 648 broad catches; 6 empty catches. Nothing changed. |
| Reliability and scale | 7.5 | 6.5 | −1.0 | This diff adds a FileWallet listing failure for relative paths, a filter that throws mid-iteration, cloud listings that abort on a concurrent delete, and an O(N) statistics path. Three sibling protocols still keep unbounded session maps. |
| Configuration and data | 7.5 | 7.0 | −0.5 | Stale ServiceLoader entries for optimism and zksync break anchor discovery; the new deployment policy is enforced by three factories and bypassed by the fourth. |
| Deployment and release | 5.5 | 6.0 | +0.5 | ABI validation, Kover, SBOM, mandatory signing and provenance attestation now exist and the ABI check passes locally. Capped: CI red since 08-23, 218 local lint violations, ABI dumps untracked, no release ever published. |
| Testing and documentation | 7.5 | 7.5 | 0 | Suite executed and green (3790 tests, 87 modules). 26 modules still have no tests; the federation verifier has no positive-path test; the checkout chain test was deleted rather than fixed. |
| Overall | 6.9 | 6.6 | −0.3 |
Each of these was re-verified in the source after the scanning agents reported it. Fix all six before tagging.
Every ci.yml run on main since 2026-08-23 fails at the lint step, before build or test. The working tree adds 218 more violations in 13 files. The ABI, coverage and SBOM steps added in this diff have never executed anywhere but this laptop.
The optimism and zksync service files still name org.trustweave.chain.* classes; the code lives under org.trustweave.anchor.*. ServiceLoader throws while iterating, so any classpath containing either jar loses discovery of every provider after the broken entry. Arbitrum and base were fixed in this diff; these two were missed.
verifyChain checks statement i+1 with statement i's keys, the reverse of OpenID Federation section 10.2, and never checks the leaf's signature at all. The parser also accepts alg=none. The only chain tests cover empty, expired and unparseable inputs, so a real chain has never been shown to pass. A real chain fails; an attacker's unsigned leaf listing the anchor key passes.
readRecord compares an absolute, normalised path against the raw Files.list entry. Path equality is textual, so any relative or dotted storagePath makes every list, query and statistics call throw after store succeeded. Tests only use @TempDir. Introduced by this diff.
Audience and nonce are checked for L2 only; verifyL3 has no expected values, while the Python reference checks expected_l3_payment_aud and nonce. Budget, recurrence and reference constraints are still appended to checked (TW-R13-01), and a negative amount under a max-only range still passes (TW-R13-02).
444 changed paths and the 105 ABI dumps are uncommitted and five commits are unpushed. With explicit-path staging the dumps are easy to leave behind, and checkKotlinAbi then fails on every module. No release, signed artifact or attestation has ever been produced for v0.7.0.
list(CredentialFilter(revoked = false)) raises IllegalStateException on the first credential that carries a status entry, and no factory accepts a WalletStatusResolver to make it answerable.
A concurrent delete or one corrupt object fails the whole cloud listing; statistics download every object; DatabaseWallet.getStatistics now materialises every row with no LIMIT.
Both public routes return e.message under INTERNAL_ERROR and catch CancellationException. Unchanged since round 13.
Algorand, Cardano and the Indy proxy still send tokens over http:// to any host. Hostnames with underscores are refused as unparseable. Bitcoin throws a raw IllegalArgumentException where EVM wraps it.
oidc4vp, SIOP and CHAPI keep plain maps with no expiry. The new oidc4vci store throws an unchecked exception at 1000 offers. The federation resolver bounds depth but not breadth or cycles.
35 of 777 main-source files log anything. 648 broad catches, 6 empty. No correlation-id or metrics guidance.
cheqd, ens, ion, plc, polygon, sol, venafi, salesforce, servicenow, chapi, anchor, status-list database, both registrar servers, wallet-services, starknet and nine example scenarios. The ABI gate now freezes APIs nothing exercises.
The claim-key extension is written but no verifier reads it; consent defaults to sharing nothing, so the airspace gate denies valid holders; the recovery export cannot be restored; reset fails in the environment that shows the recovery screen; passkey enrollment rejects synced authenticators after creating them. Weighted lightly because the README disclaims production custody.
docs-check.yml still uses mutable action tags while the other two workflows are SHA-pinned; the module-name gate was removed; the workflow now runs all 24 example mains on any Kotlin change.
TestkitWalletFactory ignores it; SUPPORTED_ONLY can construct no wallet because every catalogued plugin is experimental; PluginRegistry rejects the roughly 98 uncatalogued modules.
Ran assemble, ktlintCheck, checkKotlinAbi and the full test task locally with three workers, plus tsc and vitest for the reference wallet. Fourteen review agents scanned the diff from complementary angles; every blocker and the load-bearing needed items were re-verified by reading the source, and B5 was checked against the Python reference implementation. Round-13 findings were re-checked in the tree.
Nothing was deployed or load-tested and no fix was applied. Items marked plausible rest on agent evidence not independently reproduced. Reference-wallet defects are weighted as demo scope. SaaS is out of scope. Machine-readable scores and findings sit beside this file as scores.json and findings.json.