TW-FU-01 · CLOSED
Row lock precedes bitmap read; H2 mixed single/batch tests and 32-writer PostgreSQL test passed.
REMEDIATION · 6 SEPTEMBER 2026
TrustWeave: recurrence and recovery evidence
8.7 / 10
Up from 8.4 on the unchanged six-category rubric. The target above 9.0 remains unmet.
Intent scope implemented
Agent recurrence enforces inclusive UTC dates, occurrence ceilings and cumulative budget in the ledger-backed path. Base mandates are single-use without agent recurrence. Merchant subscription setup requires bounded terms matching authenticated checkout metadata. Budget minimum is now correctly enforced per payment.
Privileged reconciliation records SETTLED or confirmed non-execution (RELEASED) with a durable evidence reference. Duplicate evidence is idempotent; contradictory terminal outcomes are rejected. Release never removes challenge, transaction or occurrence consumption. Unknown payment outcomes stay reserved.
Agent frequency is scheduling guidance in the draft, not a strict interval or an automatic billing job. Unsupported shapes remain fail-closed. The module conformance profile describes the supported subset; no complete conformance certification is claimed.
Cross-stack and custody follow-up
Score retained: 8.7 / 10. The pinned official Python reference passes 326 upstream tests. Three focused Kotlin tests and module lint pass: six Python-issued immediate cases agree in Kotlin, and eight Kotlin-issued immediate/autonomous payment checks agree in Python, including L2 and L3 audience/nonce rejection. This is expanded interoperability evidence, not full conformance.
The full module rerun was interrupted after Docker Desktop returned HTTP 500; its database tests are not newly qualified. The previous 50-test and restore results below are historical evidence. The new CI steps have not run on a hosted runner.
Live custody remains unqualified: a non-production resource/profile and disposable recovery key are still required. The current wallet also lacks the production managed signing and recovery service. The qualification matrix separates real signing, tenant authorization, temporary access recovery, replacement-key recovery and durable replay protection.
Custody acceptance matrix · Cross-stack reproduction and remaining gates · Execution evidence
Operations exercise
| Workload | 100 HTTP fixture requests, concurrency 8 |
|---|---|
| Budget result | 50 accepted, 50 rejected |
| Load elapsed / handler p95 | 6.739 s / 1.029 s |
| Database failure | Primary container stopped; host returned 503 and storage failure signal fired |
| Backup/restore | pg_dump custom archive restored by pg_restore into a separate PostgreSQL instance |
| Restore exercise duration | 6.391 s, including recovery startup, restore, validation and host switch |
| Integrity | Complete account/reservation row digest matches; all 50 restored transactions reject replay |
| Alerts | Storage failure, backlog and latency: nine promtool evaluations passed, including firing and recovery |
This is a loopback component host with pre-authorized fixtures and an unpooled DataSource. Handler latency excludes client connection and server queue time. The quiesced workload lost zero records. These measurements are not production throughput, RTO or RPO guarantees. Stale-backup/PITR, real payment-journal authentication and external pager delivery were not exercised. Raw host measurements.
Previous recurrence/operations validation
- 50 intent tests passed, zero failures/errors/skips, including signed recurrence flows, malformed bounds, concurrent occurrence caps, settlement rollback and legacy schema migration.
- Module lint and additive ABI checks passed. Final Gradle run: 2m 4s, 850 tasks (16 executed).
- Aggregate coverage: 56.93% lines / 39.29% branches. Existing coverage policy passed without weakening.
- Documentation: 357 Markdown files, 2,390 Kotlin blocks, zero checker errors. Workflow and alert YAML parsed.
- Prometheus 3.5.0 rule tests passed with a digest-pinned image. Workflows now execute the rules and retain host exercise output; hosted execution has not yet occurred.
Current commands, source hashes and evidence. Earlier full-repository baseline and budget follow-up are historical evidence. No fresh full-repository build or production qualification is claimed. Changes remain uncommitted; SaaS and production custody were not changed.
Reassessment
| Category | / 10 | Evidence and remaining limit |
|---|---|---|
| Security and access control | 9.0 | Authenticated merchant recurrence terms, single-use base mandates and atomic agent occurrence caps join existing signature/cart/replay checks. Live custody remains unqualified. |
| Observability and diagnosability | 8.0 | Reference HTTP host emits bounded metrics; storage failure and backlog signals fire. Prometheus storage, backlog and latency rule firing/recovery tests pass. Production instrumentation and pager delivery remain open. |
| Reliability and scale | 9.0 | Budget and occurrence races, reconciliation rollback, replay and uncertain commit pass. Real backup/restore preserves the complete ledger snapshot; broad production load and PITR are not qualified. |
| Configuration and data | 9.0 | Idempotent terminal reconciliation, preserved replay/count state, legacy schema migration and unknown legacy ages are tested. External journal authentication and stale-backup recovery remain host responsibilities. |
| Deployment and release | 8.5 | Local tests, lint, ABI and alert gates pass and are wired into workflows. Changes remain uncommitted; hosted validation and a release for this tree are still outstanding. |
| Testing and documentation | 8.5 | 50 intent tests, expanded conformance profile, real PostgreSQL restore and nine Prometheus evaluations pass. Full cross-stack conformance and wider SDK branch coverage remain incomplete. |
Sum 52 / 6 = 8.6667, rounded half-up to 8.7. The rubric is unchanged. Historical arithmetic correction is retained in the score JSON; scores are engineering judgment, not certification.
Finding status
TW-FU-02 · CLOSED
Declared sizes, positive growth and overflow checks; atomic bitmap/metadata updates. PostgreSQL trigger-injected failure verified complete rollback.
TW-FU-03 · CLOSED
Batch index and purpose validation precede writes; rollback and invalid-index tests passed.
TW-FU-04 · CLOSED
Digest envelope verification binds expected credential bytes and media type. Positive digest round trip and tampering regression passed.
TW-FU-05 · CLOSED
Shared anchor handlers rethrow cancellation; real/test-mode read/write regressions passed.
TW-FU-06 · CLOSED
Streaming 1 MiB response cap, explicit operation deadline, redacted failures and REQNACK rejection; transport tests passed.
TW-FU-07 · CLOSED
JSON header serialization preserves quotes, backslashes and Unicode; shared Android JVM test passed and CI now runs it.
TW-FU-08 · OPEN
No production custody support promotion. Managed signing/KMS test endpoint/resource/profile requested; Accountly billing evidence is not custody evidence; physical-device and durable recovery qualification remain.
TW-FU-09 · PARTIAL
Implemented supported agent recurrence dates/counts and merchant subscription setup using authenticated signed metadata. Added per-payment budget minimum, single-use base mandates and durable idempotent reconciliation. Conformance matrix and positive/adversarial tests expanded. Full interoperability, mixed/duplicate recurrence modes and broader merchant profiles remain outside scope.
TW-FU-10 · PARTIAL
50 intent tests pass with unchanged coverage floors; migration, occurrence races, reconciliation failure, reference-host load and full-row restore are covered. Broader SDK and cross-stack conformance assurance remains incomplete.
TW-FU-11 · PARTIAL
Instrumented loopback host load, actual database loss, all-row pg_dump/pg_restore comparison and replay of all 50 restored transactions pass. Nine Prometheus alert evaluations cover firing and recovery; CI/release gates retain evidence. Production deployment SLO/PITR/journal/pager exercises and current hosted release evidence remain open.
Remaining production gates
- Live custody/provider and key-loss recovery qualification with an identified KMS test resource.
- Full cross-stack conformance beyond the documented strict subset.
- Repeat the recovery runbook against the deployed host, real payment journal, backup/PITR system and pager route, with agreed load and availability targets.
- Run this tree through hosted CI and preserve evidence for the actual released artifact.
Protocol and alert references: VI constraint definitions and Prometheus rule testing.