{
  "date": "2026-09-11",
  "scope": "Remediation of the same-day full-codebase review. Working tree on main at e0a4464f.",
  "status": "Eleven of fifteen tasks closed with local evidence, plus three defects the push itself surfaced. Three remain open as multi-week work, and two need an action only the repository owner can take.",
  "findings": [
    {
      "id": "F1",
      "task": "T01",
      "title": "The tree does not pass its own build",
      "status": "Closed",
      "action": "ktlintFormat on kms:plugins:hashicorp cleared all 232 violations across 10 files. The module baseline is unchanged, so nothing was grandfathered.",
      "evidence": "./gradlew build now completes; :kms:plugins:hashicorp:test passes"
    },
    {
      "id": "F2",
      "task": "T02",
      "title": "main carries an unversioned copy of the reviewed code",
      "status": "Closed",
      "action": "Committed as 5128031f, then codex/joint-remediation-20260910 merged into main with -s ours \u2014 main already contained every one of the 319 files that branch touches, and a content merge would have 3-way-blended the unformatted Vault sources and literal dependency coordinates back in alongside their replacements. Verified before merging that no branch file was absent from main. Pushed; the three ancestor branches are merged transitively."
    },
    {
      "id": "F3",
      "task": "T03",
      "title": "There is no publication path",
      "status": "Closed in code; one external step remains",
      "action": "Declared a Maven repository in the root build and in the BOM, added scm and issueManagement to every POM, corrected the dead documentation URL, added a reviewer-gated publish job on v* tags, and added scripts/check-publication.py to CI so none of it can regress.",
      "evidence": "publishAllPublicationsToCentralRepository now exists; 103 generated POMs validate",
      "remaining": "Sonatype namespace verification and the secrets/environment setup in docs/operations/publishing.md."
    },
    {
      "id": "F4",
      "task": "T04",
      "title": "Coverage is bimodal",
      "status": "Open",
      "remaining": "57.30% line / 39.83% branch to roughly 75% / 60%, top-down from credential-api. Two to three weeks of test writing; not attempted here."
    },
    {
      "id": "F5",
      "task": "T05",
      "title": "61 dependency coordinates escape the catalog",
      "status": "Closed",
      "action": "All 61 literals moved into gradle/libs.versions.toml across 34 build files. Converged web3j 4.10.0 to 4.14.0, gson 2.10.1 to 2.14.0, slf4j 2.0.9 to 2.0.17 and kotlinx-coroutines-test 1.8.1 to 1.10.2. bitcoinj stays at 0.16.2 through a new bitcoinj-legacy alias because 0.17 is a breaking API change that needs its own migration; the drift is now recorded in the catalog instead of hidden in a module. scripts/check-dependency-catalog.py fails the build on a new literal.",
      "evidence": "109 build scripts checked, zero literal coordinates; affected modules compile on the converged versions"
    },
    {
      "id": "F6",
      "task": "T07",
      "title": "Three shipped servers have no authentication primitive",
      "status": "Closed",
      "action": "Added HostAuthentication to the observability module: constant-time bearer tokens, host-supplied authorizers, an explicit frontedByProxy declaration, and per-caller fixed-window rate limiting with bounded caller tracking. The DID registrar, VC API and status-list servers gained withAuthentication and refuse mutating requests with 503 until it is called. This is a breaking change and is recorded in the changelog.",
      "evidence": "13 new tests in HostAuthenticationTest; ABI dumps updated additively"
    },
    {
      "id": "F7",
      "task": "T06",
      "title": "Instrumentation stops at the HTTP boundary",
      "status": "Open",
      "remaining": "An observability SPI through did-core, kms-core, wallet-core and credential-api. One week; not attempted here."
    },
    {
      "id": "F8",
      "task": "T08",
      "title": "Half the workflows are unpinned",
      "status": "Closed",
      "action": "All 14 remaining action references pinned to commit SHAs with version comments. Added permissions blocks to the two workflows that had none. The nightly conformance job's issues:write moved to a separate job that runs no repository code, so a compromised build dependency cannot reach it. scripts/check-workflow-pinning.py enforces both properties in CI.",
      "evidence": "6 workflows checked; every action SHA-pinned and every job permission-scoped"
    },
    {
      "id": "F9",
      "task": "T09",
      "title": "Nothing is declared production-supported",
      "status": "Partially closed",
      "action": "Added a ratchet: every module must appear in the capability catalog or in config/capability-ratchet.json, and the unassessed count may only fall. A new module with no declared maturity now fails the build.",
      "remaining": "Classifying the 102 recorded modules, and the custody and hardware qualification behind a supported rating. Both are owner decisions, not mechanical work."
    },
    {
      "id": "F10",
      "task": "T12",
      "title": "A presenter-reachable exception escapes the verification contract",
      "status": "Closed",
      "action": "ChainVerifier translates ledger IllegalStateException and IllegalArgumentException into an invalid result with a stable message, alongside the SQLException path it already had.",
      "evidence": "New regression in IssuanceRoundTripTest drives both exception types through a refusing data source"
    },
    {
      "id": "F11",
      "task": "T10",
      "title": "Two documented cancellation gaps",
      "status": "Closed",
      "action": "encodeBitSet and decodeBitSet are suspend and call ensureActive() every 8192 bits, as their TODOs prescribed. updateCredentialStatus became suspend with them; every caller was already suspend, so no public signature changed.",
      "evidence": "Two new tests: a cancelled revocation issues fewer statements than a completed one, proving the decode loop aborted before its post-decode SQL; and a structural guard that both functions stay suspend"
    },
    {
      "id": "F12",
      "task": "T13",
      "title": "The validation gates read the wrong directory on Windows",
      "status": "Closed",
      "action": "Added scripts/build_root.py, which resolves the build root the way the Gradle build does, including the trustweave.windowsInRepoBuild opt-out, and refuses a root holding no JUnit results rather than reporting phantom gaps. Both gates now use it.",
      "evidence": "Both gates exit 0 with no arguments after a build; 9 unit tests cover the resolution and the refusal"
    },
    {
      "id": "F13",
      "task": "T15",
      "title": "Broad catch surface",
      "status": "Closed",
      "correction": "The review said 549 broad catches with 12 empty bodies. The 549 is right (550 on a precise count). The 12 is not: a balanced-brace scan finds zero genuinely empty catch bodies and 21 whose body is only a comment. That figure came from a line-counting grep, not a parse.",
      "action": "Of those 21, four sat in suspend functions and swallowed CancellationException: TrustedDomainManager.emitSafely, InMemoryDomainTreasury.emitSafely and two testkit integration helpers. All four now rethrow it. The rest are best-effort close() and logging fallbacks in non-suspend code, each already carrying a comment explaining why. The full sweep then landed: 212 clauses across 81 files rethrow CancellationException first. Ordering turned out to be load-bearing \u2014 CancellationException is an IllegalStateException, so two guards inserted after such a clause were unreachable and are moved to the front of their chains. scripts/check-cancellation-guards.py enforces existence and ordering and recognises the in-body rethrow shape; the repository is at zero."
    },
    {
      "id": "T11",
      "title": "Deployment-scale ledger qualification",
      "status": "Open",
      "remaining": "Sustained load, replica promotion under write load, published RPO/RTO. Needs real infrastructure and soak time."
    },
    {
      "id": "T14",
      "title": "Compile the documentation consumers copy",
      "status": "Open",
      "remaining": "9 of 2,363 Kotlin blocks are source-backed. One week; not attempted here."
    },
    {
      "id": "F14",
      "title": "A test container image was pulled from a tag that had vanished",
      "status": "Closed",
      "discovered": "By pushing: the task had been coming from the build cache, so the break was invisible until a cache miss.",
      "action": "minio/minio's Docker Hub copy of RELEASE.2025-09-07T16-13-09Z no longer resolves. Repointed at quay.io, MinIO's own registry, pinned by digest. localstack, vault and ganache-cli were on :latest and now name versions. scripts/check-container-images.py rejects :latest and untagged images; two opt-in integration images with no listable version tag are recorded with reasons.",
      "evidence": "Verified by deleting the cached image first, so the pull was genuinely exercised"
    },
    {
      "id": "F15",
      "title": "Gate evidence did not survive its own build cache",
      "status": "Closed",
      "discovered": "CI failed check-reliability-evidence.py on a commit whose reliability tests had all passed.",
      "action": ":verifiable-intent:test came back FROM-CACHE. The JUnit XML is a declared task output so it was restored; the JSON evidence the gate reads was written outside the declared outputs and was not. The evidence directory is now a declared test output and its path comes from a system property Gradle sets to the module's real build directory. The observability module had the same shape.",
      "evidence": "Deleted the evidence, re-ran to a FROM-CACHE hit, and it was restored"
    }
  ],
  "new_gates": [
    "scripts/check-workflow-pinning.py \u2014 every action SHA-pinned, every job permission-scoped",
    "scripts/check-dependency-catalog.py \u2014 no dependency version outside the catalog",
    "scripts/check-publication.py \u2014 publishing repository declared, POMs complete, documentation links live",
    "scripts/check-capability-coverage.py \u2014 every module declares a maturity; the unassessed count may only fall",
    "scripts/build_root.py \u2014 evidence gates read the directory Gradle actually wrote",
    "scripts/check-container-images.py \u2014 no :latest or untagged test container image",
    "scripts/check-cancellation-guards.py \u2014 every broad catch in a suspend function rethrows CancellationException, and nothing on its type hierarchy precedes the guard"
  ],
  "pushed": {
    "main": "581b2752",
    "merged": "codex/joint-remediation-20260910 and its three ancestor branches, recorded with -s ours because main already carried their content",
    "note": "Pushing exposed three defects that local runs could not: a Docker Hub tag that had stopped resolving, evidence written outside a task's declared outputs so a build-cache hit lost it, and a second and third instance of the wrong-build-root class from F12."
  }
}