{
 "bundle": "ip-hardening-batch2-2026-10-06",
 "generated": "2026-10-06T23:45:20+00:00",
 "defects": [
  {
   "id": "B2-01",
   "invention": "action-risk classifier",
   "defect": "SQL comments and odd whitespace hid destructive SQL (drop/**/table scored medium)",
   "fix": "SQL read raw and comment-stripped; stricter reading wins"
  },
  {
   "id": "B2-02",
   "invention": "action-risk classifier",
   "defect": "commands split into argv lists or nested keys were not recognised (rm -rf / as a list scored medium)",
   "fix": "command and SQL keys walked at any depth; lists also read joined"
  },
  {
   "id": "B2-03",
   "invention": "action-risk classifier",
   "defect": "amounts in minor units (amount_cents) or nested objects (payment.amount) produced no amount",
   "fix": "nested and minor-unit amounts read; NaN/inf ignored"
  },
  {
   "id": "B2-04",
   "invention": "action-risk classifier",
   "defect": "a look-alike letter in a tool name dropped its payments class",
   "fix": "confusable letters folded before classification"
  },
  {
   "id": "B2-05",
   "invention": "symbolic policy verifier",
   "defect": "only 4 exception types failed closed; other evaluation errors crashed the check",
   "fix": "any evaluation error denies"
  },
  {
   "id": "B2-06",
   "invention": "symbolic policy verifier",
   "defect": "a non-mapping advisory (\"yes\") crashed the check",
   "fix": "recorded as invalid and denies"
  },
  {
   "id": "B2-07",
   "invention": "CAIN 14 invariant checker",
   "defect": "the public route /fabric/invariants/verify-all reported 200/200 PASS from validators that compare or hash constants (an honesty fix of 2026-09-23 had been reverted on 2026-10-04)",
   "fix": "no validator counts as passed unless it exercises production code; the route reports by_kind (CONSTANT_ONLY 200) and a note"
  },
  {
   "id": "B2-08",
   "invention": "quarantine and kill switch",
   "defect": "a quarantined agent could lift its own quarantine, with a blank justification",
   "fix": "subject self-release and blank justifications refused (HTTP 400)"
  },
  {
   "id": "B2-09",
   "invention": "sandbox boundary",
   "defect": "/sandbox/isolation and /sandbox/execute returned an unhandled 500 when the sandbox answered non-JSON",
   "fix": "503 sandbox unavailable"
  },
  {
   "id": "B2-10",
   "invention": "message-injection firewall",
   "defect": "the untrusted-content fence could be closed through an unescaped source label",
   "fix": "source label escaped"
  },
  {
   "id": "B2-11",
   "invention": "code provenance manifest",
   "defect": "manifest generated from a dirty tree had drifted to 90 mismatches",
   "fix": "regenerated from a clean checkout of d36f1372 (1,126 files, VERIFIED)"
  }
 ],
 "tests": {
  "proof_run": "252 passed, 0 failed",
  "new_cases_failing_before_fix": 26,
  "previously_failing_tests_now_passing": 3
 },
 "deploy": "scripts/ops/rolling_deploy.py, tag deploy/20261006T234207Z, both gateway instances",
 "live_after_deploy": {
  "invariants_verify_all_4_requests": [
   {
    "passed_count": 0,
    "failed_count": 200,
    "by_kind": {
     "CONSTANT_ONLY": 200
    }
   },
   {
    "passed_count": 0,
    "failed_count": 200,
    "by_kind": {
     "CONSTANT_ONLY": 200
    }
   },
   {
    "passed_count": 0,
    "failed_count": 200,
    "by_kind": {
     "CONSTANT_ONLY": 200
    }
   },
   {
    "passed_count": 0,
    "failed_count": 200,
    "by_kind": {
     "CONSTANT_ONLY": 200
    }
   }
  ],
  "sandbox_isolation_4_requests": [
   "503",
   "503",
   "503",
   "503"
  ]
 },
 "commits": [
  "498c8412",
  "fb2f03bd",
  "bd71f8a0",
  "eb4938bf",
  "d36f1372",
  "659acb52"
 ],
 "independence": "same-project, self-verified; not third-party",
 "source_published": false
}