EdisonJwa
271d23faf7
Closes Phases A and D of the post-PoC sequencing.
Decision register (v0.9.2 → v0.9.3):
- DEC-014 Accepted: flutter_rust_bridge 2.x pinned (closed by
poc/flutter_rust_bridge_hello).
- DEC-013.1 Accepted: rusqlite (bundled) (closed by
poc/sqlite-storage-spike).
- DEC-013.2 Accepted: Linux secure-storage backend policy —
Secret Service preferred, keyutils fallback (closed by
poc/secure-storage-spike; resolves SysRS-053 / SysRS-162
ambiguity).
- DEC-011.1 Accepted (desktop: cpal) / Deferred (mobile)
(closed by poc/audio-capture-playback-spike desktop half only).
- DEC-022 Accepted: canonical implementation directory layout per
the README sketch and SAD §7.2.
- DEC-020 explicitly Deferred by owner; remains a public-release
blocker.
Audit reports updated with empirical evidence:
- docs/security/secure-storage-audit-report.md v0.9.3:
SS-AUD-001/002/003/005/006 = PoC Pass with evidence pointers;
SS-TC-003 (Linux) Actual Result populated and Status = PoC Pass;
SS-AUD-004 cross-referenced to diagnostics-redaction PoC;
findings SS-FIND-001 (closed by DEC-013.2), SS-FIND-002 (keyutils
session caveat), SS-FIND-003 (non-Linux adapters still open).
- docs/security/diagnostic-redaction-audit-report.md v0.9.3:
REDACT-TC-001..010 = PoC Pass with evidence pointers; export
bundle policy §5 populated for every row; findings
REDACT-FIND-001 (regex coverage), REDACT-FIND-002
(tracing-layer integration), REDACT-FIND-003 (cross-spike
KnownSecretRegistry contract).
PoC plan (v0.1.0 → v0.2.0):
- Status column added to §2; outcomes recorded.
New doc:
- docs/governance/poc-results-summary.md v0.1.0 — single-page
reviewer-facing summary listing each spike's status, the
toolchain exercised, the owner decisions taken, the audit
coverage table, and open risks RISK-PoC-001..005 (mobile audio,
non-Linux secure-storage adapters, license, remaining
Proposed decisions, no product code yet).
This completes the post-PoC documentation work. Repo is at a clean
pause point: PoC code is committed, owner decisions are recorded,
audit reports carry empirical evidence, and the residual risks are
named in the summary doc.
7.5 KiB
7.5 KiB
Sec Secure Storage Audit Report V0.9.3.0.0
Document type: Security / Secure Storage Audit Report
Version: 0.9.3
Status: Baseline Candidate
Language: English
Product: Chanora
Repo path: docs/security/secure-storage-audit-report.md ---
1. Purpose
This report records evidence that Chanora stores secrets using platform secure storage mechanisms and does not store sensitive secrets in plaintext local storage.
2. Secret Classification
| Secret ID | Secret | Required storage |
|---|---|---|
| SEC-STORE-001 | Identity private key / identity secret | Platform secure storage |
| SEC-STORE-002 | Server password | Platform secure storage |
| SEC-STORE-003 | Authentication tokens if later added | Platform secure storage |
| SEC-STORE-004 | Encryption keys if later added | Platform secure storage |
3. Platform Audit Matrix
| Platform | Secure storage mechanism | Test status | Evidence | Result |
|---|---|---|---|---|
| Windows | DPAPI / Windows Credential Manager (per DEC-013 / SysRS-158) — adapter not yet implemented | Not started | n/a | Deferred to product chanora_storage |
| macOS | Keychain (per SysRS-159) — adapter not yet implemented | Not started | n/a | Deferred to product chanora_storage |
| Linux | Secret Service (libsecret) preferred; kernel keyutils fallback per DEC-013.2 | PoC Pass | poc/secure-storage-spike/VERIFICATION.md; six audit tests PASS via keyutils backend; CLI run additionally observed Secret-Service-locked → keyutils fallback live |
PoC PASS; product audit pending |
| Android | Android Keystore (per SysRS-161) — adapter not yet implemented | Not started | n/a | Deferred to product chanora_storage |
| iOS | Keychain (per SysRS-160) — adapter not yet implemented | Not started | n/a | Deferred to product chanora_storage |
4. Audit Checks
| Check ID | Check | Expected result | Status | Evidence |
|---|---|---|---|---|
| SS-AUD-001 | Identity secret is not stored in local DB. | Pass | PoC Pass (Linux) | poc/secure-storage-spike/tests/audit.rs::ss_aud_001_identity_secret_absent_from_local_db — raw SQLite file scanned for plaintext markers; only the lookup name appears. |
| SS-AUD-002 | Server password is not stored in local DB. | Pass | PoC Pass (Linux) | poc/secure-storage-spike/tests/audit.rs::ss_aud_002_server_password_absent_from_local_db — distinct plaintext marker scan. |
| SS-AUD-003 | Secret values are not written to application logs. | Pass | PoC Pass (Linux) + cross-spike | poc/secure-storage-spike/tests/audit.rs::ss_aud_003_secret_values_not_in_logs — captured tracing output contains <redacted> markers; never the plaintext. Cross-referenced by poc/diagnostics-redaction-spike REDACT-TC-002. |
| SS-AUD-004 | Secret values are not included in diagnostic export. | Pass | PoC Pass | Covered by poc/diagnostics-redaction-spike/tests/redaction.rs::redact_tc_008_diagnostic_bundle_with_mixed_sensitive_fields — whole-bundle JSON scan finds no plaintext. |
| SS-AUD-005 | Secure storage failure returns safe error. | Pass | PoC Pass (Linux) | poc/secure-storage-spike/tests/audit.rs::ss_aud_005_safe_error_on_missing_entry. Reinforced by the CLI driver run: a real locked gnome-keyring collection produced a typed Backend error containing no secret material, which the application then routed to the fallback adapter (DEC-013.2). |
| SS-AUD-006 | Secret deletion removes secure-storage entry. | Pass | PoC Pass (Linux) | poc/secure-storage-spike/tests/audit.rs::ss_aud_006_delete_removes_entry — second delete returns NotFound, not silent success. |
| SS-AUD-007 | Platform-specific secure storage is documented. | Pass | Partial | Linux documented in poc/secure-storage-spike/README.md and DEC-013.2. Windows/macOS/Android/iOS remain to be documented when adapters land in chanora_storage. |
| SS-AUD-008 | Migration or import path does not expose secrets. | Pass | Pending | No migration / import path exists yet; depends on product chanora_storage schema design (cross-references DEC-013.1 and poc/sqlite-storage-spike). |
5. Test Cases
| Test ID | Platform | Procedure | Expected result | Actual result | Status |
|---|---|---|---|---|---|
| SS-TC-001 | Windows | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | Not run — Windows adapter not implemented in PoC | Deferred |
| SS-TC-002 | macOS | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | Not run — macOS adapter not implemented in PoC | Deferred |
| SS-TC-003 | Linux | Save identity secret, inspect local DB/logs/export. | Secret absent from DB/logs/export. | Set / get / delete round-trip verified via keyutils backend; raw SQLite file scan confirmed plaintext absence; tracing log capture confirmed log absence. |
PoC Pass |
| SS-TC-004 | Android | Save identity secret, inspect app storage/logs/export. | Secret absent from DB/logs/export. | Not run — Android adapter not implemented in PoC | Deferred |
| SS-TC-005 | iOS | Save identity secret, inspect app storage/logs/export. | Secret absent from DB/logs/export. | Not run — iOS adapter not implemented in PoC | Deferred |
6. Findings
| Finding ID | Severity | Description | Status | Owner |
|---|---|---|---|---|
| SS-FIND-001 | Informational | SysRS-053 / SysRS-162 ("Secret Service, libsecret, or equivalent") admitted both Secret Service and kernel keyutils as Linux backends. The PoC surfaced this ambiguity. | Resolved by DEC-013.2 on 2026-05-13 (Secret Service preferred, keyutils fallback). | Software Architect + Security Reviewer |
| SS-FIND-002 | Informational | Kernel keyutils requires a valid session keyring; cargo-test under non-interactive shells inherits an expired _ses and must be wrapped with keyctl session -. Production code on a graphical session inherits a valid session from PAM. |
Documented in poc/secure-storage-spike/README.md and VERIFICATION.md. |
Software Architect |
| SS-FIND-003 | Open | Windows / macOS / iOS / Android adapters not implemented; SS-TC-001/002/004/005 unverified. | Open — to be closed by per-platform adapter spikes or by the product chanora_storage implementation. |
Platform Owners |
7. Approval
| Role | Name | Decision | Date |
|---|---|---|---|
| Security Reviewer | TBD | Pending | TBD |
| Platform Owner | TBD | Pending | TBD |
| QA / Verification Owner | TBD | Pending | TBD |
8. Change History
| Version | Date | Description |
|---|---|---|
| 0.9.0 | 2026-05-14 | Initial secure storage audit report template. |
Baseline Candidate 0.9.1 Update
| Version | Date | Description |
|---|---|---|
| 0.9.1 | 2026-05-14 | Updated baseline after product decision closure: Apple App Store SDK gate uses Xcode 26+ and iOS 26 / iPadOS 26 SDK+ since 2026-04-28, platform baselines and decision traceability propagated across the document set. |
Baseline Candidate 0.9.2 Update
| Version | Date | Description |
|---|---|---|
| 0.9.2 | 2026-05-14 | Corrected Apple App Store Connect upload gate to 2026-04-28 and checked full-package naming, references, and coverage. |
Baseline Candidate 0.9.3 Update
| Version | Date | Description |
|---|---|---|
| 0.9.3 | 2026-05-14 | Recorded PoC empirical evidence: SS-AUD-001/002/003/005/006 status set to PoC Pass with evidence pointers; SS-AUD-004 cross-referenced to the diagnostics-redaction PoC; SS-TC-003 Linux Actual Result populated and Status set to PoC Pass. Added findings SS-FIND-001 (closed by DEC-013.2), SS-FIND-002 (keyutils session caveat), SS-FIND-003 (non-Linux adapters still open). Non-Linux test cases SS-TC-001/002/004/005 remain Deferred. |