docs: record 5.2.2 release audit results

AUDIT.md

@@ -56,8 +56,9 @@ and LFS pointers; textual assembly is a permitted source type.
 Archive inspection must also fail closed at bounded recursion depth, member
 count, individual expanded size, and total expanded size so a nested archive or
 decompression bomb cannot turn the release scanner into an unbounded resource
-consumer. This hardening and its adversarial fixtures are release-blocking and
+consumer. On committed Linux candidate `ff99770`, this hardening and its
-remain `PENDING` until rerun on the exact candidate.
+adversarial fixtures passed all 39 source-only scanner cases, including GNU
+thin-archive and safe-diagnostic-path cases.
 
 An unknown `.bin` fails by default. A necessary binary data fixture can be
 declared only through `--data-manifest`, with four tab-separated fields for
@@ -98,15 +99,32 @@ Relevant review layers include:
 | Source reproducibility | two `make dist` runs with identical committed input and epoch | Requires equal SHA-256 digests and clean archive scans |
 | Installed package | target-native package inspection and `scripts/test-installed-zupt.sh` | Applies only to the exact OS/release/architecture tested |
 
-This table identifies evidence, not results. The release validation report and
+This table identifies evidence layers rather than results. Missing tools, OBS
-`packaging/opensuse/README.md` record `PASS`, `FAIL`, or `SKIP` for each actual
+access, other architectures, Leap, and SLE must not be reported as passing
-run. Missing tools, OBS access, other architectures, Leap, and SLE must not be
+without evidence.
-reported as passing without evidence.
 
-The 5.2.2 key-file, terminal-comment, password-prompt, explicit-Bash regression,
+## Committed-candidate local Linux evidence
-and scanner-resource-limit changes were added during the final self-audit. All
+
-affected checks and the complete required suite must be rerun after they land;
+The following upstream self-audit results apply to commit `ff99770` on the
-no earlier result is a final-candidate `PASS`.
+recorded local Linux environments. They are not an independent certification,
+a result for later commits, or evidence that release assets have been published.
+
+| Gate | Result | Recorded evidence |
+|---|---|---|
+| Full project gate | PASS | `make release-check` completed successfully on `ff99770`, including the late key-file, terminal-comment, password-prompt, explicit-Bash, and scanner-limit regressions. |
+| Packaging policy/syntax | PASS | `PASS=49 FAIL=0 SKIP=0`. |
+| Source-only scanner adversarial suite | PASS | 39/39, including GNU thin archives, bounded archive expansion, and safe diagnostic cases. |
+| Strict compilers and compiler analyzer | PASS | GCC and Clang strict builds passed; GCC `-fanalyzer` passed. |
+| Static-analysis suite | PASS | 9/9 in the full tool-enabled run. A separate reduced-environment `release-check` run completed six available checks and reported `cppcheck` unavailable; unavailable tooling was not relabelled as a pass. |
+| Dynamic analysis | PASS | ASan, UBSan, and LSan runs passed. |
+| Mutation fuzzing | PASS | 1,000 mutation iterations completed without a sanitizer-detected crash. |
+
+An earlier off-screen GUI smoke run remains supporting evidence, but is not
+represented as an exact-`ff99770` GUI-package result. Native Windows and macOS
+gates, hosted GitHub CI and release promotion, authenticated OBS validation,
+and resolution of the openSUSE automatic `debugsource` rpmlint `no-binary`
+finding remain pending. The immutable tag and its final artifacts must not be
+described as released until those applicable gates complete.
 
 ## Cryptographic review boundary
 

CHANGELOG.md

@@ -133,7 +133,7 @@ path; older readers are not claimed to accept every archive written by 5.2.2.
   stored as hexadecimal text with its source tag/commit, password, input hash,
   and archive hash. The 5.2.2 candidate lists, tests, extracts, and restores it byte-exact;
   the legacy index has no whole-image hash and produces an explicit warning.
-  The exact final candidate must repeat this gate, and no broader historical
+  The full local Linux gate passed on commit `ff99770`; no broader historical
   compatibility claim is made.
 - Serialize fixed-width archive/header, footer, index and PBKDF iteration
   fields explicitly in little-endian order. Varint readers now reject overlong
@@ -234,16 +234,20 @@ path; older readers are not claimed to accept every archive written by 5.2.2.
 - Updated the README, installation, distribution, security, audit, GUI, and
   manual-page documentation for the 5.2.2 source-only workflow.
 
-Validation results are recorded by the release process and the openSUSE
+The committed Linux candidate `ff99770` passed the full local
-packaging README. A missing tool or unexecuted platform remains `SKIP`; this
+`make release-check`. Recorded results include packaging
-entry does not claim successful OBS, architecture, Leap, or SLE builds without
+`PASS=49 FAIL=0 SKIP=0`; 39/39 source-only scanner cases, including GNU thin
-corresponding evidence. Runs made before the final positional-AAD and
+archives and safe diagnostics; strict GCC and Clang; GCC `-fanalyzer`; 9/9 in
-mandatory-AIT changes are intermediate diagnostic evidence, not final release
+the full tool-enabled static-analysis run; ASan/UBSan/LSan; and 1,000
-gates. Private-key creation/parsing, terminal-safe comment rendering, prompt
+mutation-fuzz iterations without a sanitizer-detected crash. An earlier
-signal cleanup, explicit-Bash regression execution, and scanner bomb limits are
+off-screen GUI smoke run remains supporting rather than exact-candidate package
-also final self-audit release blockers. Their focused checks and the complete
+evidence.
-required suite remain `PENDING` until the exact candidate is rerun before
+
-tagging; this entry does not claim a final `PASS`.
+These are upstream self-audit results, not independent certification or a
+published-release claim. Native Windows and macOS, hosted GitHub CI and release
+promotion, authenticated OBS, and the openSUSE automatic `debugsource` rpmlint
+`no-binary` finding remain pending. Missing or unexecuted gates remain `SKIP`,
+not `PASS`.
 
 
 ## [5.2.1] — 2026-07-12 — GUI Verify/Extract robustness; refreshed comparison + audit tables

README.md

@@ -164,8 +164,9 @@ allowed only with `--data-manifest FILE`; each tab-separated record must name
 its path, purpose, provenance, and SPDX license. This exception never permits
 compiled or executable magic, packages, AppImages, bytecode, or Git LFS
 pointers. Nested scans cap recursion, member count, individual expansion, and
-total expanded bytes and fail closed at a limit. The exact candidate must rerun
+total expanded bytes and fail closed at a limit. On committed Linux candidate
-the scanner-bomb fixtures before any release result is marked `PASS`.
+`ff99770`, all 39 source-only scanner cases passed, including GNU thin archives,
+scanner-bomb limits, and safe diagnostic cases.
 
 ## Build from source
 
@@ -282,16 +283,19 @@ devices are accepted only when their capacity can be determined and is large
 enough. The privileged undersized-loop-device regression is reported `SKIP`,
 not `PASS`, when the environment cannot create a loop device.
 
-The final release gate must also rerun the positional-AAD and mandatory-AIT
+The committed Linux candidate `ff99770` passed the full local
-regressions on the exact tagged candidate. Results obtained before those final
+`make release-check`. Recorded results include packaging
-integrity changes are useful diagnostic evidence, but are not promoted as final
+`PASS=49 FAIL=0 SKIP=0`, the 39/39 source-only scanner suite, strict GCC and
-release results. The openSUSE matrix records unexecuted gates as `SKIP`.
+Clang, GCC `-fanalyzer`, a 9/9 full tool-enabled static-analysis run,
+ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations without a
+sanitizer-detected crash. An earlier off-screen GUI smoke run remains supporting
+evidence rather than an exact-candidate package result.
 
-Private-key creation/parsing, terminal-safe comment display, POSIX prompt signal
+These are upstream local self-audit results, not independent certification or a
-cleanup, explicit-Bash regression execution, and scanner-resource-limit changes
+published-release claim. Native Windows and macOS, hosted GitHub CI/release
-are final self-audit release blockers. Their focused regressions and the full
+promotion, authenticated OBS, and resolution of the openSUSE automatic
-required suite remain pending until rerun on the exact candidate; this README
+`debugsource` rpmlint `no-binary` finding remain pending. Unexecuted gates are
-does not convert intermediate results into a final `PASS`.
+`SKIP`, never `PASS`.
 
 On Windows, 5.2.2 scopes output handling to normal local Win32 paths. A MinGW
 cross-build or Wine run is not native-Windows evidence; the `windows-latest`
@@ -329,8 +333,8 @@ compatibility scope includes an actual v5.2.1 password-encrypted, deduplicated
 disk archive with a DATA/DATA/REF/DATA sequence using the fixed-width legacy index
 and the legacy linear AAD sequence. The repository stores that 718-byte archive
 as auditable hexadecimal text with its provenance and SHA-256; the candidate
-lists, tests, extracts, and restores it byte-exact. The exact final candidate must repeat
+lists, tests, extracts, and restores it byte-exact. The full local Linux gate
-the gate. This is not a claim that a 5.2.1 reader understands every new
+passed on commit `ff99770`. This is not a claim that a 5.2.1 reader understands every new
 flag-gated 5.2.2 encoding or that every historical combination was tested.
 
 The candidate commands and outcome fields for 5.2.2 are maintained in the

SECURITY.md

@@ -48,7 +48,7 @@ password read; do not reuse it as a multi-record protocol channel.
 On POSIX terminals, the explicit prompt saves terminal state and installs
 signal-aware cleanup so a handled interruption restores echo and other changed
 settings before termination. This behavior is covered by a PTY regression and
-must be rerun on the exact release candidate.
+passed in the full local Linux gate for commit `ff99770`.
 
 ## Native key files
 
@@ -225,7 +225,7 @@ gate was rerun on every platform:
   whole-image content hash. Its regression fixture is an actual v5.2.1
   password-encrypted DATA/DATA/REF/DATA disk archive stored as hexadecimal text with
   source and hash provenance. The candidate lists, tests, extracts, and restores it
-  byte-exact; the exact final candidate must repeat that gate. This does not
+  byte-exact; the full local Linux gate passed on commit `ff99770`. This does not
   claim that 5.2.1 readers accept the new flag-gated 5.2.2 records or that every
   historical encrypted+dedup combination was validated.
 
@@ -245,8 +245,8 @@ scripts/check-source-only.sh --archive /path/to/zupt-5.2.2.tar.gz
 
 Nested archive inspection is required to enforce bounded recursion, member
 count, per-entry expanded size, and total expanded size, and to fail closed on
-limit violations. The resource-limit regressions and all other late self-audit
+limit violations. On commit `ff99770`, the source-only scanner suite passed
-fixes remain pending until the exact candidate completes the final gate suite.
+39/39, including GNU thin archives, resource-limit cases, and safe diagnostics.
 
 DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
 ZIP, Windows ZIP, and macOS DMG release assets are separate outputs. An
@@ -285,16 +285,18 @@ make test-asan-run
 The first command builds the sanitizer configuration; the second executes its
 test suite. Neither substitutes for the normal optimized build and tests.
 
-Because the positional-AAD and mandatory-AIT behavior changed late in the
+The full local Linux `make release-check` passed on committed candidate
-candidate, earlier successful runs are intermediate evidence only. The exact
+`ff99770`. Its recorded evidence includes packaging `PASS=49 FAIL=0 SKIP=0`,
-release candidate must rerun the affected regressions and the complete required
+the 39/39 source-only scanner suite, strict GCC and Clang builds, GCC
-suite; unavailable environments remain `SKIP`, not `PASS`.
+`-fanalyzer`, 9/9 static analysis in a tool-enabled run, ASan/UBSan/LSan, and
+1,000 mutation-fuzz iterations without a sanitizer-detected crash. An earlier
+off-screen GUI smoke run is supporting evidence, not an exact-candidate package
+result.
 
-The same rule applies to private-key creation/parsing, terminal-safe comment
+These are upstream self-audit results, not independent certification. Native
-display, POSIX prompt signal cleanup, explicit Bash regression execution, and
+Windows and macOS, hosted GitHub CI/release promotion, authenticated OBS, and
-source-scanner resource limits added during the final self-audit. This document
+the openSUSE automatic `debugsource` rpmlint `no-binary` finding remain pending.
-records intended candidate behavior, not a final `PASS` for work still being
+An unavailable or unexecuted environment remains `SKIP`, never `PASS`.
-integrated or rerun.
 
 Run target-native static analyzers and package checks as additional evidence.
 Do not infer x86_64, aarch64, ppc64le, s390x, riscv64, macOS, Windows, Leap, or

THREAT_MODEL.md

@@ -240,9 +240,9 @@ LFS pointers.
 
 Nested inspection is itself an untrusted-input boundary. The release scanner
 must cap recursion depth, archive members, per-entry expansion, and total
-expanded bytes and fail closed when a cap is reached. Scanner bomb regressions
+expanded bytes and fail closed when a cap is reached. Commit `ff99770` passed
-and all other late self-audit fixes are pending until rerun on the exact
+all 39 source-only scanner cases, including GNU thin archives, scanner-bomb
-candidate.
+limits, and safe diagnostic cases.
 
 DEB, binary RPM, SRPM, notice-bearing Linux tar.xz, source-only portable GUI
 ZIP, Windows ZIP, and macOS DMG files can be published separately from the
@@ -259,6 +259,15 @@ after source scans and an exact safe-member check. AppDir and Flatpak bundles
 and GUI platform installers remain excluded; Windows ZIP and macOS DMG outputs
 remain CLI-only.
 
+The committed Linux candidate `ff99770` passed the full local
+`make release-check`: packaging reported `PASS=49 FAIL=0 SKIP=0`; strict GCC,
+strict Clang, GCC `-fanalyzer`, the 9/9 tool-enabled static-analysis run,
+ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. Earlier off-screen
+GUI smoke evidence is retained separately. This upstream self-review is not an
+independent certification, and native Windows/macOS, hosted GitHub CI and
+release promotion, authenticated OBS, and the openSUSE automatic `debugsource`
+rpmlint `no-binary` finding remain pending.
+
 ## Historical compatibility notes
 
 These are historical facts about earlier releases, retained to support recovery:
@@ -279,7 +288,7 @@ These are historical facts about earlier releases, retained to support recovery:
   v5.2.1 password-encrypted DATA/DATA/REF/DATA disk fixture is stored as hexadecimal
   text with source and hash provenance. The candidate lists, tests, extracts, and restores
   it byte-exact, with a warning that the legacy index has no whole-image hash;
-  the exact final candidate must repeat that gate. Older readers are not
+  the full local Linux gate passed on commit `ff99770`. Older readers are not
   claimed to accept new flag-gated 5.2.2 records, and untested historical mode
   combinations remain unclaimed.
 

packaging/opensuse/README.md

@@ -97,8 +97,8 @@ immutable v5.2.1 tag is stored as hexadecimal text with its source and SHA-256
 provenance. The 5.2.2 reader reconstructs the legacy linear block-AAD sequence,
 lists, tests, extracts, and restores its input byte-exact through the
 fixed-width legacy disk-index parser. This does not cover every historical mode
-and must be rerun on the final candidate before it is promoted as a release
+and passed in the full local Linux gate for commit `ff99770`; the target RPM
-gate.
+`%check` must still exercise it before that package is promoted.
 
 Disk restore also snapshots the measured archive into a private scratch file
 before opening the destination, then validates and restores from that same
@@ -153,7 +153,23 @@ install it in a disposable openSUSE environment and execute
 `scripts/test-installed-zupt.sh`. Do not claim a repository or architecture
 as supported until its build and installed smoke test have actually passed.
 
-## Validation matrix for this handoff
+## Committed-candidate local Linux validation
+
+Commit `ff99770` passed the full local `make release-check`. Packaging policy
+and syntax reported `PASS=49 FAIL=0 SKIP=0`; source-only scanner testing passed
+39/39, including GNU thin archives and safe diagnostic cases; strict GCC,
+strict Clang, GCC `-fanalyzer`, the 9/9 full tool-enabled static-analysis run,
+ASan/UBSan/LSan, and 1,000 mutation-fuzz iterations passed. A reduced
+environment completed six available static checks and reported `cppcheck`
+unavailable rather than passing it. Earlier off-screen GUI smoke evidence is
+supporting evidence, not an exact-commit package result.
+
+These local upstream results do not establish native Windows or macOS success,
+hosted GitHub CI/release promotion, authenticated OBS acceptance, or resolution
+of the automatic openSUSE `debugsource` rpmlint `no-binary` finding. Those gates
+remain pending.
+
+## Prior openSUSE packaging validation
 
 The local results below were produced on 2026-08-24 from the 5.2.2 candidate
 snapshot captured for the packaging run, in a disposable openSUSE Tumbleweed