[coji]

Summary

Add a repeatable Shannon security audit for the committed examples/fullstack demo.

Changes

• Pin the Shannon source revision, Pi worker packages, and built worker image; validate the existing ChatGPT OAuth session, openai:gpt-6-sol, and cyber access before creating an audit target.
• Build a detached shallow Git clone at the recorded commit. Run the app with a fresh SQLite database in a read-only container on an internal network, reachable to Shannon through a dedicated TCP proxy.
• Save scanner status, five report/SARIF artifacts, sanitized execution log, and before/after SQLite schema, integrity, counts, and run IDs outside the repository. Fail on partial phases or missing evidence and clean up named Docker resources on every exit path.
• Record the isolation decision in ADR-0035.

Test plan

• pnpm validate at the reviewed head (including 17 audit workflow tests)
• Pinned Shannon setup and OAuth/model/cyber preflight passed
• Full repeat audit at reviewed head 572e9bc completed all required phases; exploitation was skipped because there were no exploit candidates
• Five required report/SARIF files produced outside the worktree; exploit-confirmed findings: 0; separate static-analysis leads: 8
• SQLite integrity ok before and after; six scan-created run IDs recorded; target container, proxy, network, volume, and image removed
• Confirmed generated reports and databases are absent from this PR diff

Limits

The example is intentionally public and unauthenticated. Static-analysis leads are separate from exploit-confirmed findings and need individual triage before treating them as library vulnerabilities. The scanner's traffic limits are prompt instructions; hard isolation comes from the synthetic database and private target network.

Base: 244303ede93996120030a3879a74234e102f1f27
Head: 572e9bc6df1a0f44d8b0d4f51007bba5692232f4

Review gate

Round 6: GO for 572e9bc6df1a0f44d8b0d4f51007bba5692232f4. Codex and Opus independently completed all eight perspectives, and every candidate was verified by a non-discovering reviewer. No confirmed P0–P2 code finding remains. Exact-head pnpm validate, all five CI/Vercel checks, live Shannon setup and preflight, and the full repeat scan passed. ADR-0035 and its index are accepted. Non-blocking P3 findings remain recorded in the external round reports: narrow signal timing cases, unusual pnpm layouts, test coverage, and dependency-hash cost.

Generated with spec-implement-accept skill

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
durably-demo	Ignored	Preview	Oct 18, 2026 11:17am UTC
durably-demo-vercel-turso	Ignored	Preview	Oct 18, 2026 11:17am UTC