# SAF technical audit — 2026-09-07

This report records the repository-grounded audit and remediation performed for the sdd-agentic-flow 7.10.2 release. It is a tracked handoff summary; the disposable probes and detailed ledger remain local audit evidence.

## Scope and method

The review covered product architecture, all 12 skills, shared references, SDD/evidence contracts, autonomy and guardrails, routing, CLI and machine output, lifecycle and filesystem safety, network and runtime dependencies, packaging, provider/platform neutrality, security, tests, certification, CI/release, documentation, examples, schemas, state/recovery, determinism, performance, supply chain, licensing, hygiene, complexity, and end-to-end journeys.

Evidence was gathered from source, tests, generated dist, a disposable packed consumer, CLI certification, full matrices, documentation gates, and mutation probes. No npm publish, GitHub release, remote CI query, or destructive repository cleanup was performed.

## Assessment

Score after remediation: 7.5/10. Confidence: medium. The core architecture is coherent and local-first, with the CLI acting as a deterministic control plane and skills remaining the public capability layer. The main remaining limits are host-agent enforcement, semantic evidence validity, crash recovery, concurrent filesystem races, and execution on external CI platforms.

## Findings and status

| ID | Class | Severity | Status | Corrective area |
| --- | --- | --- | --- | --- |
| SAF-01 | Gatekeeper | High | Fixed | Provenance-owned uninstall and exact purge roster |
| SAF-02 | Gatekeeper | High | Fixed | Traversal and symlink preflight before managed writes |
| SAF-03 | Guard-rail | Medium | Fixed | Unsafe provenance fails closed |
| SAF-04 | Gatekeeper | Medium | Fixed | Evidence parser requires complete structural detail |
| SAF-05 | Guard-rail | Medium | Fixed | Scoped install-intent reconciliation |
| SAF-06 | Guard-rail | Medium | Fixed | Documentation and example proof claims corrected |
| SAF-07 | Guard-rail | Low | Fixed | Packed certification disposes extraction roots |
| SAF-08 | Guard-rail | Medium | Fixed | Exhaustive report no longer claims separate gates ran |
| SAF-09 | Guard-rail | Medium | Fixed | Runtime dependency and static bundle import sensors |

No P0 finding was confirmed.

## Claim-to-proof summary

| Claim | Current proof | Remaining boundary |
| --- | --- | --- |
| Local-first/no telemetry | Network-denied packed commands and source inspection | Explicit update opt-in was not exercised against the registry |
| Zero runtime dependencies | Bundle scan, license gate, pack inspection and mutations | Build and release supply chain remain separate risks |
| Provider-neutral core | Generic contracts and edge target mapping | Live provider hosts were not run locally |
| Evidence before done | Structural parser, graph status and malformed-report exit 1 | Semantic truth of a claimed command remains external |
| Reversible targeted setup | Plan/apply, provenance, intent reconciliation and preservation tests | Crash injection remains untested |
| Deterministic CLI | Machine contracts, certification and matrices; dist/packed matrices now run in platform CI jobs | Results still depend on the remote CI run |

## Missing sensors

Provider-specific Markdown assumptions, semantic evidence lies, crash recovery during applying state, platform PTY/path/line-ending behavior, concurrent symlink races, published-artifact integrity, release rerun failures, and large-repository performance still need dedicated sensors.

## Prioritized roadmap

P0: none. P1: retain SAF-01, SAF-02 and SAF-04 in release gates. P2: crash-recovery tests, provider-neutrality mutation tests, semantic evidence ownership, review platform-CI results, and immutable Action references. P3: performance benchmarks and formal state-machine modeling when a concrete need appears.

## Reproduction

Run npm run check, npm run cli:exhaustive, npm run cli:certify, npm run cli:certify:packed, npm run cli:full-matrix:dist, npm run cli:full-matrix:packed, npm run cli:brand-motion:dist, npm run cli:brand-motion:packed, and npm run sanitize.

See the local audit directory for the optimized prompt, implementation plan, probes, packed-artifact evidence, and detailed verification ledger.