# SAF technical audit — 2026-10-10

This report summarizes the repository-grounded audit of v8.1.2 and the remediation shipped in
v8.2.0. Detailed probes and the per-finding ledger remain maintainer-local audit evidence.

## Scope and method

The audit covered the CLI source, tests and coverage, CI and release workflows, supply chain,
the 12 skills and shared references, documentation, internationalization, and governance files.
Each hypothesis was confirmed or refuted by targeted reading or by a reproduction in a disposable
sandbox with an isolated home directory. No publish, push, tag, or remote mutation was performed.

## Findings and status

| ID | Severity | Status | Area |
| --- | --- | --- | --- |
| AUD-01 | P0 | Fixed | Release workflow accepted any successful CI run on a branch named `main`, including fork pull requests |
| AUD-02 | P1 | Fixed | Release job ran dependency lifecycle scripts, an unpinned npm CLI, and tag-pinned Actions |
| AUD-03 | P1 | Fixed | Clean upgrade failed with `EXDEV` when the temporary directory was another filesystem |
| AUD-04 | P2 | Fixed | Expected state refusals (missing Git, interrupted apply, unsafe provenance) exited 2 instead of 1 |
| AUD-05 | P2 | Fixed | Low in-process coverage for doctor, uninstall, and init defaults; no coverage floor |
| AUD-06 | P2 | Fixed | The CLI entrypoint held command logic instead of routing |
| AUD-07 | P2 | Fixed | Output helpers were duplicated across five modules |
| AUD-08 | P2 | Fixed | User state files were written without an atomic replace |
| AUD-09 | P2 | Fixed | Git and npm subprocesses had no timeout |
| AUD-10 | P2 | Fixed | Provider-neutrality and shared-reference guards covered only part of the bundle |
| AUD-11 | P2 | Fixed | The maintainer source layout listed 19 of 49 modules |
| AUD-14 | P3 | Fixed | Dense skill prose and repeated autonomy text |
| AUD-15 | P3 | Fixed | Published files referenced maintainer-local paths |
| AUD-16 | P3 | Fixed | Portuguese guides lagged the English sources |
| AUD-18 | P3 | Fixed | The package shipped repository-only governance files |
| AUD-24 | P3 | Refuted | Install apply re-validates managed destinations at apply time |

The audit also found and fixed three defects outside the original hypotheses: the rich purge plan
suggested a rejected `--apply` flag, documented `--preset` aliases were not accepted, and a fresh
repository without commits reported `main` instead of its unborn branch.

## Claim-to-proof summary

| Claim | Proof |
| --- | --- |
| Release runs only for trusted pushes | `test/workflow-policy.test.ts` fails on the v8.1.2 workflows |
| Clean upgrade survives cross-device moves | `test/clean-upgrade.test.ts` injects `EXDEV` and verifies rollback |
| Handled refusals exit 1 | `test/cli-grammar.test.ts` black-box state-refusal cases |
| Every source module is documented | `npm run docs:check` architecture layout rule |

## Remaining boundaries

External host certification, monetary cost measurement, semantic evidence ownership, crash
injection for every apply path, and performance benchmarks remain outside this release. Doctor
still resolves agent skill directories from the process home directory even when a home override
is passed; the tests isolate it, and it is recorded for a future release.

## Reproduction

Run `npm run check`, `npm run release:check`, and `npm run sanitize`.