Skip to content

Harden V2 qualification gates and repair M6 invariant coverage - #50

Merged
mAsyamJ merged 4 commits into
mainfrom
security/v2-audit-hardening-20261106
Nov 7, 2026
Merged

mAsyamJ merged 4 commits into
mainfrom
security/v2-audit-hardening-20261106

Conversation

@mAsyamJ

@mAsyamJ mAsyamJ commented Nov 6, 2026 •

Copy link
Copy Markdown
Contributor

The prior V2 workflow failed validation before jobs began. This draft fixes evidence initialization and enforces structured positive test counts, required nonempty suites and zero failures/skips. A hosted run then exposed Foundry 1.8.4 grouping four invariant predicates into two records: the parser now validates/counts predicates without lowering the minimum. Raw failed-run artifacts are preserved.

Repairs two experimental M6 coverage defects: Q6 donation previously sent native currency, and replay previously used an unsupported asset. Both Q6 regressions fail before and pass after. Separates pristine unit fixture from seeded invariant fixture, preserving all 13 original unit test bodies.

Validation: 12 parser regressions pass; 17 M6 unit/regression tests pass with 10,000 fuzz cases; final native/Q6 model campaign passes 256x128 across seeds 0x6a/0x6b/0x6c (196,608 handler calls, zero outer reverts). Formatting and frozen archive checks pass. Ten project-local skills installed with pinned revisions/licenses/hashes. Bounded Slither scan recorded 18 findings with source dispositions; no full-audit claim.

PARTIAL campaign. Latest hosted CI must complete on this head. The earlier run's financial outputs all succeeded, but its reporting gate failed; replaying artifacts is not a fresh hosted PASS. Two-launch coverage, expanded genuine-v4 lifecycle, Safe/fork, compiler risk, complete static review and gas optimization remain pending. Initial parser/handler fixes were independently reviewed; later grouped-parser/fixture changes still require separate review after agent quota became unavailable.

Canonical financial contracts, frozen judging source, deployment manifests and economics are unchanged. No deployment, broadcast, merge or M6 promotion. See iteration007 STATE.json, qualification report and scoped evidence.

@vercel

vercel Bot commented Nov 6, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
retropick-metropolis-retro-ui-staging Ready Ready Preview Nov 6, 2026 2:27pm UTC

@mAsyamJ mAsyamJ changed the title Harden V2 qualification gates and pin reviewed audit skills Harden V2 qualification gates and repair M6 invariant coverage Nov 6, 2026
@mAsyamJ
mAsyamJ marked this pull request as ready for review November 7, 2026 07:21
@mAsyamJ
mAsyamJ merged commit 8f09f89 into main Nov 7, 2026
3 of 4 checks passed

This branch was successfully deployed

1 active deployment
Preview — b192257d Deployed Nov 6, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant