chore: publish Halborn security audit reports

[Infra1515]

What

Publishes the three Halborn security audit reports in a new audits/ directory:

Report	Findings	Outcome
Consensus Protocol	5 (1 critical, 3 medium, 1 low)	all solved
Network Node	22 (1 critical, 2 high, 7 medium, 6 low, 6 info)	20 solved, 2 low risk-accepted
Smart Contracts	15 (1 critical, 2 high, 7 medium, 2 low, 3 info)	14 solved, 1 medium risk-accepted

Adds audits/README.md with the summary table and a provenance note, plus a "Security Audits" section in the main README linking to the directory.

Notes for reviewers

• Pre-publication references: the reports cite remediation evidence as commit/PR links into the pre-publication repository history, which was squashed at open-sourcing — those links do not resolve here. The audits README states this explicitly and confirms all verified remediations are included in the initial public commit. The PDFs are published exactly as issued by Halborn (unmodified).
• Sensitivity review done: all 174 pages were reviewed before publishing — no confidentiality/NDA clauses, no secrets, no internal infrastructure, no personal data.
• Conscious disclosure: the three risk-accepted findings (slash-evasion via undelegation front-running — Medium, by design with unbonding-delay rationale; committee-seed entropy — Low; slashing disabled during pilot — Low) describe live behavior and are disclosed with the team's accepted-risk rationale, as is standard for published audits.
• Fixes referenced by the solved findings were spot-checked to be present in the public tree.

[github-actions]

Claude finished @Infra1515's task in 1m 6s —— View job

---

PR Review: chore/publish Halborn security audit reports

• Gather context and read changed files
• Review README.md changes
• Review audits/README.md
• Check PDF files integrity/naming
• Provide final review feedback

---

Summary

This is a clean, documentation-only PR that publishes three Halborn security audit reports. No code changes are involved. Overall the content is well-structured and accurate.

---

README.md — +6/-0

The "Security Audits" section is placed appropriately between "Example RPC request" and "Acknowledgements", making it discoverable without scrolling to the end. The blurb is concise and correctly points to ./audits/.

Minor nit: the link text [audits/](./audits/) renders with a trailing slash as the visible text. A phrasing like [the audits/ directory](./audits/) or simply [audits/](./audits/) might read a bit more naturally, but this is purely cosmetic.

---

audits/README.md

• The summary table is accurate — finding counts across all three reports add up correctly:
  • Consensus Protocol: 1+3+1 = 5 ✓
  • Network Node: 1+2+7+6+6 = 22 ✓
  • Smart Contracts: 1+2+7+2+3 = 15 ✓
• The scope descriptions are specific and match the report titles.
• The engagement date ranges are precise and lend credibility.
• The note about squashed pre-publication history and unresolvable commit/PR links is clear and accurately sets expectations for readers. This is important context that prevents confusion.
• The statement that PDFs are unmodified is good to have explicitly.

---

PDF files

File naming follows a consistent convention: halborn-YYYY-MM-{scope}.pdf. Clear and future-proof.

Repository size consideration: Each PDF is ~12–14 MB (~40 MB total added to git history). Committing large binaries directly is common practice for audit documents but worth noting — if the repository grows and large-file handling becomes a concern, Git LFS would be the standard path. Not a blocker for this PR.

---

Overall

The PR description is thorough — the sensitivity review disclosure, the risk-accepted findings rationale, and the spot-check of remediation evidence in the public tree are all good practices for a public audit release. No issues found.

LGTM — ready to merge.

[github-actions]

Security Scan - Code

Severity: HIGH, CRITICAL

No vulnerabilities found

View scan results

Report Summary

┌─────────────────────────────────────────────┬────────────┬─────────────────┬───────────────────┐
│                   Target                    │    Type    │ Vulnerabilities │ Misconfigurations │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ Cargo.lock                                  │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ crates/testing/fuzz-targets/Cargo.lock      │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ crates/testing/fuzz-targets/fuzz/Cargo.lock │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/state-sum/Cargo.lock                    │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/tps/package-lock.json                   │    npm     │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ rayls-contracts/package-lock.json           │    npm     │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/chaos-network/Dockerfile                │ dockerfile │        -        │         0         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/docker-network/Dockerfile               │ dockerfile │        -        │         0         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/docker-replay/Dockerfile                │ dockerfile │        -        │         0         │
└─────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

[github-actions]

Security Scan - Code

Severity: HIGH, CRITICAL

No vulnerabilities found

View scan results

Report Summary

┌─────────────────────────────────────────────┬────────────┬─────────────────┬───────────────────┐
│                   Target                    │    Type    │ Vulnerabilities │ Misconfigurations │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ Cargo.lock                                  │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ crates/testing/fuzz-targets/Cargo.lock      │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ crates/testing/fuzz-targets/fuzz/Cargo.lock │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/state-sum/Cargo.lock                    │   cargo    │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/tps/package-lock.json                   │    npm     │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ rayls-contracts/package-lock.json           │    npm     │        0        │         -         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/chaos-network/Dockerfile                │ dockerfile │        -        │         0         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/docker-network/Dockerfile               │ dockerfile │        -        │         0         │
├─────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ etc/docker-replay/Dockerfile                │ dockerfile │        -        │         0         │
└─────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

[github-actions]

Claude finished @Infra1515's task in 1m 6s —— View job

---

PR Review: chore/publish Halborn security audit reports

• Gather context and read changed files
• Check CLAUDE.md for repo guidelines (none present)
• Review README.md changes
• Review audits/README.md
• Provide final review feedback

---

Summary

Documentation-only PR adding three Halborn security audit PDFs and supporting README content. No code changes. The latest commit (4178a56) is a merge of main into the PR branch — no new content changes since the prior review.

---

README.md — +6/-0

Placement between "Example RPC request" and "Acknowledgements" is appropriate. The blurb is accurate and concise.

Minor nit (cosmetic only): [audits/](./audits/) renders the trailing slash as visible link text. [audits directory](./audits/) or [`audits/`](./audits/) reads slightly more naturally, but this is not a blocker.

---

audits/README.md — +24/-0

• Finding counts verified:
  • Consensus Protocol: 1 + 3 + 1 = 5 ✓
  • Network Node: 1 + 2 + 7 + 6 + 6 = 22 ✓
  • Smart Contracts: 1 + 2 + 7 + 2 + 3 = 15 ✓
• Outcome column accurately reflects the three risk-accepted findings described in the PR body.
• The squashed-history provenance note (audits/README.md:13–22) is clear and prevents reader confusion about unresolvable links.
• Explicit statement that PDFs are unmodified is good transparency.

---

PDF files

Three binary files (~40 MB total) committed directly. Consistent naming convention: halborn-YYYY-MM-{scope}.pdf. Git LFS is the standard path if binary storage becomes a concern, but it's not warranted for three audit documents.

---

Overall

This is a clean, well-documented audit publication. Security scan shows no vulnerabilities, all finding counts check out, and the provenance disclaimer is accurate. No issues found.

LGTM — ready to merge.