Record the #40 disposition for replacement candidate cd10a3f: SHIP

[BunsDev]

Part of #40. This updates docs/workflows/first-release-security-review.md with the review of replacement candidate cd10a3f and a fresh disposition.

Disposition: SHIP (recommended) for cd10a3fa1d9900e0dbcb04bbb2477140854fba1d.

Evidence

• Packed bytes. Packed twice from fresh clones with identical output, and matching the lock and Chat's vendored archives. All four packages are private, with no lifecycle scripts.
• Fixes present in the packed cave-client dist/: F4 (fix(cave): retain observed discovery authority #277 latch), F5 (fix(cave): redact protected fetch error causes #285 cause redaction) and F1 (fix(cave): stop advising retry on timed-out single-use pairing exchange #294).
• Conformance. The aggregate in Commit the accepted SDK #38 aggregate for replacement candidate cd10a3f #325 comes from run 36222464391 (producer 399e1f19, validator 67fd5d8a). It was verified live, and strict readiness passes.
• Automated checks at cd10a3f:
  • verify on Node 24.18.1 and 24.x;
  • native keyring on all three OSes;
  • CodeQL;
  • pnpm audit, with no known vulnerabilities;
  • SHA-pinned actions, and no token fallback in release.yml;
  • the secret scan.
• Independent manual review. Static review of the release-package runtime diff aec069089..cd10a3f (feat(coven): add bounded Automation event subscriptions #300, feat(cave): preserve managed HPKE iterator authority #301, feat(coven): verify local Automation receipt integrity #304, feat(coven): add bounded Automation digest and projection helpers #305, build(deps): bump canonicalize from 5.0.0 to 5.1.0 #308). It found no Critical, High or Medium issue.

Findings

• R1 (Low). The managed familiarContract and familiarAnalytics bypass the JS downgrade guard and iterator pin. This is confirmed at cave/src/managed.ts:144-145. The exposure depends on the host, which owns discovery and the bearer in managed mode.
  • Accepted by the release owner on 2026-09-26.
  • Follow-up due 2026-10-24: route both reads through the resolver, or record the host guarantee.
• I1–I3 (Informational), accepted:
  • the managed latch is per client instance;
  • the HPKE proof is asserted by the host;
  • an abandoned event iterator keeps one abort listener.
• F3 carries forward, with this cycle's two local timeout recurrences noted.

Scope of the decision

This does not authorize publication. publishingEnabled stays false and the packages stay private. Publication remains with #41, which needs its own fresh authorization, the protected approval chain, npm trusted-publisher confirmation and registry byte/provenance checks. The previous candidate 96804bc4 stays blocked, and its record is kept as history.

Docs only.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Add exact verification evidence, reconcile current-status documentation, and correct the lifecycle-script wording.

Review effort: Lite
Findings: 1

Open (1)

• Correct inaccurate lifecycle enforcement evidence statement · New

What changed in this PR

Updates the first-release security record with a recommended SHIP disposition for candidate cd10a3f, while keeping publication separately gated.

Changes:

• Records packaging, conformance, automated-check, and manual-review evidence.
• Documents accepted findings and follow-up dates.
• Preserves publication gating through #41 and the history of candidate 96804bc4.

File	Summary
docs/​workflows/​first-release-security-review.md	Records the replacement candidate’s security review and SHIP disposition.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.