docs(audits): Pass-7 adversarial audit of the #77-#140 wave + spec truth-up

[Reederey87]

Pass 7 — seventh design & implementation audit

First adversarial audit of the #77–#140 wave (no prior audit checkpoint): the OS agent
sandbox (P4-GIT-03, #107–#129), the AD-1 zero-infra carrier hub (#96–#106), the
supply-chain/distribution pipeline (#105–#120), and the multi-device env/trust/service wave
(#131–#139). Trunk audited: d667530 (#140).

Method

Verification-driven nine-dimension workflow (9 dimension reviewers → per-finding adversarial
verification), mirroring Pass 6. The three P1 candidates were additionally cross-verified by a
second model family (gpt-5.5 via Codex) — the project's dual-review norm applied to the audit
itself. 22 candidates → 21 confirmed (P1=3, P2=11, P3=7), 1 refuted. Two severity corrections at
verification (P7-SANDBOX-01 P2→P1, P7-SUPPLY-01 P1→P3).

Headline findings (open — for the Phase-B implementation wave)

• P7-SANDBOX-01 (P1) — the default-on Seatbelt/bwrap/Landlock sandbox grants writes only to the
  worktree+tmp dirs, but a DevStrap agent worktree is a git linked worktree whose .git lives in
  the parent clone → agent git commit EPERMs and agent pr has nothing to push. The core loop
  silently breaks on the common Mac dev host, and the only e2e canary uses a fresh nested repo so it's
  untested. Reproduced against a real linked worktree by both model families.
• P7-DATA-01 (P1) — the revoke-triggered env-blob rewrap is the one env-profile writer that skips
  the EnvProfileSourceCoords/envCoordLess CAS guard the other two writers apply → a concurrent
  newer profile is clobbered with stale content.
• P7-SEC-01 (P1) — the snapshot carries no device-trust state, so a device.revoked compacted
  below the retention floor is lost on recovery → the stale-approved recovering replica re-grants the
  fresh WCK epoch to the revoked device (defeats TRUST-01 forward-secrecy-on-revoke).
• P2/P3: no rewrap-on-approve (P7-SYNC-02), stranded blobs on transient GET (P7-SYNC-01),
  folder-carrier torn writes + non-atomic stale-lock break (P7-HUB-01/02), service exec-path
  validation / Cellar-symlink path / global label (P7-CLI-01/P7-SVC-01/02), .snowflake deny-set
  drift (P7-SANDBOX-02), property-gen coverage (P7-SYNC-03), and the curl|sh cosign gap
  (P7-SUPPLY-01).

What's in this PR

• docs/audits/AUDIT_RECOMMENDATIONS_2026-07-07_PASS7.md — the full audit (exec summary,
  at-a-glance table, prioritized roadmap, per-finding detail with file:line evidence + verifier
  rulings, exa anchors, Appendix A/B).
• docs/audits/README.md — Pass-7 index row + "17 open of 21" open table (header count == rows) +
  dated note. (The ledger was already current through docs: unattended-operation wave close-out (PRs #136–#139) #140; Pass 7 adds only its own rows.)
• Doc truth-up — the four confirmed P7-DOC-* findings, fixed here: ARCHITECTURE.md, spec/00,
  and docs/quickstart.md re-synced to the shipped OS sandbox + service installers.
• spec/18_WORK_LOG.md — newest-first entry.

Gates

• spec-drift passed (20 specs, 6 changed files); TestEveryCommandIsDocumented +
  TestMigrationsDocumented pass; ledger header-count invariant holds (17 rows).
• Docs-only PR (no Go source changed) → single-reviewer per the PR-cycle convention.

🤖 Generated with Claude Code