philipp.baumann/dse-security-reports
Watch
0
0
Fork
You've already forked dse-security-reports
 0
Code Issues 1 Pull requests Releases Activity

docs(triage): state the library state ladder, the WireGuard role and the report date #27

Merged
Philipp Baumann merged 2 commits from fm/dse-security-reports-state-ladder into main 2026-10-28 12:35:10 +00:00
Conversation 0 Commits 2 Files changed 4 +57 -9
Philipp Baumann commented 2026-10-28 12:33:50 +00:00
Owner
Copy link

Summary

The 28.10.2026 reversal turned on the report using the single word "installiert" for at least six materially different library states, and on role statements broader than their evidence. This PR states the six-rung state ladder explicitly with what proves each rung, replaces the WireGuard unit's software-presence description with its read-only-verified network role, narrows one overbroad claim to the four libraries actually measured, and records a report date that is deliberately a separate fact from the data snapshot date.

What changed

  • reports/defender-triage.typ — adds the subsection "Zustandsleiter einer Bibliothek (sechs Evidenzstufen)" beside the verified per-package findings: a table of the six rungs (nur im Index, Cache, eingebettet, installiert/inaktiv, Live-Umgebung, geladen) with the proof for each, the two honest limits (a loaded set is a snapshot because Python imports lazily; loaded is not exploited), the discipline that follows (never promote "installiert" to "in Verwendung", never demote it to "abwesend" -- both mistakes happened in this report on 28.10), and the mapping of the carried findings onto the rungs: pyjwt 2.13.0 on QMS is a Live-Umgebung, not "geladen", and the text states that geladen was not measured; pyjwt 2.12.1 in the five test bundles and python3-jwt 2.4.0 from the Alma distro package are installiert, inaktiv; pyjwt 2.10.1 on DEV-MISC remains nur im Index. Also rewrites the WireGuard paragraph: the verified role (tunnel terminator on UDP 51820, DNS resolver for 10.15.5.0/24, dnsmasq the only listener on that address, the tunnel carrying the whole range, a chokepoint for the subnet) instead of "Tunnel-Terminator und Resolver-Software" software presence, and narrows "Applikations-Software traegt er nicht" to the measured fact that pyjwt, anyio, h11 and pillow have zero hits in this unit's evidence cache. The kernel-exposure sentence carries the same verified role.
  • reports/defender-findings.typ — header and document title only: reads the committed report date and renders "Berichtsstand - Datenstand (Evidenz) " like the triage report; no content change.
  • config/report-date.json — new committed value (reportDate: 2026-10-28): the recorded, reviewable source for the Berichtsstand, deliberately bumped each round; it is never read from the render clock, so both PDFs stay byte-identical, and the evidence Datenstand stays its own separate fact rendered alongside.
  • AGENTS.md — one sentence recording the report-date source and its separation from the snapshot date.

Behaviour change

Text and dates only; no derivation lane touched, no new or changed figures (every number already existed in the derived data or the verification round). Both reports now open with "Berichtsstand 28.10.2026 - Datenstand (Evidenz) 27.10.2026", the triage report states the state ladder and its discipline, and the WireGuard unit is described by its verified network role rather than an inferred general negative. just all, just repro (byte-identical PDFs), just test (39 passed) and just lint verified on the fixture lane; the real 2026-10-28 round re-rendered from the restored caches.

Instructions-PR: none

## Summary The 28.10.2026 reversal turned on the report using the single word "installiert" for at least six materially different library states, and on role statements broader than their evidence. This PR states the six-rung state ladder explicitly with what proves each rung, replaces the WireGuard unit's software-presence description with its read-only-verified network role, narrows one overbroad claim to the four libraries actually measured, and records a report date that is deliberately a separate fact from the data snapshot date. ## What changed - `reports/defender-triage.typ` — adds the subsection "Zustandsleiter einer Bibliothek (sechs Evidenzstufen)" beside the verified per-package findings: a table of the six rungs (nur im Index, Cache, eingebettet, installiert/inaktiv, Live-Umgebung, geladen) with the proof for each, the two honest limits (a loaded set is a snapshot because Python imports lazily; loaded is not exploited), the discipline that follows (never promote "installiert" to "in Verwendung", never demote it to "abwesend" -- both mistakes happened in this report on 28.10), and the mapping of the carried findings onto the rungs: pyjwt 2.13.0 on QMS is a Live-Umgebung, not "geladen", and the text states that geladen was not measured; pyjwt 2.12.1 in the five test bundles and python3-jwt 2.4.0 from the Alma distro package are installiert, inaktiv; pyjwt 2.10.1 on DEV-MISC remains nur im Index. Also rewrites the WireGuard paragraph: the verified role (tunnel terminator on UDP 51820, DNS resolver for 10.15.5.0/24, dnsmasq the only listener on that address, the tunnel carrying the whole range, a chokepoint for the subnet) instead of "Tunnel-Terminator und Resolver-Software" software presence, and narrows "Applikations-Software traegt er nicht" to the measured fact that pyjwt, anyio, h11 and pillow have zero hits in this unit's evidence cache. The kernel-exposure sentence carries the same verified role. - `reports/defender-findings.typ` — header and document title only: reads the committed report date and renders "Berichtsstand <date> - Datenstand (Evidenz) <snapshot>" like the triage report; no content change. - `config/report-date.json` — new committed value (reportDate: 2026-10-28): the recorded, reviewable source for the Berichtsstand, deliberately bumped each round; it is never read from the render clock, so both PDFs stay byte-identical, and the evidence Datenstand stays its own separate fact rendered alongside. - `AGENTS.md` — one sentence recording the report-date source and its separation from the snapshot date. ## Behaviour change Text and dates only; no derivation lane touched, no new or changed figures (every number already existed in the derived data or the verification round). Both reports now open with "Berichtsstand 28.10.2026 - Datenstand (Evidenz) 27.10.2026", the triage report states the state ladder and its discipline, and the WireGuard unit is described by its verified network role rather than an inferred general negative. `just all`, `just repro` (byte-identical PDFs), `just test` (39 passed) and `just lint` verified on the fixture lane; the real 2026-10-28 round re-rendered from the restored caches. Instructions-PR: none 
- Add the six-rung library state ladder (nur im Index ... geladen) as a
  table with what proves each rung, the two honest limits (a loaded set is
  a snapshot because Python imports lazily; loaded is not exploited) and
  the discipline that follows: never promote installiert to in Verwendung
  and never demote it to abwesend -- both mistakes happened in this
  report on 28.10.2026.
- Map the carried findings onto the rungs: pyjwt 2.13.0 on QMS is a
  Live-Umgebung, not geladen, and the text states that geladen was not
  measured; pyjwt 2.12.1 in the test bundles and python3-jwt 2.4.0 from
  the Alma distro package are installiert, inaktiv; pyjwt 2.10.1 on
  DEV-MISC remains nur im Index.
- State the WireGuard unit's verified network role (tunnel terminator on
  UDP 51820, DNS resolver for 10.15.5.0/24 and only listener on that
  address, the tunnel carrying the whole range) instead of software
  presence, and narrow the overbroad claim that it carries no
  application software to the measured four libraries with zero hits.
- Introduce a committed report date (config/report-date.json) that both
  reports read: Berichtsstand 28.10.2026 leading, with the evidence
  Datenstand 27.10.2026 kept as its own fact; the value is committed per
  round and never read from the render clock, so the PDFs stay
  byte-identical.
Philipp Baumann deleted branch fm/dse-security-reports-state-ladder 2026-10-28 12:35:10 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
philipp.baumann/dse-security-reports!27
No description provided.