docs(security): falsify the remediation independently (Session 7)

[ojassug]

Closes §9.1 item 3 of docs/security-review-2026-08-30.md.

The fourteen fixes in 66a3171..58538b8 (9 files, 515 insertions) were all written by one agent, and §11's falsification pass was written by the same one. This is the pass by an agent that did not write them, run against a build of 58538b8 on Windows/Node 26 and WSL2 Ubuntu/Node 22 on real ext4 — three of the fixes in that surface are POSIX-only. Every §11 confirmation was treated as unverified and re-run.

Report only. Nothing under src/ is modified: the protocol is read-only, and the agent that fixes these should not be the one that found them.

Eleven fixes hold

• V-01 / V-03 survived a 50,000-case differential fuzz against JSON.parse — 44,419 accepted bodies, 0 divergences — with randomly \uXXXX-escaped keys, duplicated members and shuffled order.
• §6.3 SSRF guard refused all 43 URLs tried, including decimal, hex, octal, trailing-dot, both bracketed IPv4-mapped forms, userinfo and fragment tricks.
• F-04 measured 600 on ext4 on create and after overwriting files left at 0644 and 0666.
• OX-L8 reproduced its own comment's figure to the byte — 146,176 of 1,024,001 truncated on Linux, complete on Windows — with Ctrl+C latency 7 ms normally and 2,013 ms against a stalled reader.
• F-02, F-01, V-02, F-03, F-07 and F-06 on the route it patches: confirmed.

Four new findings, all Low, all reproduced end to end

• S-01 — the F-01-residual credential hoist is falsified. The guard is conditioned on isApiRoute, but getOrCreateSession runs for every path. A no-cors GET carries no Origin header, so V-02's gate never sees it. Driven with a real browser from a foreign origin: 400 requests → 400 distinct connections → 0 carrying Origin → sessionCount 100, and a seeded victim session plus its stored content evicted. That is §10.2's chain, step for step, after the fix. The test asserting the property exercises one route and is titled for all of them.
• S-02 — F-06's label escaping is bypassed on the fallback route. renderFallbackBytes builds the same ==> path <== header from the raw path. Same directory, two runs on ext4: 3 headers on the success path, 4 on the fallback path, the extra one naming a file that does not exist. The README sentence mitigating F-07 is false there.
• S-03 — F-05 is incomplete on its own field. V8's JSON.parse message is forwarded verbatim and quotes ~15 bytes of the payload into trace.fallbackReason.
• S-04 — the §6.3 guard stops at the first hop. fetch sets no redirect; undici strips authorization cross-origin but not x-api-key. A stub provider's 302 delivered an Anthropic key to a stand-in metadata listener, whose body the gateway relayed back as a 200.

Two downgrades

• D-1 — F-03's "no realistic invocation does it": a sibling-repo bundle (optimize repoA repoB, the documented multi-path form) ships the second repository's git-ignored files with no warning. Measured.
• D-2 — §11.2's "no remaining special case to slip through": an empty Origin value is still exempt. The conclusion survives — no browser sends one — but the sentence overstates what was measured.

One hypothesis failed and is recorded as a negative: F-03's new execFileSync('git', …) does not open a Windows cwd-hijack. A planted git.exe never ran, with the hostile directory as the child's cwd and again as the parent's.

Verification

• npm run build clean at 58538b8.
• test/unit/security-review-findings.test.ts — 48 passed / 2 skipped.
• Gateway + integration — 15 files, 119 passed.
• All three run before any probe was written, so the four findings are gaps in what the suite asserts, not regressions.

🤖 Generated with Claude Code