Audit date: 2026-10-25. This is a delivery snapshot, not an assessment of any runtime, customer, website or production deployment. Recheck GitHub before using these commits as current-state evidence.
Updated 2026-10-26 UTC. This section supersedes the remaining-work statements in the earlier delivery snapshots below. The original twelve-issue campaign is implemented, and the subsequent CSV provenance audit #25 is addressed.
- PR #24 provisions explicit GitHub OIDC/Sigstore publication, expiring envelopes and durable sequence/clock checks. PR #26 fixes a real CLI flag incompatibility and adds verification before publication. The production trust/recovery policy pins the company's numeric repository/owner IDs and exact main workflow, using independent Sigstore roots. This adopts existing repository-admin authority. It does not claim separately provisioned 2-of-3 offline custodians; operator-managed TUF remains an alternative.
- Real releases 1001, 2001, 3001 and 4001 were independently authenticated. After 2001
was accepted, authentic 1001 failed rollback checks. Tampered bytes, wrong
numeric publisher and an authentic artifact at expiry were rejected without
changing accepted output/state. Release 4001
was published by the updated self-verifying workflow; its
publisher run passed.
Source commit:
ad1ac3bfea1c90cdb022c9543c1ebb7596c56675. Artifact SHA-256:0914a3272186874721119c58aed01a441b2a1f447aced867d5bdbd861931a1f1. - PR #27 addresses #25 with report schema 1.1: all formats carry exact executable identity and completeness; empty CSV reports carry an explicit summary. Existing observation columns, timestamps, rule dates and inventory schema are preserved. The classifier version stays 1.0.0 for the released converter's named-profile compatibility; retain original reports for top-level provenance that the older converter does not project. Actual conversion was verified.
- Final local validation runs 78 stdlib tests and 13 optional TUF tests. Copilot reviewed the substantive trust feature and its stale-run remediation. Its monthly quota then exhausted; the CLI compatibility and CSV follow-ups received manual review, real-release probes where applicable and cross-platform CI. No Copilot review is claimed for those follow-ups. Each PR records exact-head checks, and issue completion receipts record actual merge-commit checks.
Published envelopes expire after 30 days; further publication is an explicit maintainer decision, with no new recurring schedule. Signature verification never installs rules automatically or establishes advisory accuracy, runtime patches or exploitability. Existing embedded rules remain usable offline. Production publication/verification is distinct from a production target scan; no targets were scanned. Current issue states and newest build receipts should always be read back from GitHub rather than inferred from historical tables.
Delivery receipt updated 2026-10-26 UTC (October 25 in America/New_York). The initial 48-repository audit below is historical. Its missing-adapter and missing-repository statements are superseded by this delivery section. Two new optional support repositories bring the current family inventory to 50.
Implemented and merged with GitHub Copilot review and passing hosted checks:
- All 17 edge checkers' actual CSV/configuration paths are reconciled in the edge matrix. Fifteen separate metadata PRs add dated KEV fields; the two initial NetScaler tools already had dated threat metadata. The full pinned CISA catalog digest, CVE presence/absence and listing dates were checked independently. No threshold changes or target scans were made.
- The Node matrix maps all 21 named July/October CVEs to separate checkers. Optional Node metadata reports builtin capability shape and npm engine declarations; neither establishes application use, reachability, installed runtime identity or advisory exposure.
- Sharp adds npm/SBOM metadata, bounded ELF observations and lexical SVG/source mitigation candidates. Namespaced SBOM packages cannot impersonate unscoped packages. vm2 and simple-git add bounded dependency/source candidates, with line-ending and arrow-regex corrections. These are syntax hints, not taint analysis or proof of runtime behavior.
- CopyEscape adds Docker export observations and bounded shell/YAML copy-command candidates. Unsupported syntax emits unresolved coverage. Export input-slot identities do not encode absolute paths; argument order matters for comparison.
- Atlassian adds explicit local version files, evidence confidence and input
ordinals. Files are independent observations; conflicts within a file remain
unknown. Flowise adds allowlisted deployment/owner/package metadata and
independent instance grouping. Unverified deployment exports remain unknown,
including affected-range versions;
--fail-on-findingdoes not flag unknowns. - OCI inventory parses bounded local archives/SBOMs without extraction or execution, preserving provenance and incomplete coverage. Its consumer profiles use actual checker input contracts and retain unverified build provenance. Docker config identity does not authenticate supplied layers or attest a running image.
- Result bridge converts explicit versioned canonical/legacy reports to SARIF/NDJSON, retaining unknown/not_tested, completion, conflicts and observation counts. Relative source paths require opt-in; privacy hashes remain linkable and guessable.
- Optional offline TUF verification is merged in PR #21. Real synthetic signatures test expiry, rotation/revocation, rollback and protected output separately from the standalone core. This authenticates a local artifact for subsequent review/release preparation; it does not install rules automatically or provision a hosted feed.
Remaining: #13 requires production publisher custody, an independently distributed public trust root and an authenticated release/feed channel with recovery ownership. The recommendation is an offline Ed25519 2-of-3 root with separate release-role keys. No production keys or feed are provisioned. Keep the parent #2 open for that work. Other child implementation scopes are fulfilled by the merged work and matrices; this documentation does not assert production deployment or assessment.
Local suites on the final implementations: Node2Shell/metadata 65, optional TUF 13, Sharp 73, vm2 31, simple-git 32, CopyEscape 78, Atlassian 58, Flowise 70, OCI 19 and bridge 13. Platform skips are reported by each suite. The two initial NetScaler suites also pass locally (52 and 64). All 15 KEV-update suites passed locally with 40–72 cases each. Bridge output passed five variants against the vendored official OASIS SARIF schema. No real targets were assessed.
Copilot's hosted findings and independent CLI reviews informed fixes. The hosted review quota was exhausted during final revisions; completed Copilot CLI reviews provided the remaining review receipts. Review scope is recorded in each PR; reviewers did not execute tests. Local checks, exact-head hosted checks, actual merge-commit checks and production trust are separate evidence.
Every job below completed successfully on the listed default-branch commit, not only on its pre-merge PR head. Node2Shell has six core and six optional TUF jobs; each other listed repository has six Linux/Windows/macOS jobs.
All 48 repositories visible in the completetech-security organization were
inventoried through authenticated GitHub metadata. Each had a successful hosted
workflow on its exact default-branch commit below, and none had an open PR.
The 12 open issues were all in this reference repository. A successful workflow
is evidence about that revision's configured checks; it does not prove every
roadmap requirement, independent review, exploitability or production readiness.
Fresh local Python 3.14 checks: Node2Shell ran 61 tests successfully; Atlassian ran 53 with one skip; Flowise ran 65 with two skips. Those two family checkers were checked out separately at the commits listed below. Other family test suites were not rerun locally during this audit. Tests used synthetic inputs.
Completed implementation work is distinguished from the broader original scope. The issue bodies retain their historical requirements and dated delivery notes.
| Issue | Verified delivery | Remaining scope / disposition |
|---|---|---|
| #2 | First three implementations and later exploit repositories merged; receipts below | Keep the parent open for incomplete children. The October 23 description of the first PRs as unmerged is historical. |
| #3 | Separate NetScaler, Ivanti, BeyondTrust, SonicWall and FortiMail checkers exist | Keep open for reconciliation of portfolio CSV/configuration and external-threat metadata requirements against every destination. A per-CVE version checker does not establish all original grouped acceptance criteria. |
| #4 | 20 separate additional Node advisory repositories, plus Node2Shell | Keep open for the complete advisory coverage matrix and lockfile/container evidence and feature-metadata collection requirements. Existing implementations accept operator observations; do not call these runtime attestation. |
| #6 | Sharp/library selection, provenance, independent conditions, mitigation and reports implemented | Keep open: lockfile/SBOM ingestion, bounded ELF inspection and SVG/source mitigation candidates from the original scope are absent. PIE/libc are operator observations. |
| #7 | Atlassian checker covers all eight products with per-branch fixes, JSON/CSV inventories, uncertainty and reports | Core checker acceptance verified. Broader local product-file adapters are not claimed; the destination checklist still records omission of a dedicated evidence-confidence field. |
| #8 | Flowise and flowise-components assessed independently; npm lockfiles/declarations, explicit inventory, uncertainty and reports | Core checker acceptance verified. Direct container-image parsing and owner aggregation are not claimed; optional OCI work remains #12. |
| #9 | Separate Engine/CLI, Desktop and go-archive comparisons; disputed archive range remains unknown | Keep open: CI YAML/shell source scanning, command direction, alias/wrapper and variable-argument fixtures are absent. |
| #10 | simple-git affected interval, gap uncertainty, fixed line and operator preconditions implemented | Keep open: installed-dependency ingestion and import-bound clone/mirror source candidates, relative locations and ambiguity fixtures are absent. |
| #11 | vm2 exact interval and fixed line, independent operator observations implemented | Keep open: JS/TS NodeVM construction/configuration analysis, spreads/defaults and trust-boundary candidate fixtures are absent. |
| #12 | No oci-runtime-inventory repository in the audited organization |
Not implemented; retain as optional supporting work. Requires bounded archive/layer/whiteout semantics, hostile fixtures and consumer adapters. |
| #13 | Contracts, embedded snapshots and helpers bundled into implemented scanners | Keep open: signed distribution, publisher trust, key rotation, expiry and rollback remain deferred and unimplemented. Checksums are not signatures; do not introduce a mandatory shared runtime. |
| #14 | No scan-results-bridge repository in the audited organization |
Not implemented; retain as optional supporting work. Normalize actual per-checker result contracts before SARIF/NDJSON conversion; the old separate shared-rules-repository dependency is superseded by bundled contracts. |
The core acceptance for #7 and #8 is narrower than every adapter mentioned in those proposals' scope sections. The remaining adapters are tracked in Atlassian #7 and Flowise #7. No unchecked requirement is silently marked implemented here. Every other incomplete original ticket remains open.
Links pin the audited commit and a successful workflow for that same SHA. They are repository build/test evidence only. No live targets were scanned.
Implement each future parser in its exploit-specific destination, preserving its existing result semantics, input bounds, standalone distribution and publication protections. Original issues remain the acceptance authority. Update the parent only after destination changes, meaningful synthetic tests, review and hosted checks for the published revision are verified. Optional OCI, conversion and signed-update work must not become prerequisites for running an individual offline checker.