docs(audit): verify post-remediation closure

[blakinio]

Purpose

Independently verify current main after the accepted R1/R2/R4/R3 remediation sequence and issue one normalized closure verdict for OTC2-AUD-001 through OTC2-AUD-004.

Verdict

• OTC2-AUD-001 — PARTIALLY_CLOSED;
• OTC2-AUD-002 — CLOSED;
• OTC2-AUD-003 — CLOSED;
• OTC2-AUD-004 — CLOSED;
• no new defect above LOW severity.

The active Identity/Platform secret flow, nonblocking shutdown, capability-safe asset opening and complete architecture policy are materially corrected. One focused residual remains:

OTC2-POST-001 — CallbackAttempt.target is still a public mutable ordinary String, so caller mutation before Drop can bypass complete owner-controlled overwrite coverage; direct oversized GameEntryCredential input is also rejected without explicit clearing. The current internal technical-login path does not exercise either gap, so severity is LOW, but literal R1 acceptance is incomplete.

Audit rules

• implementation was not authorized and no implementation change was made;
• current source, tests, architecture records, manifests, lockfile, supply-chain policy and live CI were reviewed directly;
• archived task claims were supporting evidence only;
• no production, manifest, lockfile, workflow or shared PR feat(ui): prototype Oteryn login shell #23 path changed.

Exact-head evidence

Base: main@67a6c9d726f7e70977803b028270475570210db0.

Final head 88439b0b631c10f3e6ca10f4971892059c8b580b passed:

• Rust Client run 30702545118;
• Windows job 91375964282: locked metadata, rustfmt, strict Clippy, full workspace tests and real-workspace architecture validation;
• Supply Chain job 91375964296;
• repository CI run 30702545170;
• CI / Required job 91376061607;
• exact changed-file review: audit task and report only;
• comments, reviews and unresolved review threads: none.

The report also records the earlier independent source-validation run and accurately notes that Clippy/tests use the exact current workspace ladder without --all-features, while cargo-deny uses --all-features.

Report

oteryn-client/docs/audits/post-remediation/2026-08-01-closure-audit.md

Task

OTC2-20260801-post-remediation-closure-audit