Skip to content

ci(track-a): independently audit native-login closeout helpers - #575

Closed
blakinio wants to merge 4 commits into
mainfrom
audit/OTC-20260818-native-login-final
Closed

ci(track-a): independently audit native-login closeout helpers#575
blakinio wants to merge 4 commits into
mainfrom
audit/OTC-20260818-native-login-final

Conversation

@blakinio

@blakinio blakinio commented Aug 19, 2026

Copy link
Copy Markdown
Owner

Terminal audit disposition — consumed by native-login promotion #577

Status: CLOSED UNMERGED AS AUDIT-ONLY / CONSUMED.

This PR independently falsified the frozen source #528 head 8e029f5849a1d51f69486adcc3716c80f139e60e without physical runtime, real credentials, login, GUI input or gameplay.

Terminal accepted audit results

Helper/source validation:

current_sha_native_login_gate.py             py_compile PASS
current_sha_secret_ingress.cpp               compile PASS
experimental_character_control_current.cpp   compile PASS
sealed memfd + complete seal set              PASS
SCM_RIGHTS synthetic same-UID/PID ingress     PASS
synthetic credential payload/response         PASS
exact current public package fence             PASS
source current-SHA gate                        PASS
REAL_SECRET_ACCESS=false
OFFICIAL_CLIENT_EXECUTED=false

Targeted strict table audit:

run 32242788755 = SUCCESS
TGameClient                       table=0x1d903c4 methods=44 switch LEA=0xd1910a
TCharacterSelectionController     table=0x1d98fe4 methods=26 switch LEA=0xd51c90
TAuthenticationProcessController  table=0x1d8ff20 methods=51 switch LEA=0xd0f5ff
STRICT_ALL_NATIVE_LOGIN_QMETA_TABLES=PASS
RAW_CLIENT_RETAINED=false

Falsification repair history

Two earlier audit generations are explicitly audit-method failures, not source findings:

  1. run 32242202262: audit cleanup trap removed the temporary client between steps after helper compile/synthetic ingress/package fence had passed;
  2. run 32242561205: source gate and TGameClient/CharacterSelection strict bindings passed, but coordinator parser imposed an inapplicable requirement that TAuthenticationProcessController be discovered as a relocation-backed static QMetaObject. The final targeted table-xref discriminator tested the actual claim and passed.

No material implementation finding remained after the independent audit. The result was consumed into coordinator evidence and source review 4971140006 = ACCEPT_WITH_EDITS, then clean promotion #577 passed exact-head CI/governance/native-auth validation and squash-merged as db41e9112383fd5993cba04437bbbd8f6963e6e7.

No temporary audit workflow from this PR is merged to main.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant