Confirmed finding
PR #16 was merged as 945fc6fc, but every workflow group observed on its exact PR head ac9c2892 failed. The failed surface includes focused and full workspace validation, dependency audit, timing/security checks, compatibility, and performance qualification. No post-merge workflow receipt was available.
The source includes meaningful cryptographic and DAG hardening, but source plausibility is not a release receipt.
Acceptance criteria
- Pass deterministic focused and full-workspace tests on the exact candidate commit.
- Resolve dependency-audit findings or document affected-version reachability and a time-bounded remediation owner.
- Run independent ML-KEM known-answer/interoperability vectors for every supported parameter set and negative tamper cases.
- Pass timing-regression, fuzz/crash, license, secret-scan, clippy/format, Docker, CLI, WASM, and supported-platform compatibility gates.
- Produce reproducible performance baselines with thresholds fixed before the candidate run.
- Pin third-party GitHub Actions to verified full commit SHAs.
- Keep release qualification fail closed; no skipped or failed required gate may be relabeled as acceptance.
No production vulnerability or exploitability claim is made here. Security-sensitive reproduction detail should use a private advisory if later confirmed.
Confirmed finding
PR #16 was merged as
945fc6fc, but every workflow group observed on its exact PR headac9c2892failed. The failed surface includes focused and full workspace validation, dependency audit, timing/security checks, compatibility, and performance qualification. No post-merge workflow receipt was available.The source includes meaningful cryptographic and DAG hardening, but source plausibility is not a release receipt.
Acceptance criteria
No production vulnerability or exploitability claim is made here. Security-sensitive reproduction detail should use a private advisory if later confirmed.