XHIM Security Audit Status

Status: PARTIAL — FORMAL RELEASE BLOCKED

Date: 2026-07-25

This is a historical workspace snapshot. Its original commit and exact build manifest were not recorded, so the counts below must not be reused as evidence for the current tree; a formal release must regenerate and bind the report to the release commit and artifact hashes.

Completed in this workspace

• C++ Debug build and 23 CTest targets pass, including ABI/package consumers, offline read-only, attachment planning and the full transport decision matrix.
• Apple Swift tests, Android JNI/Kotlin strict compilation, Harmony Node-API strict compilation and Windows .NET warnaserror build pass.
• Go unit tests and go vet ./... pass.
• Database encryption requests fail closed when SQLCipher is not linked.
• Device and capacity templates were passed to their verifiers and correctly failed; missing external evidence cannot be mistaken for approval.
• The Go license collector found and copied license evidence for 38 resolved modules in the local evidence directory.

Formal blockers

The local machine does not currently provide gitleaks, semgrep, govulncheck, osv-scanner or trivy. The available-only audit recorded all five as missing; the formal audit mode and commercial_gate.sh therefore fail. No claim is made that secret, SAST, dependency, container or IaC scanning has passed.

The formal report also requires:

• the real SQLCipher library and five platform secure-key Adapters;
• signed final packages and their exact SBOMs;
• accepted findings or expiring, approved exceptions;
• penetration testing of auth/tenant/media boundaries;
• production TLS, KMS rotation, backup restore and incident-response evidence.

This file is a status record, not a security certification.