feat: add this week's findings to the security audit (2026-07-20)

[enricopiovesan]

Summary

Second audit pass, commit 7c59137. This is an addition to the existing audit, not a rewrite — every finding, count, and section from the original July audit is untouched.

How history is preserved: the findings register table must keep its exact existing 4-column schema (Severity | Domain | Location | Finding), so I couldn't add a "date found" column. Instead the 6 new findings render from their own array, after a labeled divider row (NEW FINDINGS — AUDITED 2026-07-20, COMMIT 7C59137) styled distinctly in accent color. The register now visibly shows two audit passes instead of silently merging them into one undated list.

New findings (linked to their GitHub issues)

• High/Security — supply-chain signature verification never checks a cryptographic signature (Ed25519 is format-only, Sigstore is a stub); forged artifacts pass artifact verify. Leaves spec 065 unimplemented. #781
• High/Security — dev-any auth mode grants admin via the unsigned bearer literal "system_admin" and trusts any RFC1918-private peer, not just loopback. #782
• Medium/Security — browser adapter allocates from unbounded Content-Length before reading the body, unlike the HTTP API's capped sibling. #783
• Medium/Runtime — .NET Wasmtime bridge sets resource limits once at construction instead of per call; Rust core and the Kotlin/Chicory bridge are correctly implemented, .NET is the outlier. #784
• Medium/Functional gap — agent execute fully validates real WASM packages, then routes through a hardcoded 7-ID example executor and fails on anything else. #785
• Low/Performance — resolve_version_range does a full registry scan+sort instead of a targeted lookup. #786

Also updated

• Executive summary counts: High 4→6, Medium 7→10, Low 2→3. Critical and the spec/crate stats are untouched — this pass didn't re-audit those.
• Audit-source line and JSON-LD dateModified note the second pass and its commit.
• One confirmed-clean result folded into the existing Permanence strengths list: wasm32-unknown-unknown portability re-verified, native-only deps correctly feature-gated.

Test plan

• npm run build clean
• Verified in browser: stat counts correct, divider row renders distinctly styled, all 6 issue links resolve to the right URLs, source line shows both audit dates/commit, portability bullet renders in the strengths list
• No console errors
• Confirmed every pre-existing row, count, and section is byte-for-byte unchanged except where explicitly listed above

🤖 Generated with Claude Code