docs: Core Runtime Self-Extend Audit Report

[IanFrelinger]

Summary

Comprehensive read-only audit of Ashlar's core runtime focusing on admission and self-extend readiness for autonomous operation with validation. Produces structured markdown report under docs/audits/ as requested.

Changes

• Add docs/audits/2026-09-self-extend-core.md — comprehensive audit report covering:
  • Production-ready components (cert-gate, invariants A-D, trust APIs, hold admission)
  • Spike/hold-only components (self-extend runner adapter, certified loop, policy packs)
  • Requirements for claiming "autonomous self-extension with validation"
  • Top 10 gaps ranked by false-ADMIT risk with exploitability analysis
  • Core vs product boundary (what must never move out)
  • Critical security findings (3 trust signature holes: P0 severity)
  • Recommended next PRs with priorities

Key Findings

Production-Ready

• ✅ Certification loop with invariants A-D enforced and tested
• ✅ Trust log APIs (backend only, no UI)
• ✅ HoldAdmission / aggressiveness mode (fail-closed defaults)
• ✅ Policy pack infrastructure

Critical Gaps (P0)

• ❌ Trust signatures have 3 exploitable security holes (limitations 7-9):
  • Committed HMAC key (trivial forgery)
  • Ed25519 signature downgrade (delete field → bypass)
  • Schema version downgrade (rewrite gate name post-certification)
• ❌ Certified autonomy loop exists in spikes but not integrated into production path
• ❌ No dashboard UI for trust events
• ❌ Self-extend policy pack rules documented but not implemented

Coupling Found

• ⚠️ Commercial ApprovalBridge (Discord integration) — verify it stays out of src/

Testing

Audit-only PR (no code changes) — read-heavy analysis of existing implementation.

Audit Methodology

• Read 20+ source files across src/Ashlar.BackgroundAgents, src/Ashlar.Infrastructure, application/
• Read 4 specification documents (SELF-EXTEND-AUDIT.md, certification-evidence.md, trust loop specs)
• Traced control flow from BackgroundAgentService through self-extend execution path
• Analyzed test coverage for invariants A-D (4 test files verified)
• Reviewed spike evidence (spikes/autonomy-first-flight/ P2-P6, S1-S5)
• ~7000 lines audited (5000 LOC implementation + 2000 LOC docs)

Testing strategy (blast radius)

Change type	Minimum proof (check what applies)
Documentation only	N/A — no executable changes

• make kernel-coverage-gate — N/A (docs only)
• make kernel-gate — N/A (docs only)
• make test-prod-style — N/A (docs only)

Checklist

• make test passes locally — N/A (docs only, no code changes)
• Documentation updated — this PR adds audit documentation
• No TODO or NotImplementedException left unresolved — docs only
• Breaking changes are documented — N/A (audit report)

Release

• Not a versioned release — skip

---

Scope Notes

Per user request:

• AUDIT ONLY (read-heavy) — no feature implementation
• Focus: cert-gate, trust log, HoldAdmission, self-extend readiness, policy packs
• Output: structured markdown report as PR under docs/audits/
• Constraint: flag any Cursor/product coupling in core

Recommended Follow-Ups

Next PRs should address (per audit §8):

1. P0: Fix trust signature security holes (limitations 7-9)
2. P1: Integrate certified loop into background agent path
3. P1: Implement watch window + auto-rollback
4. P2: Dashboard UI for trust events
5. P2: Self-extend policy pack rules

See audit report §8 for detailed task breakdowns and exit criteria.