# External audit checklist

The reviewer should record pass/fail evidence for every item.

## Artifact and provenance

- Recalculate the MSIX SHA-256 and compare it with `audit-request.json`.
- Verify the MSIX signature and publisher.
- Unpack the MSIX and recalculate the complete app-tree SHA-256.
- Rebuild from the included source and locked dependencies.
- Compare the rebuilt payload and document every non-reproducible difference.
- Review the SPDX SBOM and all direct/transitive dependencies.

## Windows isolation

- Confirm `uap10:TrustLevel="appContainer"`.
- Confirm `uap10:RuntimeBehavior="packagedClassicApp"`.
- Confirm the only declared capability is `internetClient`.
- Confirm `runFullTrust` and sensitive device/library capabilities are absent.
- Install on a clean Windows 10 2004+ or Windows 11 VM.
- Verify the running connector process has `TokenIsAppContainer = true`.
- Test denied access to unrelated files, processes, registry, camera,
  microphone, location and user libraries.

## Credential and data boundary

- Inspect the WebView2 host, page hook and connector bridge.
- Confirm cookies, authorization headers, tokens, request bodies, URL query
  strings and raw websocket frames cannot cross the host bridge.
- Confirm the C# redactor rejects forbidden credential keys and bearer values.
- Confirm only allowlisted API responses and websocket event shapes upload.
- Confirm the client has no Supabase service-role key.
- Confirm viewer codes upload only as SHA-256 hashes.
- Review server-side validation, rate limits, second redaction and private
  Supabase grants.
- Capture network traffic during login, quiet periods, rounds and reconnects.

## Installation gate

- Confirm the release candidate stays blocked before GoMining connection until
  a valid `.smcaudit` file is imported.
- Confirm changing any installed package file invalidates the artifact hash.
- Confirm changing version, source revision, challenge, policy, issue/expiry or
  verdict invalidates the attestation.
- Confirm the private attestation signing key is not in the repository, app,
  package, website or ordinary build environment.

## Verdict

- Record reviewer identity and organization.
- Record audit date, methods, tools, findings and accepted residual risks.
- Bind the verdict to every value listed in `AUDIT-HANDOFF.md`.
- Sign only a `pass` verdict after all blocking findings are resolved.

