# Independent security audit handoff

## Status boundary

This repository can prepare and internally test an exact release candidate. It
must not describe that candidate as independently audited until an external
reviewer has approved the exact package hash and an independent attestation
signer has signed the resulting verdict.

The test-signed release candidate is not a publicly trusted production
release. Its certificate exists only to prove package integrity during
development and must never be presented as the Smart Miners production
identity.

## Required external inputs

The external reviewer receives one generated `External-Audit.zip` containing:

- the exact signed MSIX and its SHA-256;
- the signing certificate without a private key;
- the unpacked MSIX payload and complete app-tree SHA-256;
- the source snapshot used for the build;
- locked dependency files and an SPDX SBOM;
- the package manifest and capability policy;
- internal automated security and AppContainer runtime test evidence;
- the server ingestion validator and relevant private-table migrations;
- an unsigned audit request whose status is `pending`.

Internal tests are evidence for the reviewer, not a substitute for independent
review.

## Binding the external verdict

An accepted verdict must bind all of these values:

1. signed MSIX SHA-256;
2. unpacked installed-app tree SHA-256;
3. source revision or immutable source-snapshot SHA-256;
4. app and package version;
5. security policy version;
6. the installation-specific challenge;
7. issue time and expiry time;
8. verdict `pass`;
9. the independent signer's ECDSA P-256/SHA-256 signature.

The private audit key must be kept outside this repository and outside the
Smart Miners web server build environment. Only the public verification key is
shipped in the app.

## Production release rule

A production download may be enabled only when all of the following are true:

- the source revision is clean and publicly reviewable;
- the MSIX is signed by the declared production publisher through a trusted
  code-signing service or certificate;
- the package signature and timestamp verify on a clean Windows system;
- an external reviewer has issued a signed pass for the exact hashes;
- the AppContainer runtime test reports `TokenIsAppContainer = true`;
- the website publishes the same package and SHA-256 reviewed by the auditor.

