Astra independent security reviews, second round
Status: all three independent reviews completed.
Subsequent implementation work is tracked in the
native fixes report. This review and its findings
continue to describe the original a10323d runtime, not the patched working tree.
Consolidated result
No reviewer demonstrated an external request/response disclosure, authentication bypass, or shortcut to recover an epoch key in the reviewed v2 paths. This is bounded negative evidence, not a proof that no such vulnerability exists.
The strongest additional evidence concerns native secret erasure. A local probe showed that the 256-byte register file remaining after the VM destructor can reconstruct its final segment output with one BLAKE2b operation. Access to the last segment's retained state would enable epoch-key unwrapping. No reviewer found an externally reachable enclave-memory read that supplies those bytes; the experiment deliberately inspects retained storage at the deallocation boundary. This is confirmed secret remanence with conditional security impact, not a demonstrated Nitro escape or remote early-decryption attack.
The known aesDummy construction race remains confirmed and unfixed. Native
JIT permission changes also ignore failure returns; the examined failure paths
normally fault, and no confidentiality exploit was demonstrated. Prior limits
on metadata inference, wall-clock delay, WebPKI and recipient trust, retention
and post-release provenance remain in force.
Reports
Requested by the project owner after the nine-model panel. Each review uses
GPT-6 Astra through Codex at high reasoning effort and has full repository
access. The deployed runtime is frozen at
a10323dede4413fbf295916b8ad12e3dbad7514e. Current runtime files were checked
against that revision. No runtime changes or production calls are authorized
as part of these reviews.
| Reviewer | Scope | Report path |
|---|---|---|
astra_epoch_round2 |
Serial wrapping, early key recovery, lifecycle, clocks, publication and request leases | Report |
astra_confidentiality_round2 |
Client verification, inner and upstream TLS, transport, parsers, cross-client confidentiality | Report |
astra_native_round2 |
Native RandomX/FFI/JIT, raw NSM entropy handling, secret memory and native leak paths | Report |
Initial reviews exclude earlier model reports. The current threat model is supplied as a claim to examine; the primitive-strength assumption does not assume that composition or implementation is correct. Known scope boundaries and the previously confirmed AES-probe data race are distinguished from new findings. Local test artifacts are retained. The coordinator read all three reports and checked the native-remanence probe and recorded validation results.
Executed checks
- Seven independent synthetic verification cases passed: six rejected attacker-controlled evidence before any application GET, and one distinguished historical evidence acceptance from live rejection. The existing Python suite reported 64 passed.
- Six focused timelock/epoch tests passed; one full-memory test was skipped in the epoch review. Additional source-linked probes rejected four forged final checkpoints and four record-context mutations.
- Native AArch64 light and full-memory runs each matched 16 secure-JIT versus interpreted hashes, exercised 1,280 emitter patterns, and reproduced native register remanence. ASan/UBSan reported no errors in these local probes.
These are development-host/synthetic checks, not production Nitro execution, exhaustive fuzzing, or a full-duration solve. No runtime fixes or deployment changes were made. Concrete follow-up work is constructor synchronization, native secret-state cleanup with deallocation-boundary tests, and explicit propagation of JIT memory-permission errors.