# BCX v0.1.0 Pentest Report

Status: PASS
Commit: bb36de79f51e926bd4ea70da5245a010a552b7f9
Tester: Senior Rust Security Architect
Scope: BCX v0.1.0 repository foundation, no-std workspace scaffold, CI, supply-chain policy, release gates, and initial protocol primitive validation.
Date: 2026-06-19

## Summary

The initial review found repository-foundation and early scaffold issues that
needed cleanup before `v0.1.0` could be considered tag-ready. Release-scope
findings were fixed before this report was marked `PASS`.

BCX `v0.1.0` remains a repository foundation release. It is not a production
protocol release and must not be used for consequential network operations.

## Findings Resolved For v0.1.0

- Digest zero checks no longer use data-dependent early exit.
- `Digest::ct_eq` was added for security-sensitive digest comparisons.
- `Nonce` debug output is redacted.
- `CapabilityRef` and `PolicyEpoch` now expose digest accessors.
- Signature envelopes now validate exact per-algorithm signature lengths.
- Signed-envelope verification now performs algorithm admission and envelope
  shape validation before provider dispatch.
- `WireLimits` now uses private fields, hard caps, a validated constructor, and
  accessors.
- Wire header validation rejects unsupported minor versions.
- GitHub Actions checkout is pinned to the `v6.0.3` commit SHA.
- CI runner is pinned to `ubuntu-24.04`.
- CI installs pinned `cargo-deny` and `cargo-audit` versions.
- `deny.toml` denies wildcard dependency versions and checks unmaintained and
  unsound advisories across the whole graph.
- Release readiness now requires a full 40-character commit hash in pentest
  reports.

## Deferred Findings

These items are not release blockers for `v0.1.0` because this tag does not
ship network parsing, federation, or Sovereign-profile admission logic:

- Fuzzing harnesses are required before network-sourced canonical decoding and
  native frame parsing become active release surfaces.
- Autonomous-agent proof-level enforcement belongs to the later Sovereign
  profile admission milestone.

Both are tracked in the version plan before the relevant behavior becomes
production scope.

## Verification

The following checks passed after remediation:

```bash
cargo test --workspace --all-features
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo deny check
cargo audit
```

## Known Limitations

- No canonical encoding yet.
- No real cryptographic provider yet.
- No capability verifier yet.
- No receipts or WHY bundles yet.
- No Fluxheim integration yet.
