{"schema":"steadywrk.mizan-chain/v1","generated_at":"2026-08-18T02:11:01.887Z","source":"repository","genesis_tag":"STEADYWRK-MIZAN-GENESIS-v1","count":6,"head":"d769352f88e79e6da5a103b8a521769cbcba2ef035fbc283ff7644ec424872bb","unsigned_entries":6,"algorithm":{"leaf":"payload = the whole sealed run: schema, sealedAt, genesis_tag, registry digest, counts, and one record per control carrying verdict, observed, method, and its negative control. canonical_json(payload) = JSON.stringify after sorting every object's keys recursively (arrays keep their order).","link":"rowHash_n = SHA256(seq + \"|\" + prevHash + \"|\" + sealedAt + \"|\" + canonical_json(payload)) — four fields joined by a literal pipe, no spaces, hashed as UTF-8. prevHash_1 = SHA256(genesis_tag) and prevHash_n = rowHash_(n-1). sealedAt is BOTH the third joined field and a field inside payload; the two must be the same string.","order":"entries are served in ascending seq, which must start at 1 and be contiguous — a chain that starts at seq 2 is a truncated chain, not a short one, and a verifier must reject it rather than believe it from wherever it begins","implementation":"sealed by security/mizan/run.mjs; recomputed independently, with no shared code, by security/mizan/verify.mjs (`node security/mizan/verify.mjs --selftest` checks that the verifier itself can still fail)"},"links":[{"seq":1,"prevHash":"8183fc0234dd0edfd2ac12310344b2924c9787a7988e40212242659e9a433b8b","rowHash":"162aa17e8689834ba8c488f8f5736a9de11b5cfe0ce1fca301bffac84f64eceb","payload":{"schema":"steadywrk.mizan-attestation/v1","sealedAt":"2026-08-11T13:52:32.555Z","genesis_tag":"STEADYWRK-MIZAN-GENESIS-v1","registry":{"schema":"steadywrk.mizan-registry/v1","control_count":14,"registry_sha256":"ccf666dc2dead383725183711570075dcc470404d87d824bf121efbfa06934a2"},"engine":"security/mizan/run.mjs","counts":{"live":11,"dark":1,"cant_check":2},"controls":[{"control_id":"MZ-001","probe":"auth-gate-fires","ran_at":"2026-08-11T13:52:22.374Z","verdict":"LIVE","observed":"24/24 protected prefixes refused anonymously (7 x 307->/sign-in, 17 x opaque 404)","method":"GET https://steadywrk.app<each PROTECTED_PATH_PREFIXES entry>/<nonce> anonymously, redirect:manual -> status + Location","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"known-public paths correctly judged not-refused: /=200, /lab=200, /api/health=200","method":"GET https://steadywrk.app{/,/lab,/api/health} judged with the SAME refusal assertion (wrong input: these are public)"}},{"control_id":"MZ-002","probe":"employee-api-sealed","ran_at":"2026-08-11T13:52:23.487Z","verdict":"LIVE","observed":"3/3 sealed: /api/employee/documents=404 empty ct=text/plain, /api/employee/shifts=404 empty ct=text/plain, /api/employee/mizan-probe-msopzcu2=404 empty ct=text/plain [real routes indistinguishable from nonce path]","method":"GET https://steadywrk.app{/api/employee/documents,/api/employee/shifts,/api/employee/mizan-probe-msopzcu2} anonymously -> status + body","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"public endpoints correctly judged not-sealed: /api/health=status=200 len=15, /.well-known/did.json=status=200 len=858","method":"GET https://steadywrk.app{/api/health,/.well-known/did.json} judged with the SAME sealed-ness assertion (wrong input: these are public 200s)"}},{"control_id":"MZ-003","probe":"security-headers","ran_at":"2026-08-11T13:52:23.990Z","verdict":"LIVE","observed":"https://steadywrk.app/ 200 csp=[1482ch, default-src 'self'] hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY || https://steadywrk.app/api/health 200 csp=ABSENT hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY","method":"GET https://steadywrk.app/ (require CSP+HSTS+XCTO+XFO) and GET https://steadywrk.app/api/health (require HSTS+XCTO+XFO) -> response headers","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health missing csp; all 4 single-header knockouts on / rejected (csp,hsts,xcto,xfo)","method":"GET https://steadywrk.app/api/health judged with the DOCUMENT required-set [csp,hsts,xcto,xfo], plus the live headers from https://steadywrk.app/ with each required header deleted in turn, judged by the SAME assertion"}},{"control_id":"MZ-004","probe":"receipt-chain-verifies","ran_at":"2026-08-11T13:52:24.541Z","verdict":"LIVE","observed":"HTTP 200 steadywrk.app/api/public/receipt-chain; count=21 links=21; 21/21 leaves recomputed; fold reaches published head 392ccb6382b1...; sig valid but key is same-origin (not independent)","method":"GET https://steadywrk.app/api/public/receipt-chain -> recompute chain_n=SHA256(chain_{n-1}|n|ts|SHA256(canonical_json(receipt))) from chain_0=SHA256(genesis_tag); compare recomputed head to published head. The endpoint's own integrity claims are ignored.","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"10/10 single-byte/structural tampers across 2 baseline(s) (synthetic+live) reported as breaks; pristine baselines verified clean. The assertion can fail.","method":"Same recomputeChain() assertion as probe(), run against deliberately WRONG inputs: one hex character flipped in a link chain value, in a receipt_hash, in the head, plus an edited receipt body and a truncated prefix. Each must be reported broken; a pristine baseline must verify clean."}},{"control_id":"MZ-005","probe":"content-ledger-honest","ran_at":"2026-08-11T13:52:24.926Z","verdict":"CANT-CHECK","observed":"HTTP 200 count=0 links=0 head=null unsealed_rows=0; disclosure 484 chars present. Empty chain commits to nothing.","method":"GET https://steadywrk.app/api/public/content-ledger -> recompute chain_n=SHA256(chain_{n-1}|n|ts|hash) from chain_0=SHA256(genesis_tag) and compare to published head; separately assert integrity.does_not_prove is >=120 chars / >=2 sentences and non-boilerplate, and that integrity.signing matches what the response actually carries.","reason":"empty_chain_nothing_to_verify","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"7/7 tampers caught (4 chain: byte-flip in chain/hash/head + prefix truncation; 3 honesty: stripped, boilerplate, signature advertised but absent); pristine baseline verified clean. Both assertions can fail.","method":"Same recomputeChain() and checkHonesty() assertions as probe(), run against deliberately WRONG inputs built from a synthetic baseline: one hex character flipped in a row chain, in a row hash, and in the head; a truncated prefix; a stripped does_not_prove; a boilerplate does_not_prove; and signing.enabled=true carrying no signature. Each must be caught, and the pristine baseline must verify clean."}},{"control_id":"MZ-006","probe":"did-key-resolvable","ran_at":"2026-08-11T13:52:25.098Z","verdict":"LIVE","observed":"200 did:web:steadywrk.app — 2 verification method(s) valid. ed25519-2026-01: ed25519-pub, 32 key bytes; receipt-chain-ed25519-v1: ed25519-pub, 32 key bytes","method":"GET https://steadywrk.app/.well-known/did.json -> JSON, then base58btc-decode each publicKeyMultibase and check 0xED 0x01 + 32 bytes","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health as DID doc: id=null, expected did:web:steadywrk.app; truncated key: decoded 32 bytes, expected 34","method":"GET https://steadywrk.app/api/health judged as a DID document, plus the live publicKeyMultibase truncated by 4 chars judged by the SAME key check"}},{"control_id":"MZ-007","probe":"branch-protection","ran_at":"2026-08-11T13:52:25.448Z","verdict":"LIVE","observed":"branch=main allow_force_pushes=false enforce_admins=true required_contexts=[build-and-lint] strict=false allow_deletions=false required_signatures=false","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/main/protection","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately unprotected branch] branch=ascension/claim-liability: HTTP 404 \"Branch not protected\" — no protection object exists","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/ascension/claim-liability/protection"}},{"control_id":"MZ-008","probe":"actions-runner-owned","ran_at":"2026-08-11T13:52:27.572Z","verdict":"LIVE","observed":"26 runs-on in 25 executable file(s), all [self-hosted, Windows, X64]; runners online=1/1 (omen-steadywrk-1/Windows/self-hosted+Windows+X64); inert-but-hosted: npm-publish.yml.draft:34,npm-publish.yml.draft:70","method":"parse 25 .github/workflows/*.{yml,yaml} for runs-on + gh api -X GET repos/karimalsalah/steadywrk/actions/runners","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately hosted runners] 2 runs-on in 1 file(s); 2 not self-hosted: npm-publish.yml.draft:34 [ubuntu-latest]; npm-publish.yml.draft:70 [ubuntu-latest]","method":"[negative control] same parser over non-executable workflow files: npm-publish.yml.draft"}},{"control_id":"MZ-009","probe":"secret-scan-armed","ran_at":"2026-08-11T13:52:28.246Z","verdict":"LIVE","observed":"wiring ok (gitleaks-action@dcedce43c6f4… + precondition script present); detector flagged 1 finding(s) [aws-access-token] on a freshly generated synthetic key using the repo .gitleaks.toml (allowlist in force)","method":"\"gitleaks\" dir \"C:/Users/youso/AppData/Local/Temp/mizan-scan-zlDj3Q\" -c \"C:/Users/youso/dev/wt-mizan/.gitleaks.toml\" --report-format json --report-path \"C:/Users/youso/AppData/Local/Temp/mizan-scan-zlDj3Q/report.json\" --no-banner --log-level error [version is set by build process]","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — corpus contains no secret] wiring ok (gitleaks-action@dcedce43c6f4… + precondition script present); detector reported 0 findings on the supplied corpus with the repo .gitleaks.toml (allowlist in force) — the assertion \"scanner flags this\" did not hold","method":"\"gitleaks\" dir \"C:/Users/youso/AppData/Local/Temp/mizan-scan-3u9mLJ\" -c \"C:/Users/youso/dev/wt-mizan/.gitleaks.toml\" --report-format json --report-path \"C:/Users/youso/AppData/Local/Temp/mizan-scan-3u9mLJ/report.json\" --no-banner --log-level error [version is set by build process]"}},{"control_id":"MZ-010","probe":"no-metered-ci-spend","ran_at":"2026-08-11T13:52:28.653Z","verdict":"DARK","observed":"BREAKER TRIPPED — MTD net $98.88 (product=actions $98.88) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: account-wide karimalsalah, 51 items across 7 repo(s), 2026-08 UTC","method":"gh api -X GET users/karimalsalah/settings/billing/usage -f year=2026 -f month=8 -> sum(usageItems[].netAmount)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-threshold figure, not real spend] CAP BREACHED — MTD net $132.40 (product=actions $132.40) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: synthetic figure — no billing call made","method":"[negative control] evaluate(synthetic $132.40) through the same comparison the live path uses"}},{"control_id":"MZ-011","probe":"collaborator-inventory","ran_at":"2026-08-11T13:52:29.319Z","verdict":"LIVE","observed":"roster ENUMERATED ONLY — drift not assessed, no prior attestation to diff against. 3 write-capable: admin:karimalsalah, admin:usephedm, write:KarimCoSpace","method":"gh api -X GET repos/karimalsalah/steadywrk/collaborators -f affiliation=all -f per_page=100 -> filter permissions to write|maintain|admin, sort","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic roster with no write access] zero write-capable accounts enumerated from 2 collaborator record(s) — a repository with an owner cannot have an empty write roster, so this enumeration is not trustworthy","method":"[negative control] same permission filter + evaluate() over a synthetic read-only-only collaborator payload"}},{"control_id":"MZ-012","probe":"prod-deploy-matches-main","ran_at":"2026-08-11T13:52:29.950Z","verdict":"LIVE","observed":"prod=e899c43 via /standing-ledger (HTML, BUILD_HASH); main=e899c43acd71e9ec45bd03621d9605c5a0504b7c via gh/ls-remote; e899c43 is a prefix of e899c43acd71e9ec45bd03621d9605c5a0504b7c. Silent: /api/health 200 body={\"status\":\"ok\"} (no build field); no build header among 7 candidates","method":"GET /api/health (JSON + build headers: both silent by design) then GET /standing-ledger for BUILD_HASH; compared against `gh api repos/<repo>/commits/main --jq .sha` (fallback `git ls-remote`)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"comparator correctly rejected the wrong SHA: e899c43 != ffffffffffffffffffffffffffffffffffffffff. local build-info.ts=75f6613 vs prod: mismatch","method":"same comparator, wrong expected SHA (ffffffff…) against the real production build hash"}},{"control_id":"MZ-013","probe":"vulnerability-backlog","ran_at":"2026-08-11T13:52:31.236Z","verdict":"CANT-CHECK","observed":"8 open alert(s) [medium=5 high=3]; no ceiling recorded anywhere in the estate, so the bound cannot be evaluated","method":"gh api -X GET repos/karimalsalah/steadywrk/dependabot/alerts -f state=open -f per_page=100 -> count by security_advisory.severity","reason":"no_ceiling_recorded","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-ceiling backlog] 99 open alert(s) [medium=83 high=12 critical=4] exceeds ceiling 5 (synthetic ceiling)","method":"[negative control] evaluate(synthetic 99 open alerts vs synthetic ceiling 5) through the same comparison the live path uses"}},{"control_id":"MZ-014","probe":"mfa-on-owner-account","ran_at":"2026-08-11T13:52:31.970Z","verdict":"LIVE","observed":"account=karimalsalah (repo owner of karimalsalah): two_factor_authentication=true, read from the authenticated user record","method":"gh api -X GET user -> .login + .two_factor_authentication (compared against repo owner karimalsalah)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic payload, MFA deliberately false] account=karimalsalah: two_factor_authentication=false","method":"[negative control] evaluate(synthetic user payload with two_factor_authentication:false) through the same assertion the live path uses"}}]},"signature":null,"keyId":null},{"seq":2,"prevHash":"162aa17e8689834ba8c488f8f5736a9de11b5cfe0ce1fca301bffac84f64eceb","rowHash":"406bc33ebb7bc993d999eef0601fc64e29e860ad8217056e6b0f758b1657173d","payload":{"schema":"steadywrk.mizan-attestation/v1","sealedAt":"2026-08-11T13:56:57.126Z","genesis_tag":"STEADYWRK-MIZAN-GENESIS-v1","registry":{"schema":"steadywrk.mizan-registry/v1","control_count":14,"registry_sha256":"ccf666dc2dead383725183711570075dcc470404d87d824bf121efbfa06934a2"},"engine":"security/mizan/run.mjs","counts":{"live":11,"dark":1,"cant_check":2},"controls":[{"control_id":"MZ-001","probe":"auth-gate-fires","ran_at":"2026-08-11T13:56:46.786Z","verdict":"LIVE","observed":"24/24 protected prefixes refused anonymously (7 x 307->/sign-in, 17 x opaque 404)","method":"GET https://steadywrk.app<each PROTECTED_PATH_PREFIXES entry>/<nonce> anonymously, redirect:manual -> status + Location","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"known-public paths correctly judged not-refused: /=200, /lab=200, /api/health=200","method":"GET https://steadywrk.app{/,/lab,/api/health} judged with the SAME refusal assertion (wrong input: these are public)"}},{"control_id":"MZ-002","probe":"employee-api-sealed","ran_at":"2026-08-11T13:56:47.836Z","verdict":"LIVE","observed":"3/3 sealed: /api/employee/documents=404 empty ct=text/plain, /api/employee/shifts=404 empty ct=text/plain, /api/employee/mizan-probe-msoq50rd=404 empty ct=text/plain [real routes indistinguishable from nonce path]","method":"GET https://steadywrk.app{/api/employee/documents,/api/employee/shifts,/api/employee/mizan-probe-msoq50rd} anonymously -> status + body","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"public endpoints correctly judged not-sealed: /api/health=status=200 len=15, /.well-known/did.json=status=200 len=858","method":"GET https://steadywrk.app{/api/health,/.well-known/did.json} judged with the SAME sealed-ness assertion (wrong input: these are public 200s)"}},{"control_id":"MZ-003","probe":"security-headers","ran_at":"2026-08-11T13:56:48.204Z","verdict":"LIVE","observed":"https://steadywrk.app/ 200 csp=[1482ch, default-src 'self'] hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY || https://steadywrk.app/api/health 200 csp=ABSENT hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY","method":"GET https://steadywrk.app/ (require CSP+HSTS+XCTO+XFO) and GET https://steadywrk.app/api/health (require HSTS+XCTO+XFO) -> response headers","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health missing csp; all 4 single-header knockouts on / rejected (csp,hsts,xcto,xfo)","method":"GET https://steadywrk.app/api/health judged with the DOCUMENT required-set [csp,hsts,xcto,xfo], plus the live headers from https://steadywrk.app/ with each required header deleted in turn, judged by the SAME assertion"}},{"control_id":"MZ-004","probe":"receipt-chain-verifies","ran_at":"2026-08-11T13:56:48.759Z","verdict":"LIVE","observed":"HTTP 200 steadywrk.app/api/public/receipt-chain; count=21 links=21; 21/21 leaves recomputed; fold reaches published head 392ccb6382b1...; sig valid but key is same-origin (not independent)","method":"GET https://steadywrk.app/api/public/receipt-chain -> recompute chain_n=SHA256(chain_{n-1}|n|ts|SHA256(canonical_json(receipt))) from chain_0=SHA256(genesis_tag); compare recomputed head to published head. The endpoint's own integrity claims are ignored.","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"10/10 single-byte/structural tampers across 2 baseline(s) (synthetic+live) reported as breaks; pristine baselines verified clean. The assertion can fail.","method":"Same recomputeChain() assertion as probe(), run against deliberately WRONG inputs: one hex character flipped in a link chain value, in a receipt_hash, in the head, plus an edited receipt body and a truncated prefix. Each must be reported broken; a pristine baseline must verify clean."}},{"control_id":"MZ-005","probe":"content-ledger-honest","ran_at":"2026-08-11T13:56:49.137Z","verdict":"CANT-CHECK","observed":"HTTP 200 count=0 links=0 head=null unsealed_rows=0; disclosure 484 chars present. Empty chain commits to nothing.","method":"GET https://steadywrk.app/api/public/content-ledger -> recompute chain_n=SHA256(chain_{n-1}|n|ts|hash) from chain_0=SHA256(genesis_tag) and compare to published head; separately assert integrity.does_not_prove is >=120 chars / >=2 sentences and non-boilerplate, and that integrity.signing matches what the response actually carries.","reason":"empty_chain_nothing_to_verify","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"7/7 tampers caught (4 chain: byte-flip in chain/hash/head + prefix truncation; 3 honesty: stripped, boilerplate, signature advertised but absent); pristine baseline verified clean. Both assertions can fail.","method":"Same recomputeChain() and checkHonesty() assertions as probe(), run against deliberately WRONG inputs built from a synthetic baseline: one hex character flipped in a row chain, in a row hash, and in the head; a truncated prefix; a stripped does_not_prove; a boilerplate does_not_prove; and signing.enabled=true carrying no signature. Each must be caught, and the pristine baseline must verify clean."}},{"control_id":"MZ-006","probe":"did-key-resolvable","ran_at":"2026-08-11T13:56:49.311Z","verdict":"LIVE","observed":"200 did:web:steadywrk.app — 2 verification method(s) valid. ed25519-2026-01: ed25519-pub, 32 key bytes; receipt-chain-ed25519-v1: ed25519-pub, 32 key bytes","method":"GET https://steadywrk.app/.well-known/did.json -> JSON, then base58btc-decode each publicKeyMultibase and check 0xED 0x01 + 32 bytes","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health as DID doc: id=null, expected did:web:steadywrk.app; truncated key: decoded 32 bytes, expected 34","method":"GET https://steadywrk.app/api/health judged as a DID document, plus the live publicKeyMultibase truncated by 4 chars judged by the SAME key check"}},{"control_id":"MZ-007","probe":"branch-protection","ran_at":"2026-08-11T13:56:49.658Z","verdict":"LIVE","observed":"branch=main allow_force_pushes=false enforce_admins=true required_contexts=[build-and-lint] strict=false allow_deletions=false required_signatures=false","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/main/protection","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately unprotected branch] branch=ascension/claim-liability: HTTP 404 \"Branch not protected\" — no protection object exists","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/ascension/claim-liability/protection"}},{"control_id":"MZ-008","probe":"actions-runner-owned","ran_at":"2026-08-11T13:56:51.818Z","verdict":"LIVE","observed":"26 runs-on in 25 executable file(s), all [self-hosted, Windows, X64]; runners online=1/1 (omen-steadywrk-1/Windows/self-hosted+Windows+X64); inert-but-hosted: npm-publish.yml.draft:34,npm-publish.yml.draft:70","method":"parse 25 .github/workflows/*.{yml,yaml} for runs-on + gh api -X GET repos/karimalsalah/steadywrk/actions/runners","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately hosted runners] 2 runs-on in 1 file(s); 2 not self-hosted: npm-publish.yml.draft:34 [ubuntu-latest]; npm-publish.yml.draft:70 [ubuntu-latest]","method":"[negative control] same parser over non-executable workflow files: npm-publish.yml.draft"}},{"control_id":"MZ-009","probe":"secret-scan-armed","ran_at":"2026-08-11T13:56:52.546Z","verdict":"LIVE","observed":"wiring ok (gitleaks-action@dcedce43c6f4… + precondition script present); detector flagged 1 finding(s) [aws-access-token] on a freshly generated synthetic key using the repo .gitleaks.toml (allowlist in force)","method":"\"gitleaks\" dir \"C:/Users/youso/AppData/Local/Temp/mizan-scan-3JvLEy\" -c \"C:/Users/youso/dev/wt-mizan/.gitleaks.toml\" --report-format json --report-path \"C:/Users/youso/AppData/Local/Temp/mizan-scan-3JvLEy/report.json\" --no-banner --log-level error [version is set by build process]","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — corpus contains no secret] wiring ok (gitleaks-action@dcedce43c6f4… + precondition script present); detector reported 0 findings on the supplied corpus with the repo .gitleaks.toml (allowlist in force) — the assertion \"scanner flags this\" did not hold","method":"\"gitleaks\" dir \"C:/Users/youso/AppData/Local/Temp/mizan-scan-53vGTm\" -c \"C:/Users/youso/dev/wt-mizan/.gitleaks.toml\" --report-format json --report-path \"C:/Users/youso/AppData/Local/Temp/mizan-scan-53vGTm/report.json\" --no-banner --log-level error [version is set by build process]"}},{"control_id":"MZ-010","probe":"no-metered-ci-spend","ran_at":"2026-08-11T13:56:52.922Z","verdict":"DARK","observed":"BREAKER TRIPPED — MTD net $98.88 (product=actions $98.88) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: account-wide karimalsalah, 51 items across 7 repo(s), 2026-08 UTC","method":"gh api -X GET users/karimalsalah/settings/billing/usage -f year=2026 -f month=8 -> sum(usageItems[].netAmount)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-threshold figure, not real spend] CAP BREACHED — MTD net $132.40 (product=actions $132.40) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: synthetic figure — no billing call made","method":"[negative control] evaluate(synthetic $132.40) through the same comparison the live path uses"}},{"control_id":"MZ-011","probe":"collaborator-inventory","ran_at":"2026-08-11T13:56:53.585Z","verdict":"LIVE","observed":"roster ENUMERATED ONLY — drift not assessed, no prior attestation to diff against. 3 write-capable: admin:karimalsalah, admin:usephedm, write:KarimCoSpace","method":"gh api -X GET repos/karimalsalah/steadywrk/collaborators -f affiliation=all -f per_page=100 -> filter permissions to write|maintain|admin, sort","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic roster with no write access] zero write-capable accounts enumerated from 2 collaborator record(s) — a repository with an owner cannot have an empty write roster, so this enumeration is not trustworthy","method":"[negative control] same permission filter + evaluate() over a synthetic read-only-only collaborator payload"}},{"control_id":"MZ-012","probe":"prod-deploy-matches-main","ran_at":"2026-08-11T13:56:54.163Z","verdict":"LIVE","observed":"prod=e899c43 via /standing-ledger (HTML, BUILD_HASH); main=e899c43acd71e9ec45bd03621d9605c5a0504b7c via gh/ls-remote; e899c43 is a prefix of e899c43acd71e9ec45bd03621d9605c5a0504b7c. Silent: /api/health 200 body={\"status\":\"ok\"} (no build field); no build header among 7 candidates","method":"GET /api/health (JSON + build headers: both silent by design) then GET /standing-ledger for BUILD_HASH; compared against `gh api repos/<repo>/commits/main --jq .sha` (fallback `git ls-remote`)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"comparator correctly rejected the wrong SHA: e899c43 != ffffffffffffffffffffffffffffffffffffffff. local build-info.ts=75f6613 vs prod: mismatch","method":"same comparator, wrong expected SHA (ffffffff…) against the real production build hash"}},{"control_id":"MZ-013","probe":"vulnerability-backlog","ran_at":"2026-08-11T13:56:55.416Z","verdict":"CANT-CHECK","observed":"8 open alert(s) [medium=5 high=3]; no ceiling recorded anywhere in the estate, so the bound cannot be evaluated","method":"gh api -X GET repos/karimalsalah/steadywrk/dependabot/alerts -f state=open -f per_page=100 -> count by security_advisory.severity","reason":"no_ceiling_recorded","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-ceiling backlog] 99 open alert(s) [medium=83 high=12 critical=4] exceeds ceiling 5 (synthetic ceiling)","method":"[negative control] evaluate(synthetic 99 open alerts vs synthetic ceiling 5) through the same comparison the live path uses"}},{"control_id":"MZ-014","probe":"mfa-on-owner-account","ran_at":"2026-08-11T13:56:56.484Z","verdict":"LIVE","observed":"account=karimalsalah (repo owner of karimalsalah): two_factor_authentication=true, read from the authenticated user record","method":"gh api -X GET user -> .login + .two_factor_authentication (compared against repo owner karimalsalah)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic payload, MFA deliberately false] account=karimalsalah: two_factor_authentication=false","method":"[negative control] evaluate(synthetic user payload with two_factor_authentication:false) through the same assertion the live path uses"}}]},"signature":null,"keyId":null},{"seq":3,"prevHash":"406bc33ebb7bc993d999eef0601fc64e29e860ad8217056e6b0f758b1657173d","rowHash":"de88453dcf8ce378f60ed0d28bb9c06ab613cc243fcd2af375eec5c85aba3486","payload":{"schema":"steadywrk.mizan-attestation/v1","sealedAt":"2026-08-11T14:12:22.836Z","genesis_tag":"STEADYWRK-MIZAN-GENESIS-v1","registry":{"schema":"steadywrk.mizan-registry/v1","control_count":14,"registry_sha256":"ccf666dc2dead383725183711570075dcc470404d87d824bf121efbfa06934a2"},"engine":"security/mizan/run.mjs","counts":{"live":10,"dark":2,"cant_check":2},"controls":[{"control_id":"MZ-001","probe":"auth-gate-fires","ran_at":"2026-08-11T14:12:12.307Z","verdict":"LIVE","observed":"24/24 protected prefixes refused anonymously (7 x 307->/sign-in, 17 x opaque 404)","method":"GET https://steadywrk.app<each PROTECTED_PATH_PREFIXES entry>/<nonce> anonymously, redirect:manual -> status + Location","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"known-public paths correctly judged not-refused: /=200, /lab=200, /api/health=200","method":"GET https://steadywrk.app{/,/lab,/api/health} judged with the SAME refusal assertion (wrong input: these are public)"}},{"control_id":"MZ-002","probe":"employee-api-sealed","ran_at":"2026-08-11T14:12:13.352Z","verdict":"LIVE","observed":"3/3 sealed: /api/employee/documents=404 empty ct=text/plain, /api/employee/shifts=404 empty ct=text/plain, /api/employee/mizan-probe-msoqouyg=404 empty ct=text/plain [real routes indistinguishable from nonce path]","method":"GET https://steadywrk.app{/api/employee/documents,/api/employee/shifts,/api/employee/mizan-probe-msoqouyg} anonymously -> status + body","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"public endpoints correctly judged not-sealed: /api/health=status=200 len=15, /.well-known/did.json=status=200 len=858","method":"GET https://steadywrk.app{/api/health,/.well-known/did.json} judged with the SAME sealed-ness assertion (wrong input: these are public 200s)"}},{"control_id":"MZ-003","probe":"security-headers","ran_at":"2026-08-11T14:12:13.894Z","verdict":"LIVE","observed":"https://steadywrk.app/ 200 csp=[1482ch, default-src 'self'] hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY || https://steadywrk.app/api/health 200 csp=ABSENT hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY","method":"GET https://steadywrk.app/ (require CSP+HSTS+XCTO+XFO) and GET https://steadywrk.app/api/health (require HSTS+XCTO+XFO) -> response headers","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health missing csp; all 4 single-header knockouts on / rejected (csp,hsts,xcto,xfo)","method":"GET https://steadywrk.app/api/health judged with the DOCUMENT required-set [csp,hsts,xcto,xfo], plus the live headers from https://steadywrk.app/ with each required header deleted in turn, judged by the SAME assertion"}},{"control_id":"MZ-004","probe":"receipt-chain-verifies","ran_at":"2026-08-11T14:12:14.464Z","verdict":"LIVE","observed":"HTTP 200 steadywrk.app/api/public/receipt-chain; count=21 links=21; 21/21 leaves recomputed; fold reaches published head 392ccb6382b1...; sig valid but key is same-origin (not independent)","method":"GET https://steadywrk.app/api/public/receipt-chain -> recompute chain_n=SHA256(chain_{n-1}|n|ts|SHA256(canonical_json(receipt))) from chain_0=SHA256(genesis_tag); compare recomputed head to published head. The endpoint's own integrity claims are ignored.","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"10/10 single-byte/structural tampers across 2 baseline(s) (synthetic+live) reported as breaks; pristine baselines verified clean. The assertion can fail.","method":"Same recomputeChain() assertion as probe(), run against deliberately WRONG inputs: one hex character flipped in a link chain value, in a receipt_hash, in the head, plus an edited receipt body and a truncated prefix. Each must be reported broken; a pristine baseline must verify clean."}},{"control_id":"MZ-005","probe":"content-ledger-honest","ran_at":"2026-08-11T14:12:14.900Z","verdict":"CANT-CHECK","observed":"HTTP 200 count=0 links=0 head=null unsealed_rows=0; disclosure 484 chars present. Empty chain commits to nothing.","method":"GET https://steadywrk.app/api/public/content-ledger -> recompute chain_n=SHA256(chain_{n-1}|n|ts|hash) from chain_0=SHA256(genesis_tag) and compare to published head; separately assert integrity.does_not_prove is >=120 chars / >=2 sentences and non-boilerplate, and that integrity.signing matches what the response actually carries.","reason":"empty_chain_nothing_to_verify","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"7/7 tampers caught (4 chain: byte-flip in chain/hash/head + prefix truncation; 3 honesty: stripped, boilerplate, signature advertised but absent); pristine baseline verified clean. Both assertions can fail.","method":"Same recomputeChain() and checkHonesty() assertions as probe(), run against deliberately WRONG inputs built from a synthetic baseline: one hex character flipped in a row chain, in a row hash, and in the head; a truncated prefix; a stripped does_not_prove; a boilerplate does_not_prove; and signing.enabled=true carrying no signature. Each must be caught, and the pristine baseline must verify clean."}},{"control_id":"MZ-006","probe":"did-key-resolvable","ran_at":"2026-08-11T14:12:15.086Z","verdict":"LIVE","observed":"200 did:web:steadywrk.app — 2 verification method(s) valid. ed25519-2026-01: ed25519-pub, 32 key bytes; receipt-chain-ed25519-v1: ed25519-pub, 32 key bytes","method":"GET https://steadywrk.app/.well-known/did.json -> JSON, then base58btc-decode each publicKeyMultibase and check 0xED 0x01 + 32 bytes","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health as DID doc: id=null, expected did:web:steadywrk.app; truncated key: decoded 32 bytes, expected 34","method":"GET https://steadywrk.app/api/health judged as a DID document, plus the live publicKeyMultibase truncated by 4 chars judged by the SAME key check"}},{"control_id":"MZ-007","probe":"branch-protection","ran_at":"2026-08-11T14:12:15.469Z","verdict":"LIVE","observed":"branch=main allow_force_pushes=false enforce_admins=true required_contexts=[build-and-lint] strict=false allow_deletions=false required_signatures=false","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/main/protection","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately unprotected branch] branch=ascension/claim-liability: HTTP 404 \"Branch not protected\" — no protection object exists","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/ascension/claim-liability/protection"}},{"control_id":"MZ-008","probe":"actions-runner-owned","ran_at":"2026-08-11T14:12:17.552Z","verdict":"LIVE","observed":"26 runs-on in 25 executable file(s), all [self-hosted, Windows, X64]; runners online=1/1 (omen-steadywrk-1/Windows/self-hosted+Windows+X64); inert-but-hosted: npm-publish.yml.draft:34,npm-publish.yml.draft:70","method":"parse 25 .github/workflows/*.{yml,yaml} for runs-on + gh api -X GET repos/karimalsalah/steadywrk/actions/runners","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately hosted runners] 2 runs-on in 1 file(s); 2 not self-hosted: npm-publish.yml.draft:34 [ubuntu-latest]; npm-publish.yml.draft:70 [ubuntu-latest]","method":"[negative control] same parser over non-executable workflow files: npm-publish.yml.draft"}},{"control_id":"MZ-009","probe":"secret-scan-armed","ran_at":"2026-08-11T14:12:18.318Z","verdict":"DARK","observed":"secret-scan wiring absent: ci.yml has no SHA-pinned gitleaks-action step","method":"\"gitleaks\" dir \"C:/Users/youso/AppData/Local/Temp/mizan-scan-mAcPyU\" -c \"C:/Users/youso/dev/wt-mizan/.gitleaks.toml\" --report-format json --report-path \"C:/Users/youso/AppData/Local/Temp/mizan-scan-mAcPyU/report.json\" --no-banner --log-level error [version is set by build process]","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — corpus contains no secret] secret-scan wiring absent: ci.yml has no SHA-pinned gitleaks-action step","method":"\"gitleaks\" dir \"C:/Users/youso/AppData/Local/Temp/mizan-scan-OJnXWR\" -c \"C:/Users/youso/dev/wt-mizan/.gitleaks.toml\" --report-format json --report-path \"C:/Users/youso/AppData/Local/Temp/mizan-scan-OJnXWR/report.json\" --no-banner --log-level error [version is set by build process]"}},{"control_id":"MZ-010","probe":"no-metered-ci-spend","ran_at":"2026-08-11T14:12:18.719Z","verdict":"DARK","observed":"BREAKER TRIPPED — MTD net $98.90 (product=actions $98.90) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: account-wide karimalsalah, 51 items across 7 repo(s), 2026-08 UTC","method":"gh api -X GET users/karimalsalah/settings/billing/usage -f year=2026 -f month=8 -> sum(usageItems[].netAmount)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-threshold figure, not real spend] CAP BREACHED — MTD net $132.40 (product=actions $132.40) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: synthetic figure — no billing call made","method":"[negative control] evaluate(synthetic $132.40) through the same comparison the live path uses"}},{"control_id":"MZ-011","probe":"collaborator-inventory","ran_at":"2026-08-11T14:12:19.439Z","verdict":"LIVE","observed":"roster ENUMERATED ONLY — drift not assessed, no prior attestation to diff against. 3 write-capable: admin:karimalsalah, admin:usephedm, write:KarimCoSpace","method":"gh api -X GET repos/karimalsalah/steadywrk/collaborators -f affiliation=all -f per_page=100 -> filter permissions to write|maintain|admin, sort","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic roster with no write access] zero write-capable accounts enumerated from 2 collaborator record(s) — a repository with an owner cannot have an empty write roster, so this enumeration is not trustworthy","method":"[negative control] same permission filter + evaluate() over a synthetic read-only-only collaborator payload"}},{"control_id":"MZ-012","probe":"prod-deploy-matches-main","ran_at":"2026-08-11T14:12:20.124Z","verdict":"LIVE","observed":"prod=e899c43 via /standing-ledger (HTML, BUILD_HASH); main=e899c43acd71e9ec45bd03621d9605c5a0504b7c via gh/ls-remote; e899c43 is a prefix of e899c43acd71e9ec45bd03621d9605c5a0504b7c. Silent: /api/health 200 body={\"status\":\"ok\"} (no build field); no build header among 7 candidates","method":"GET /api/health (JSON + build headers: both silent by design) then GET /standing-ledger for BUILD_HASH; compared against `gh api repos/<repo>/commits/main --jq .sha` (fallback `git ls-remote`)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"comparator correctly rejected the wrong SHA: e899c43 != ffffffffffffffffffffffffffffffffffffffff. local build-info.ts=75f6613 vs prod: mismatch","method":"same comparator, wrong expected SHA (ffffffff…) against the real production build hash"}},{"control_id":"MZ-013","probe":"vulnerability-backlog","ran_at":"2026-08-11T14:12:21.419Z","verdict":"CANT-CHECK","observed":"8 open alert(s) [medium=5 high=3]; no ceiling recorded anywhere in the estate, so the bound cannot be evaluated","method":"gh api -X GET repos/karimalsalah/steadywrk/dependabot/alerts -f state=open -f per_page=100 -> count by security_advisory.severity","reason":"no_ceiling_recorded","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-ceiling backlog] 99 open alert(s) [medium=83 high=12 critical=4] exceeds ceiling 5 (synthetic ceiling)","method":"[negative control] evaluate(synthetic 99 open alerts vs synthetic ceiling 5) through the same comparison the live path uses"}},{"control_id":"MZ-014","probe":"mfa-on-owner-account","ran_at":"2026-08-11T14:12:22.226Z","verdict":"LIVE","observed":"account=karimalsalah (repo owner of karimalsalah): two_factor_authentication=true, read from the authenticated user record","method":"gh api -X GET user -> .login + .two_factor_authentication (compared against repo owner karimalsalah)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic payload, MFA deliberately false] account=karimalsalah: two_factor_authentication=false","method":"[negative control] evaluate(synthetic user payload with two_factor_authentication:false) through the same assertion the live path uses"}}]},"signature":null,"keyId":null},{"seq":4,"prevHash":"de88453dcf8ce378f60ed0d28bb9c06ab613cc243fcd2af375eec5c85aba3486","rowHash":"262a31fe092347a3e15cdf6bb783c956c0fd6a30cbd961f3ad1ea47bd6d2047d","payload":{"schema":"steadywrk.mizan-attestation/v1","sealedAt":"2026-08-11T14:13:18.004Z","genesis_tag":"STEADYWRK-MIZAN-GENESIS-v1","registry":{"schema":"steadywrk.mizan-registry/v1","control_count":14,"registry_sha256":"ccf666dc2dead383725183711570075dcc470404d87d824bf121efbfa06934a2"},"engine":"security/mizan/run.mjs","counts":{"live":11,"dark":1,"cant_check":2},"controls":[{"control_id":"MZ-001","probe":"auth-gate-fires","ran_at":"2026-08-11T14:13:07.710Z","verdict":"LIVE","observed":"24/24 protected prefixes refused anonymously (7 x 307->/sign-in, 17 x opaque 404)","method":"GET https://steadywrk.app<each PROTECTED_PATH_PREFIXES entry>/<nonce> anonymously, redirect:manual -> status + Location","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"known-public paths correctly judged not-refused: /=200, /lab=200, /api/health=200","method":"GET https://steadywrk.app{/,/lab,/api/health} judged with the SAME refusal assertion (wrong input: these are public)"}},{"control_id":"MZ-002","probe":"employee-api-sealed","ran_at":"2026-08-11T14:13:08.661Z","verdict":"LIVE","observed":"3/3 sealed: /api/employee/documents=404 empty ct=text/plain, /api/employee/shifts=404 empty ct=text/plain, /api/employee/mizan-probe-msoqq1l8=404 empty ct=text/plain [real routes indistinguishable from nonce path]","method":"GET https://steadywrk.app{/api/employee/documents,/api/employee/shifts,/api/employee/mizan-probe-msoqq1l8} anonymously -> status + body","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"public endpoints correctly judged not-sealed: /api/health=status=200 len=15, /.well-known/did.json=status=200 len=858","method":"GET https://steadywrk.app{/api/health,/.well-known/did.json} judged with the SAME sealed-ness assertion (wrong input: these are public 200s)"}},{"control_id":"MZ-003","probe":"security-headers","ran_at":"2026-08-11T14:13:09.068Z","verdict":"LIVE","observed":"https://steadywrk.app/ 200 csp=[1482ch, default-src 'self'] hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY || https://steadywrk.app/api/health 200 csp=ABSENT hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY","method":"GET https://steadywrk.app/ (require CSP+HSTS+XCTO+XFO) and GET https://steadywrk.app/api/health (require HSTS+XCTO+XFO) -> response headers","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health missing csp; all 4 single-header knockouts on / rejected (csp,hsts,xcto,xfo)","method":"GET https://steadywrk.app/api/health judged with the DOCUMENT required-set [csp,hsts,xcto,xfo], plus the live headers from https://steadywrk.app/ with each required header deleted in turn, judged by the SAME assertion"}},{"control_id":"MZ-004","probe":"receipt-chain-verifies","ran_at":"2026-08-11T14:13:09.709Z","verdict":"LIVE","observed":"HTTP 200 steadywrk.app/api/public/receipt-chain; count=21 links=21; 21/21 leaves recomputed; fold reaches published head 392ccb6382b1...; sig valid but key is same-origin (not independent)","method":"GET https://steadywrk.app/api/public/receipt-chain -> recompute chain_n=SHA256(chain_{n-1}|n|ts|SHA256(canonical_json(receipt))) from chain_0=SHA256(genesis_tag); compare recomputed head to published head. The endpoint's own integrity claims are ignored.","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"10/10 single-byte/structural tampers across 2 baseline(s) (synthetic+live) reported as breaks; pristine baselines verified clean. The assertion can fail.","method":"Same recomputeChain() assertion as probe(), run against deliberately WRONG inputs: one hex character flipped in a link chain value, in a receipt_hash, in the head, plus an edited receipt body and a truncated prefix. Each must be reported broken; a pristine baseline must verify clean."}},{"control_id":"MZ-005","probe":"content-ledger-honest","ran_at":"2026-08-11T14:13:10.137Z","verdict":"CANT-CHECK","observed":"HTTP 200 count=0 links=0 head=null unsealed_rows=0; disclosure 484 chars present. Empty chain commits to nothing.","method":"GET https://steadywrk.app/api/public/content-ledger -> recompute chain_n=SHA256(chain_{n-1}|n|ts|hash) from chain_0=SHA256(genesis_tag) and compare to published head; separately assert integrity.does_not_prove is >=120 chars / >=2 sentences and non-boilerplate, and that integrity.signing matches what the response actually carries.","reason":"empty_chain_nothing_to_verify","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"7/7 tampers caught (4 chain: byte-flip in chain/hash/head + prefix truncation; 3 honesty: stripped, boilerplate, signature advertised but absent); pristine baseline verified clean. Both assertions can fail.","method":"Same recomputeChain() and checkHonesty() assertions as probe(), run against deliberately WRONG inputs built from a synthetic baseline: one hex character flipped in a row chain, in a row hash, and in the head; a truncated prefix; a stripped does_not_prove; a boilerplate does_not_prove; and signing.enabled=true carrying no signature. Each must be caught, and the pristine baseline must verify clean."}},{"control_id":"MZ-006","probe":"did-key-resolvable","ran_at":"2026-08-11T14:13:10.329Z","verdict":"LIVE","observed":"200 did:web:steadywrk.app — 2 verification method(s) valid. ed25519-2026-01: ed25519-pub, 32 key bytes; receipt-chain-ed25519-v1: ed25519-pub, 32 key bytes","method":"GET https://steadywrk.app/.well-known/did.json -> JSON, then base58btc-decode each publicKeyMultibase and check 0xED 0x01 + 32 bytes","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health as DID doc: id=null, expected did:web:steadywrk.app; truncated key: decoded 32 bytes, expected 34","method":"GET https://steadywrk.app/api/health judged as a DID document, plus the live publicKeyMultibase truncated by 4 chars judged by the SAME key check"}},{"control_id":"MZ-007","probe":"branch-protection","ran_at":"2026-08-11T14:13:10.743Z","verdict":"LIVE","observed":"branch=main allow_force_pushes=false enforce_admins=true required_contexts=[build-and-lint] strict=false allow_deletions=false required_signatures=false","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/main/protection","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately unprotected branch] branch=ascension/claim-liability: HTTP 404 \"Branch not protected\" — no protection object exists","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/ascension/claim-liability/protection"}},{"control_id":"MZ-008","probe":"actions-runner-owned","ran_at":"2026-08-11T14:13:12.783Z","verdict":"LIVE","observed":"26 runs-on in 25 executable file(s), all [self-hosted, Windows, X64]; runners online=1/1 (omen-steadywrk-1/Windows/self-hosted+Windows+X64); inert-but-hosted: npm-publish.yml.draft:34,npm-publish.yml.draft:70","method":"parse 25 .github/workflows/*.{yml,yaml} for runs-on + gh api -X GET repos/karimalsalah/steadywrk/actions/runners","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately hosted runners] 2 runs-on in 1 file(s); 2 not self-hosted: npm-publish.yml.draft:34 [ubuntu-latest]; npm-publish.yml.draft:70 [ubuntu-latest]","method":"[negative control] same parser over non-executable workflow files: npm-publish.yml.draft"}},{"control_id":"MZ-009","probe":"secret-scan-armed","ran_at":"2026-08-11T14:13:13.594Z","verdict":"LIVE","observed":"wiring ok (direct pinned-binary invocation + in-CI negative control (detector proven able to fail on every run)); detector flagged 1 finding(s) [aws-access-token] on a freshly generated synthetic key using the repo .gitleaks.toml (allowlist in force)","method":"\"gitleaks\" dir \"C:/Users/youso/AppData/Local/Temp/mizan-scan-9ES5CX\" -c \"C:/Users/youso/dev/wt-mizan/.gitleaks.toml\" --report-format json --report-path \"C:/Users/youso/AppData/Local/Temp/mizan-scan-9ES5CX/report.json\" --no-banner --log-level error [version is set by build process]","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — corpus contains no secret] wiring ok (direct pinned-binary invocation + in-CI negative control (detector proven able to fail on every run)); detector reported 0 findings on the supplied corpus with the repo .gitleaks.toml (allowlist in force) — the assertion \"scanner f…","method":"\"gitleaks\" dir \"C:/Users/youso/AppData/Local/Temp/mizan-scan-E0A3el\" -c \"C:/Users/youso/dev/wt-mizan/.gitleaks.toml\" --report-format json --report-path \"C:/Users/youso/AppData/Local/Temp/mizan-scan-E0A3el/report.json\" --no-banner --log-level error [version is set by build process]"}},{"control_id":"MZ-010","probe":"no-metered-ci-spend","ran_at":"2026-08-11T14:13:13.961Z","verdict":"DARK","observed":"BREAKER TRIPPED — MTD net $98.90 (product=actions $98.90) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: account-wide karimalsalah, 51 items across 7 repo(s), 2026-08 UTC","method":"gh api -X GET users/karimalsalah/settings/billing/usage -f year=2026 -f month=8 -> sum(usageItems[].netAmount)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-threshold figure, not real spend] CAP BREACHED — MTD net $132.40 (product=actions $132.40) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: synthetic figure — no billing call made","method":"[negative control] evaluate(synthetic $132.40) through the same comparison the live path uses"}},{"control_id":"MZ-011","probe":"collaborator-inventory","ran_at":"2026-08-11T14:13:14.708Z","verdict":"LIVE","observed":"roster ENUMERATED ONLY — drift not assessed, no prior attestation to diff against. 3 write-capable: admin:karimalsalah, admin:usephedm, write:KarimCoSpace","method":"gh api -X GET repos/karimalsalah/steadywrk/collaborators -f affiliation=all -f per_page=100 -> filter permissions to write|maintain|admin, sort","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic roster with no write access] zero write-capable accounts enumerated from 2 collaborator record(s) — a repository with an owner cannot have an empty write roster, so this enumeration is not trustworthy","method":"[negative control] same permission filter + evaluate() over a synthetic read-only-only collaborator payload"}},{"control_id":"MZ-012","probe":"prod-deploy-matches-main","ran_at":"2026-08-11T14:13:15.310Z","verdict":"LIVE","observed":"prod=e899c43 via /standing-ledger (HTML, BUILD_HASH); main=e899c43acd71e9ec45bd03621d9605c5a0504b7c via gh/ls-remote; e899c43 is a prefix of e899c43acd71e9ec45bd03621d9605c5a0504b7c. Silent: /api/health 200 body={\"status\":\"ok\"} (no build field); no build header among 7 candidates","method":"GET /api/health (JSON + build headers: both silent by design) then GET /standing-ledger for BUILD_HASH; compared against `gh api repos/<repo>/commits/main --jq .sha` (fallback `git ls-remote`)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"comparator correctly rejected the wrong SHA: e899c43 != ffffffffffffffffffffffffffffffffffffffff. local build-info.ts=75f6613 vs prod: mismatch","method":"same comparator, wrong expected SHA (ffffffff…) against the real production build hash"}},{"control_id":"MZ-013","probe":"vulnerability-backlog","ran_at":"2026-08-11T14:13:16.657Z","verdict":"CANT-CHECK","observed":"8 open alert(s) [medium=5 high=3]; no ceiling recorded anywhere in the estate, so the bound cannot be evaluated","method":"gh api -X GET repos/karimalsalah/steadywrk/dependabot/alerts -f state=open -f per_page=100 -> count by security_advisory.severity","reason":"no_ceiling_recorded","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-ceiling backlog] 99 open alert(s) [medium=83 high=12 critical=4] exceeds ceiling 5 (synthetic ceiling)","method":"[negative control] evaluate(synthetic 99 open alerts vs synthetic ceiling 5) through the same comparison the live path uses"}},{"control_id":"MZ-014","probe":"mfa-on-owner-account","ran_at":"2026-08-11T14:13:17.392Z","verdict":"LIVE","observed":"account=karimalsalah (repo owner of karimalsalah): two_factor_authentication=true, read from the authenticated user record","method":"gh api -X GET user -> .login + .two_factor_authentication (compared against repo owner karimalsalah)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic payload, MFA deliberately false] account=karimalsalah: two_factor_authentication=false","method":"[negative control] evaluate(synthetic user payload with two_factor_authentication:false) through the same assertion the live path uses"}}]},"signature":null,"keyId":null},{"seq":5,"prevHash":"262a31fe092347a3e15cdf6bb783c956c0fd6a30cbd961f3ad1ea47bd6d2047d","rowHash":"30bc487e4ee7f2c153a67a003da6378957b5157e4c70136e239df5b19d4bab31","payload":{"schema":"steadywrk.mizan-attestation/v1","sealedAt":"2026-08-11T14:23:11.461Z","genesis_tag":"STEADYWRK-MIZAN-GENESIS-v1","registry":{"schema":"steadywrk.mizan-registry/v1","control_count":14,"registry_sha256":"ccf666dc2dead383725183711570075dcc470404d87d824bf121efbfa06934a2"},"engine":"security/mizan/run.mjs","counts":{"live":11,"dark":1,"cant_check":2},"controls":[{"control_id":"MZ-001","probe":"auth-gate-fires","ran_at":"2026-08-11T14:23:01.143Z","verdict":"LIVE","observed":"24/24 protected prefixes refused anonymously (7 x 307->/sign-in, 17 x opaque 404)","method":"GET https://steadywrk.app<each PROTECTED_PATH_PREFIXES entry>/<nonce> anonymously, redirect:manual -> status + Location","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"known-public paths correctly judged not-refused: /=200, /lab=200, /api/health=200","method":"GET https://steadywrk.app{/,/lab,/api/health} judged with the SAME refusal assertion (wrong input: these are public)"}},{"control_id":"MZ-002","probe":"employee-api-sealed","ran_at":"2026-08-11T14:23:02.420Z","verdict":"LIVE","observed":"3/3 sealed: /api/employee/documents=404 empty ct=text/plain, /api/employee/shifts=404 empty ct=text/plain, /api/employee/mizan-probe-msor2rpn=404 empty ct=text/plain [real routes indistinguishable from nonce path]","method":"GET https://steadywrk.app{/api/employee/documents,/api/employee/shifts,/api/employee/mizan-probe-msor2rpn} anonymously -> status + body","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"public endpoints correctly judged not-sealed: /api/health=status=200 len=15, /.well-known/did.json=status=200 len=858","method":"GET https://steadywrk.app{/api/health,/.well-known/did.json} judged with the SAME sealed-ness assertion (wrong input: these are public 200s)"}},{"control_id":"MZ-003","probe":"security-headers","ran_at":"2026-08-11T14:23:02.787Z","verdict":"LIVE","observed":"https://steadywrk.app/ 200 csp=[1482ch, default-src 'self'] hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY || https://steadywrk.app/api/health 200 csp=ABSENT hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY","method":"GET https://steadywrk.app/ (require CSP+HSTS+XCTO+XFO) and GET https://steadywrk.app/api/health (require HSTS+XCTO+XFO) -> response headers","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health missing csp; all 4 single-header knockouts on / rejected (csp,hsts,xcto,xfo)","method":"GET https://steadywrk.app/api/health judged with the DOCUMENT required-set [csp,hsts,xcto,xfo], plus the live headers from https://steadywrk.app/ with each required header deleted in turn, judged by the SAME assertion"}},{"control_id":"MZ-004","probe":"receipt-chain-verifies","ran_at":"2026-08-11T14:23:03.366Z","verdict":"LIVE","observed":"HTTP 200 steadywrk.app/api/public/receipt-chain; count=21 links=21; 21/21 leaves recomputed; fold reaches published head 392ccb6382b1...; sig valid but key is same-origin (not independent)","method":"GET https://steadywrk.app/api/public/receipt-chain -> recompute chain_n=SHA256(chain_{n-1}|n|ts|SHA256(canonical_json(receipt))) from chain_0=SHA256(genesis_tag); compare recomputed head to published head. The endpoint's own integrity claims are ignored.","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"10/10 single-byte/structural tampers across 2 baseline(s) (synthetic+live) reported as breaks; pristine baselines verified clean. The assertion can fail.","method":"Same recomputeChain() assertion as probe(), run against deliberately WRONG inputs: one hex character flipped in a link chain value, in a receipt_hash, in the head, plus an edited receipt body and a truncated prefix. Each must be reported broken; a pristine baseline must verify clean."}},{"control_id":"MZ-005","probe":"content-ledger-honest","ran_at":"2026-08-11T14:23:03.928Z","verdict":"CANT-CHECK","observed":"HTTP 200 count=0 links=0 head=null unsealed_rows=0; disclosure 484 chars present. Empty chain commits to nothing.","method":"GET https://steadywrk.app/api/public/content-ledger -> recompute chain_n=SHA256(chain_{n-1}|n|ts|hash) from chain_0=SHA256(genesis_tag) and compare to published head; separately assert integrity.does_not_prove is >=120 chars / >=2 sentences and non-boilerplate, and that integrity.signing matches what the response actually carries.","reason":"empty_chain_nothing_to_verify","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"7/7 tampers caught (4 chain: byte-flip in chain/hash/head + prefix truncation; 3 honesty: stripped, boilerplate, signature advertised but absent); pristine baseline verified clean. Both assertions can fail.","method":"Same recomputeChain() and checkHonesty() assertions as probe(), run against deliberately WRONG inputs built from a synthetic baseline: one hex character flipped in a row chain, in a row hash, and in the head; a truncated prefix; a stripped does_not_prove; a boilerplate does_not_prove; and signing.enabled=true carrying no signature. Each must be caught, and the pristine baseline must verify clean."}},{"control_id":"MZ-006","probe":"did-key-resolvable","ran_at":"2026-08-11T14:23:04.106Z","verdict":"LIVE","observed":"200 did:web:steadywrk.app — 2 verification method(s) valid. ed25519-2026-01: ed25519-pub, 32 key bytes; receipt-chain-ed25519-v1: ed25519-pub, 32 key bytes","method":"GET https://steadywrk.app/.well-known/did.json -> JSON, then base58btc-decode each publicKeyMultibase and check 0xED 0x01 + 32 bytes","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health as DID doc: id=null, expected did:web:steadywrk.app; truncated key: decoded 32 bytes, expected 34","method":"GET https://steadywrk.app/api/health judged as a DID document, plus the live publicKeyMultibase truncated by 4 chars judged by the SAME key check"}},{"control_id":"MZ-007","probe":"branch-protection","ran_at":"2026-08-11T14:23:04.475Z","verdict":"LIVE","observed":"branch=main allow_force_pushes=false enforce_admins=true required_contexts=[build-and-lint] strict=false allow_deletions=false required_signatures=false","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/main/protection","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately unprotected branch] branch=ascension/claim-liability: HTTP 404 \"Branch not protected\" — no protection object exists","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/ascension/claim-liability/protection"}},{"control_id":"MZ-008","probe":"actions-runner-owned","ran_at":"2026-08-11T14:23:06.391Z","verdict":"LIVE","observed":"27 runs-on in 26 executable file(s), all [self-hosted, Windows, X64]; runners online=1/1 (omen-steadywrk-1/Windows/self-hosted+Windows+X64); inert-but-hosted: npm-publish.yml.draft:34,npm-publish.yml.draft:70","method":"parse 26 .github/workflows/*.{yml,yaml} for runs-on + gh api -X GET repos/karimalsalah/steadywrk/actions/runners","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately hosted runners] 2 runs-on in 1 file(s); 2 not self-hosted: npm-publish.yml.draft:34 [ubuntu-latest]; npm-publish.yml.draft:70 [ubuntu-latest]","method":"[negative control] same parser over non-executable workflow files: npm-publish.yml.draft"}},{"control_id":"MZ-009","probe":"secret-scan-armed","ran_at":"2026-08-11T14:23:07.085Z","verdict":"LIVE","observed":"wiring ok (direct pinned-binary invocation + in-CI negative control (detector proven able to fail on every run)); detector flagged 1 finding(s) [aws-access-token] on a freshly generated synthetic key using the repo .gitleaks.toml (allowlist in force)","method":"\"gitleaks\" dir \"C:/Users/youso/AppData/Local/Temp/mizan-scan-YbiCxx\" -c \"C:/Users/youso/dev/wt-mizan/.gitleaks.toml\" --report-format json --report-path \"C:/Users/youso/AppData/Local/Temp/mizan-scan-YbiCxx/report.json\" --no-banner --log-level error [version is set by build process]","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — corpus contains no secret] wiring ok (direct pinned-binary invocation + in-CI negative control (detector proven able to fail on every run)); detector reported 0 findings on the supplied corpus with the repo .gitleaks.toml (allowlist in force) — the assertion \"scanner f…","method":"\"gitleaks\" dir \"C:/Users/youso/AppData/Local/Temp/mizan-scan-daKMAr\" -c \"C:/Users/youso/dev/wt-mizan/.gitleaks.toml\" --report-format json --report-path \"C:/Users/youso/AppData/Local/Temp/mizan-scan-daKMAr/report.json\" --no-banner --log-level error [version is set by build process]"}},{"control_id":"MZ-010","probe":"no-metered-ci-spend","ran_at":"2026-08-11T14:23:07.498Z","verdict":"DARK","observed":"BREAKER TRIPPED — MTD net $98.93 (product=actions $98.93) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: account-wide karimalsalah, 51 items across 7 repo(s), 2026-08 UTC","method":"gh api -X GET users/karimalsalah/settings/billing/usage -f year=2026 -f month=8 -> sum(usageItems[].netAmount)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-threshold figure, not real spend] CAP BREACHED — MTD net $132.40 (product=actions $132.40) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: synthetic figure — no billing call made","method":"[negative control] evaluate(synthetic $132.40) through the same comparison the live path uses"}},{"control_id":"MZ-011","probe":"collaborator-inventory","ran_at":"2026-08-11T14:23:08.211Z","verdict":"LIVE","observed":"roster ENUMERATED ONLY — drift not assessed, no prior attestation to diff against. 3 write-capable: admin:karimalsalah, admin:usephedm, write:KarimCoSpace","method":"gh api -X GET repos/karimalsalah/steadywrk/collaborators -f affiliation=all -f per_page=100 -> filter permissions to write|maintain|admin, sort","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic roster with no write access] zero write-capable accounts enumerated from 2 collaborator record(s) — a repository with an owner cannot have an empty write roster, so this enumeration is not trustworthy","method":"[negative control] same permission filter + evaluate() over a synthetic read-only-only collaborator payload"}},{"control_id":"MZ-012","probe":"prod-deploy-matches-main","ran_at":"2026-08-11T14:23:08.782Z","verdict":"LIVE","observed":"prod=e899c43 via /standing-ledger (HTML, BUILD_HASH); main=e899c43acd71e9ec45bd03621d9605c5a0504b7c via gh/ls-remote; e899c43 is a prefix of e899c43acd71e9ec45bd03621d9605c5a0504b7c. Silent: /api/health 200 body={\"status\":\"ok\"} (no build field); no build header among 7 candidates","method":"GET /api/health (JSON + build headers: both silent by design) then GET /standing-ledger for BUILD_HASH; compared against `gh api repos/<repo>/commits/main --jq .sha` (fallback `git ls-remote`)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"comparator correctly rejected the wrong SHA: e899c43 != ffffffffffffffffffffffffffffffffffffffff. local build-info.ts=75f6613 vs prod: mismatch","method":"same comparator, wrong expected SHA (ffffffff…) against the real production build hash"}},{"control_id":"MZ-013","probe":"vulnerability-backlog","ran_at":"2026-08-11T14:23:10.126Z","verdict":"CANT-CHECK","observed":"8 open alert(s) [medium=5 high=3]; no ceiling recorded anywhere in the estate, so the bound cannot be evaluated","method":"gh api -X GET repos/karimalsalah/steadywrk/dependabot/alerts -f state=open -f per_page=100 -> count by security_advisory.severity","reason":"no_ceiling_recorded","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-ceiling backlog] 99 open alert(s) [medium=83 high=12 critical=4] exceeds ceiling 5 (synthetic ceiling)","method":"[negative control] evaluate(synthetic 99 open alerts vs synthetic ceiling 5) through the same comparison the live path uses"}},{"control_id":"MZ-014","probe":"mfa-on-owner-account","ran_at":"2026-08-11T14:23:10.848Z","verdict":"LIVE","observed":"account=karimalsalah (repo owner of karimalsalah): two_factor_authentication=true, read from the authenticated user record","method":"gh api -X GET user -> .login + .two_factor_authentication (compared against repo owner karimalsalah)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic payload, MFA deliberately false] account=karimalsalah: two_factor_authentication=false","method":"[negative control] evaluate(synthetic user payload with two_factor_authentication:false) through the same assertion the live path uses"}}]},"signature":null,"keyId":null},{"seq":6,"prevHash":"30bc487e4ee7f2c153a67a003da6378957b5157e4c70136e239df5b19d4bab31","rowHash":"d769352f88e79e6da5a103b8a521769cbcba2ef035fbc283ff7644ec424872bb","payload":{"schema":"steadywrk.mizan-attestation/v1","sealedAt":"2026-08-13T04:23:30.519Z","genesis_tag":"STEADYWRK-MIZAN-GENESIS-v1","registry":{"schema":"steadywrk.mizan-registry/v1","control_count":14,"registry_sha256":"ccf666dc2dead383725183711570075dcc470404d87d824bf121efbfa06934a2"},"engine":"security/mizan/run.mjs","counts":{"live":8,"dark":0,"cant_check":6},"controls":[{"control_id":"MZ-001","probe":"auth-gate-fires","ran_at":"2026-08-13T04:23:19.305Z","verdict":"LIVE","observed":"24/24 protected prefixes refused anonymously (7 x 307->/sign-in, 17 x opaque 404)","method":"GET https://steadywrk.app<each PROTECTED_PATH_PREFIXES entry>/<nonce> anonymously, redirect:manual -> status + Location","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"known-public paths correctly judged not-refused: /=200, /lab=200, /api/health=200","method":"GET https://steadywrk.app{/,/lab,/api/health} judged with the SAME refusal assertion (wrong input: these are public)"}},{"control_id":"MZ-002","probe":"employee-api-sealed","ran_at":"2026-08-13T04:23:20.560Z","verdict":"LIVE","observed":"3/3 sealed: /api/employee/documents=404 empty ct=text/plain, /api/employee/shifts=404 empty ct=text/plain, /api/employee/mizan-probe-msr0j9ct=404 empty ct=text/plain [real routes indistinguishable from nonce path]","method":"GET https://steadywrk.app{/api/employee/documents,/api/employee/shifts,/api/employee/mizan-probe-msr0j9ct} anonymously -> status + body","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"public endpoints correctly judged not-sealed: /api/health=status=200 len=15, /.well-known/did.json=status=200 len=858","method":"GET https://steadywrk.app{/api/health,/.well-known/did.json} judged with the SAME sealed-ness assertion (wrong input: these are public 200s)"}},{"control_id":"MZ-003","probe":"security-headers","ran_at":"2026-08-13T04:23:21.070Z","verdict":"LIVE","observed":"https://steadywrk.app/ 200 csp=[1482ch, default-src 'self'] hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY || https://steadywrk.app/api/health 200 csp=ABSENT hsts=max-age=63072000; includeSubDomains; pr… xcto=nosniff xfo=DENY","method":"GET https://steadywrk.app/ (require CSP+HSTS+XCTO+XFO) and GET https://steadywrk.app/api/health (require HSTS+XCTO+XFO) -> response headers","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health missing csp; all 4 single-header knockouts on / rejected (csp,hsts,xcto,xfo)","method":"GET https://steadywrk.app/api/health judged with the DOCUMENT required-set [csp,hsts,xcto,xfo], plus the live headers from https://steadywrk.app/ with each required header deleted in turn, judged by the SAME assertion"}},{"control_id":"MZ-004","probe":"receipt-chain-verifies","ran_at":"2026-08-13T04:23:21.778Z","verdict":"LIVE","observed":"HTTP 200 steadywrk.app/api/public/receipt-chain; count=21 links=21; 21/21 leaves recomputed; fold reaches published head 392ccb6382b1...; sig valid but key is same-origin (not independent)","method":"GET https://steadywrk.app/api/public/receipt-chain -> recompute chain_n=SHA256(chain_{n-1}|n|ts|SHA256(canonical_json(receipt))) from chain_0=SHA256(genesis_tag); compare recomputed head to published head. The endpoint's own integrity claims are ignored.","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"10/10 single-byte/structural tampers across 2 baseline(s) (synthetic+live) reported as breaks; pristine baselines verified clean. The assertion can fail.","method":"Same recomputeChain() assertion as probe(), run against deliberately WRONG inputs: one hex character flipped in a link chain value, in a receipt_hash, in the head, plus an edited receipt body and a truncated prefix. Each must be reported broken; a pristine baseline must verify clean."}},{"control_id":"MZ-005","probe":"content-ledger-honest","ran_at":"2026-08-13T04:23:22.426Z","verdict":"CANT-CHECK","observed":"HTTP 200 count=0 links=0 head=null unsealed_rows=0; disclosure 484 chars present. Empty chain commits to nothing.","method":"GET https://steadywrk.app/api/public/content-ledger -> recompute chain_n=SHA256(chain_{n-1}|n|ts|hash) from chain_0=SHA256(genesis_tag) and compare to published head; separately assert integrity.does_not_prove is >=120 chars / >=2 sentences and non-boilerplate, and that integrity.signing matches what the response actually carries.","reason":"empty_chain_nothing_to_verify","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"7/7 tampers caught (4 chain: byte-flip in chain/hash/head + prefix truncation; 3 honesty: stripped, boilerplate, signature advertised but absent); pristine baseline verified clean. Both assertions can fail.","method":"Same recomputeChain() and checkHonesty() assertions as probe(), run against deliberately WRONG inputs built from a synthetic baseline: one hex character flipped in a row chain, in a row hash, and in the head; a truncated prefix; a stripped does_not_prove; a boilerplate does_not_prove; and signing.enabled=true carrying no signature. Each must be caught, and the pristine baseline must verify clean."}},{"control_id":"MZ-006","probe":"did-key-resolvable","ran_at":"2026-08-13T04:23:22.615Z","verdict":"LIVE","observed":"200 did:web:steadywrk.app — 2 verification method(s) valid. ed25519-2026-01: ed25519-pub, 32 key bytes; receipt-chain-ed25519-v1: ed25519-pub, 32 key bytes","method":"GET https://steadywrk.app/.well-known/did.json -> JSON, then base58btc-decode each publicKeyMultibase and check 0xED 0x01 + 32 bytes","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"both wrong inputs rejected — /api/health as DID doc: id=null, expected did:web:steadywrk.app; truncated key: decoded 32 bytes, expected 34","method":"GET https://steadywrk.app/api/health judged as a DID document, plus the live publicKeyMultibase truncated by 4 chars judged by the SAME key check"}},{"control_id":"MZ-007","probe":"branch-protection","ran_at":"2026-08-13T04:23:23.001Z","verdict":"CANT-CHECK","observed":"probe said CANT-CHECK: branch=main: gh failed: Resource not accessible by integration gh: Resource not accessible by integration (HTTP 403) || negative control returned CANT-CHECK (expected DARK): [negative control — deliberately unprotected branch] branch=ascension/claim-liability: gh failed: Reso…","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/main/protection","reason":"negative_control_did_not_fail","negative_control_ok":false,"negative_control":{"verdict":"CANT-CHECK","observed":"[negative control — deliberately unprotected branch] branch=ascension/claim-liability: gh failed: Resource not accessible by integration gh: Resource not accessible by integration (HTTP 403)","method":"gh api -X GET repos/karimalsalah/steadywrk/branches/ascension/claim-liability/protection","reason":"github_api_call_failed"}},{"control_id":"MZ-008","probe":"actions-runner-owned","ran_at":"2026-08-13T04:23:24.864Z","verdict":"CANT-CHECK","observed":"all 27 runs-on self-hosted; runner registry unreadable: gh: Resource not accessible by integration (HTTP 403)","method":"parse 26 .github/workflows/*.{yml,yaml} for runs-on + gh api -X GET repos/karimalsalah/steadywrk/actions/runners","reason":"runner_registry_unreadable","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — deliberately hosted runners] 2 runs-on in 1 file(s); 2 not self-hosted: npm-publish.yml.draft:34 [ubuntu-latest]; npm-publish.yml.draft:70 [ubuntu-latest]","method":"[negative control] same parser over non-executable workflow files: npm-publish.yml.draft"}},{"control_id":"MZ-009","probe":"secret-scan-armed","ran_at":"2026-08-13T04:23:25.434Z","verdict":"LIVE","observed":"wiring ok (direct pinned-binary invocation + in-CI negative control (detector proven able to fail on every run)); detector flagged 1 finding(s) [aws-access-token] on a freshly generated synthetic key using the repo .gitleaks.toml (allowlist in force)","method":"\"gitleaks\" dir \"C:/Windows/SERVIC~1/NETWOR~1/AppData/Local/Temp/mizan-scan-pYcpAT\" -c \"C:/actions-runner/_work/steadywrk/steadywrk/.gitleaks.toml\" --report-format json --report-path \"C:/Windows/SERVIC~1/NETWOR~1/AppData/Local/Temp/mizan-scan-pYcpAT/report.json\" --no-banner --log-level error [8.30.1]","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — corpus contains no secret] wiring ok (direct pinned-binary invocation + in-CI negative control (detector proven able to fail on every run)); detector reported 0 findings on the supplied corpus with the repo .gitleaks.toml (allowlist in force) — the assertion \"scanner f…","method":"\"gitleaks\" dir \"C:/Windows/SERVIC~1/NETWOR~1/AppData/Local/Temp/mizan-scan-znEa0Q\" -c \"C:/actions-runner/_work/steadywrk/steadywrk/.gitleaks.toml\" --report-format json --report-path \"C:/Windows/SERVIC~1/NETWOR~1/AppData/Local/Temp/mizan-scan-znEa0Q/report.json\" --no-banner --log-level error [8.30.1]"}},{"control_id":"MZ-010","probe":"no-metered-ci-spend","ran_at":"2026-08-13T04:23:26.581Z","verdict":"CANT-CHECK","observed":"spend not verified: gh exit 1: gh: Resource not accessible by integration (HTTP 403). This is NOT a $0.00 reading.","method":"gh api -X GET users/karimalsalah/settings/billing/usage -f year=2026 -f month=8 -> sum(usageItems[].netAmount)","reason":"billing_figure_unverified","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-threshold figure, not real spend] CAP BREACHED — MTD net $132.40 (product=actions $132.40) vs breaker $90.00 / cap $100.00; threshold source: committed estate constant (scripts/ops/spend-probe.mjs); scope: synthetic figure — no billing call made","method":"[negative control] evaluate(synthetic $132.40) through the same comparison the live path uses"}},{"control_id":"MZ-011","probe":"collaborator-inventory","ran_at":"2026-08-13T04:23:27.111Z","verdict":"LIVE","observed":"roster ENUMERATED ONLY — drift not assessed, no prior attestation to diff against. 3 write-capable: admin:karimalsalah, admin:usephedm, write:KarimCoSpace","method":"gh api -X GET repos/karimalsalah/steadywrk/collaborators -f affiliation=all -f per_page=100 -> filter permissions to write|maintain|admin, sort","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic roster with no write access] zero write-capable accounts enumerated from 2 collaborator record(s) — a repository with an owner cannot have an empty write roster, so this enumeration is not trustworthy","method":"[negative control] same permission filter + evaluate() over a synthetic read-only-only collaborator payload"}},{"control_id":"MZ-012","probe":"prod-deploy-matches-main","ran_at":"2026-08-13T04:23:27.671Z","verdict":"LIVE","observed":"prod=9b51b45 via /standing-ledger (HTML, BUILD_HASH); main=9b51b45127b4945665cf1937cc0a93b8c59e438f via gh/ls-remote; 9b51b45 is a prefix of 9b51b45127b4945665cf1937cc0a93b8c59e438f. Silent: /api/health 200 body={\"status\":\"ok\"} (no build field); no build header among 7 candidates","method":"GET /api/health (JSON + build headers: both silent by design) then GET /standing-ledger for BUILD_HASH; compared against `gh api repos/<repo>/commits/main --jq .sha` (fallback `git ls-remote`)","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"comparator correctly rejected the wrong SHA: 9b51b45 != ffffffffffffffffffffffffffffffffffffffff. local build-info.ts=75f6613 vs prod: mismatch","method":"same comparator, wrong expected SHA (ffffffff…) against the real production build hash"}},{"control_id":"MZ-013","probe":"vulnerability-backlog","ran_at":"2026-08-13T04:23:29.477Z","verdict":"CANT-CHECK","observed":"alert enumeration failed: HTTP 403 / Dependabot alerts disabled for this repository. Not reported as zero open alerts.","method":"gh api -X GET repos/karimalsalah/steadywrk/dependabot/alerts -f state=open -f per_page=100 -> count by security_advisory.severity","reason":"alerts_endpoint_unavailable_or_disabled","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic over-ceiling backlog] 99 open alert(s) [medium=83 high=12 critical=4] exceeds ceiling 5 (synthetic ceiling)","method":"[negative control] evaluate(synthetic 99 open alerts vs synthetic ceiling 5) through the same comparison the live path uses"}},{"control_id":"MZ-014","probe":"mfa-on-owner-account","ran_at":"2026-08-13T04:23:29.966Z","verdict":"CANT-CHECK","observed":"could not read the authenticated user record: gh exit 1: gh: Resource not accessible by integration (HTTP 403)","method":"gh api -X GET user -> .login + .two_factor_authentication (compared against repo owner karimalsalah)","reason":"user_endpoint_unreadable","negative_control_ok":true,"negative_control":{"verdict":"DARK","observed":"[negative control — synthetic payload, MFA deliberately false] account=karimalsalah: two_factor_authentication=false","method":"[negative control] evaluate(synthetic user payload with two_factor_authentication:false) through the same assertion the live path uses"}}]},"signature":null,"keyId":null}],"integrity":{"signing":{"enabled":false,"reason":"No entry in this chain carries a signature: no MIZAN signing key is seated where the runs are sealed. These entries are hash-linked only — they prove the rows are mutually consistent, not that we authored them. Nothing here is signed and nothing here claims to be."},"proves":"The head is a pure function of the entries published here. Recompute prevHash_1 from SHA256(genesis_tag), fold each entry forward with the formula above, and compare to head. Changing any byte of any observation, any verdict, or any does-not-prove string changes the head. If you recorded a head on an earlier visit and it still matches, nothing before it has been rewritten since.","does_not_prove":"That the probes fired, or fired against production. The chain commits to what the probes SAID they saw; it cannot tell you they ran, and a fabricated `observed` string hashes exactly as well as a true one. Read each control's `method` and re-run security/mizan/probes/ yourself — they are published for that reason. That a LIVE verdict means the control is sound: LIVE means one probe saw one thing work at one moment, and the registry's `does_not_prove` for that control states the rest. That history was never rewritten: the same party serves the entries and the head, so recomputation shows internal consistency at this moment and becomes tamper-evident against us only once YOU hold an old head. And, specifically for this chain: it is unsigned unless integrity.signing.enabled is true, so it identifies no author at all."},"cross_check":{"spec":"https://steadywrk.app/spec/receipt-chain","verifier":"node security/mizan/verify.mjs https://steadywrk.app/api/public/mizan","page":"https://steadywrk.app/trust/live","note":"This envelope matches steadywrk.receipt-chain/v1 and steadywrk.content-ledger/v1 so one verifier shape covers all three, but the LINK FORMULA here is MIZAN's own and is stated in full above. Do not assume the receipt-chain formula applies to this feed."}}