The threat model is SPEC §2.1 (what must remain impossible), with the mathematical triage in MATH.md and the boundary register.
This page lists the reviews that changed it. Each is recorded at the fix site in the code and pinned by a test. No named external reviewer has reviewed Mirror yet. When one does, they are listed here with their consent, and not before.
| Review | What it found | What changed | Pinned by |
|---|---|---|---|
| Leg authentication (internal, marked Sev-0 at the fix site) | With unsigned legs accepted, the operator's signature was the only thing behind a clear: the operator could copy one member's commitments into another's slot | Strict leg signing is the default; the opt-out expires on 2026-12-01 and cannot be extended | server/core.js, server/cutover.test.js |
| Blind join key (internal, Sev-0) | A plaintext shipment reference let the operator's logs draw the correspondent graph | Locator commitments; plaintext refused after the cutover date | kernel/mirror-locator.js, server/cutover.test.js |
| Transport (internal) | The operator API had no HSTS or CSP while the static site did; HEAD /jwks returned 404 | Security headers on every response; HEAD routed as GET | worker/src/index.js, server/app.js |
| Strategy review: independent witnesses (September 2026) | Two desks stating the same number could mint a clear | The independence gate: no clear without a ratified witness | kernel/mirror-independence-gate.js, server/independence-gate-routes.test.js |
| The mathematical gaps (September 2026) | A label is not proven to be its value's band; malleable signatures; the pricing basis is not compared; pairwise secrets | Precise assertion (not_proven_here), origin binding, basis commitment, low-S signatures, pairwise ECDH; the ZK proof commissioned rather than hand-rolled | MATH.md, server/label-integrity-routes.test.js, kernel/mirror-malleability.test.js |
| Deal-gate review (September 2026) | Procurement blockers: custody, rotation, push delivery, per-desk permissions, API description | HSM custody, rehearsed rotation, signed webhooks, delegated scoped keys, OpenAPI 3.1, signed provenance | server/webhooks.test.js, server/delegation.test.js, server/rotation-rehearsal.test.js, server/openapi.test.js |
| This round's own tests (September 2026) | A failover bander re-signing the same legs was counted as a second verdict; an unreachable HSM produced a silently unbandable batch; an unrecordable governance event could split isolates | The idempotency key ignores signature bytes; the bander stops when the HSM stops; events are durable before they change state | server/bander-ha.test.js, server/degradation.test.js |
What an external review would be asked to attack first#
- The independence gate and the witness registry: can a stakeholder obtain a witness-class key?
- The raw-data wall's key normalisation, against the published corpus.
- Delegation and scope enforcement: can a delegate widen its scopes or outlive a revocation?
- Webhook delivery: SSRF through DNS rebinding and redirects.
- The claim in
/cannotthat the operator can hold no staff directory and no secret.