jobtrackingapp/docs/cv-integration-qa/SECURITY_AND_PRIVACY.md

# Security and privacy — 2026-10-27

Decision: **CONDITIONAL** for isolated development; production **NO-GO**. Review uses the repository security-auditor workflow and Codex Security static diff review, with separate actual test evidence. No production Docker, MariaDB, filesystem, model cache or service was changed.

## Changed-source review

Codex Security scan `9196450b-d1cb-4625-ae79-039c210ce881` completed and sealed for immutable `ef425c2..89974a2`: **zero findings**, 22 host inventory entries plus 13 supplementary changed paths, 35 total, no deleted paths or deferred review tasks. Canonical threat model, coverage, report and SARIF are retained under `C:/Users/Connor/.codex/state/plugins/codex-security/scans/Job-tracker/89974a257e4192b3d93779000a7df6998afc4051_20261026T232811Z_cjmnex0o/`. The newer checkout includes subsequent documentation; scanned source was read immutably. A sealed per-file note for `ProfileCvController.cs` mistakenly describes translations; the actual lifecycle diff was inspected and the canonical threat model correctly describes it. No claim depends on that note.

All three capability preflight checks passed; no user configuration was changed. The account advisory reported Daybreak not granted, which may limit display of protected results and did not gate the scan. Workbench usage reports 9,039,853 total / 9,016,404 input / 8,725,888 cached input tokens across three threads (`codex_rollout`); this is host-attributed usage, **not isolated incremental scan cost**. Static review cannot prove runtime exploitation resistance, deployment isolation or production readiness.

After that immutable scan, four test/config/fixture-generator files were independently reviewed. Three assertion gaps were tightened before execution: timeout cannot count as connection-failure success, details must belong to each correct job, and effective template/page settings must match. Actual provider80, the long real-browser case, fresh frontend995/109, TypeScript, lint and independent PDF oracles passed. These additions change no application behavior; they are not misrepresented as part of the sealed35-path tool scan.

## Boundaries and actual checks

| Boundary | Current protection and verification |
|---|---|
| Upload type/size/spoofing | Existing authenticated admission, signature/extension validation, 5 MiB and page/archive limits, duplicate/pending caps retained; full backend and parser security suites remain enabled. |
| PDF/DOCX active content | Existing external/active payload, DTD/resolver, archive expansion/ratio/path and malicious PDF rejection retained. Real malformed/truncated/native document tests rerun; arbitrary document safety is not guaranteed. |
| Parser resource/privacy | One parser child, private temporary environment, bounded time/CPU and POSIX resources, offline network/process restrictions, read-only isolated container. Native parser dependencies remain a patching obligation. |
| Mapping/model output | Owned source block required, category/field/target/count/value allowlists, whole-token source matching and explicit corrections. Caller cannot author provenance/IDs. Local model seam remains disabled; synthetic schema/adversarial tests do not establish real inference quality. |
| Owner and tenant | Run/artifact/review/source/profile lookup remains authenticated owner-scoped. Actual browser strangers receive 404 for source/review; no caller tenant ID controls lookup. |
| Revision and terminal races | Existing atomic canonical revision/history/projection plus status concurrency, narrow MariaDB 1020 handling, bounded retention reload and terminal retry/cancel guards; real MariaDB race/rollback/replay evidence in MARIA_DB_AND_RD21.md. |
| Original/source access | Owned private path, `no-store`, browser source hash equals uploaded bytes. Extracted text is untrusted display content. |
| Cleanup | Two simultaneous synthetic sidecar requests returned one 200 and one 503 busy; `/tmp` had zero work directories before and after. Retention/cancellation/orphan and failure tests remain enabled; this bounded check is not a sustained abuse/load test. |

The isolated test sidecars used immutable image `sha256:8a29cb90fcc2817b0d784826d55a172c943f5ad7e1b6105e690a2d79ee15fe87`, loopback-only, read-only, 1 GiB memory, two CPU quota, 128 PIDs, 512 MiB temporary filesystem. Both owned containers were removed and their exact identities verified absent. Linux API/database/schema/network cleanup and final provider cleanup also passed. Windows extraction working set is measured; the parser's memory argument is not a kernel memory ceiling on Windows. The Python audit hook is defense in depth, not a native sandbox.

Actual MariaDB session termination after writes/before commit is covered by the final80-case lane: no success acknowledgement, pending/no-receipt state and empty canonical facts/history after rollback, followed by one durable retry/replay. This closes that narrow interruption test; it does not qualify whole-server outage, storage power loss or production recovery.

Original files/raw extraction/block JSON expire after seven days, or one day for failed/cancelled/discarded work, plus up to the hourly sweep interval while running. Startup cleanup catches overdue work. Deletion failures retain references for retry. Applied candidates, including unselected extracted evidence, audit decisions/receipts and canonical history persist under existing account deletion/retention rules; original-source expiry does not erase this history. Privacy/operator review must account for that distinction and backup retention.

## Current advisories and inherited gates

Fresh independent checks in `.artifacts/cv-integration-qa/independent-02/`: npm audited 881 dependencies with zero reported vulnerabilities; the CV-import Python lock audited 48 dependencies with zero reported advisories/skips. `dotnet-audit-02.json` lists no vulnerable API packages including transitive packages. All native commands exited zero. These are point-in-time advisory checks, not proof against undisclosed flaws. The first NuGet wrapper attempt used an unsupported flag and is retained separately; only the corrected native command establishes this result.

Latest authoritative P9-SEC-02 records distinguish 99 fixed/version-verified dispositions and 10 scoped exclusions from the original109, with Python dependency security **CONDITIONAL PASS**. Its trained-model/cache compatibility PASS is scoped to the immutable BART artifact. The installed dependency scan still remained incomplete for vendor CPU `torch==2.13.0+cpu`, absent from the queried PyPI record; current slim-lock auditing does not close that gap. These historical findings are neither all unresolved nor globally cleared. No new exception or owner risk acceptance is granted here. Hosted MariaDB isolation, deployed identity, production filesystem integrity, off-disk backup and restore qualification remain unverified/blocked. No CV Ollama artifact or real inference was qualified. Deployment configuration, OS ACLs and physical security require owner/operator evidence before release.