V14 ~ Race to Heavy Audits

We will have frontier-level AI audits

Six independent frontier models audited src/ (the on-disk layer, in-memory VFS, and FUSE frontend). This document is the resolution ledger: every finding, whether it was fixed, and — when it wasn't — the justification.

Legend

✅ Fixed — code changed to address the finding (commit referenced).
❌ Not fixed — no code change; justification follows (invalid, by design, deferred, or already-correct). Per the project rule, an ❌ always carries a reason.

Tally

Auditor	Date	Findings	✅ Fixed	❌ Not fixed (justified)
Grok (xAI)	2026-05-27	16	4	12
OpenAI GPT-5.5	2026-06-03	8	8	0
Claude Opus 4.8	2026-06-03	6	5	1
Qwen3-235B-A22B-Thinking	2026-06-03	10	3	7
DeepSeek V4 (pi)	2026-06-03	8 actionable	3	5
Claude Fable 5 (Anthropic)	2026-06-11	8	6	2

Net: every finding across all five audits is either fixed or carries a documented reason it stands. No genuine showstopper survived. Source audits verified against the current tree (make tests WERROR=1, make test 7/7, make verify 77/0/3).

Grok

Audit: audit/20260527_Grok_Audit.md · Replies: audit/20260527_Grok_Claude_Reply.md, audit/20260527_Grok_ChatGPT_reply.md · tested at commit 499e5cb. Architectural review (~19 files, ~7k LOC). Grok scored 7.2/10; the point-by-point reply adjusted to 8.0/10 after refuting the findings that didn't survive a read of the mount invocation.

#	Finding (severity)	Status	Justification / commit
1.1	Global mutex reentrancy → deadlock (Critical)	❌	Not a bug — FUSE is mounted single-threaded (`-s`, `mount_phase9.sh`). One worker, zero concurrent callbacks; the mutex serializes for a future MT upgrade.
1.2	Cross-dir rename replay leaves file in both dirs (Critical)	✅	Investigated as V13 Finding E and proven NOT reproducible — the dual-slot shadow/primary inode table prevents the duplicate on recovery (crash harness: file lands in source only). Documented in `known-limitations.html`.
1.3	Transaction/durability holes; free blocks but leave inode (Critical)	❌	By design — Option A (write-through data, deferred dirents), not ACID. Block rollback present on every failure path. Bonus: error-path inode-zero-before-free ordering further hardened this cycle (`cb99ce3`).
1.4	Extent rollback missing; `reconcile_bitmap` never called (Critical)	❌	Not a bug — `s64_bitmap_clear_ranges` runs on every failure path; `s64_fs_reconcile_bitmap` is invoked from `load_from_fs` when repairs are detected.
2.1	Namespace mutation races during readdir	❌	Not a bug — single-threaded FUSE; no concurrent mutation possible.
2.2	Orphan/unlink races; fragile nlink=0	❌	Not a bug — single-threaded; `release_orphan` runs under the global mutex on the one thread.
2.3	Multiple path-split implementations	❌	Not a bug — four functions serve distinct roles (traversal vs parent/base vs heap vs fuse-local); no failure case shown.
2.4	ENOTEMPTY "ghost children"	❌	Documented behavior — trace tooling is evidence the area was validated (V10/V11 xfstests), not that it is broken.
3.a	Symlink target not length-validated (Security)	❌	Not a bug — explicit `ENAMETOOLONG` check on target length in `s64_vfs.c`.
3.b	No permission enforcement (Security)	❌	By design — removable flash media target; DAC out of scope, documented.
3.c	TOCTOU in create/rename (Security)	❌	Not a bug — single-threaded; no check-to-act window.
3.d	`s64_get_caller_info` (`/proc`) on every readdir	✅	Fixed — removed from the readdir path; remaining calls only inside `S64_DEBUG_OPS` blocks.
3.e	Unconditional `fprintf` in unlink/rmdir/rename	✅	Fixed — gated behind `S64_DEBUG_OPS` (V13), and all remaining `src/` stderr gated behind `S64_DEBUG` (`8f5492f`).
4	Single global lock; flush-all-dirty-dirs on fsync (Perf)	❌	Deferred by design — correctness-first; documented `TODO(v5)` to target only the parent dir.
5.a	`s64_alloc.c/h` look abandoned	❌	Cosmetic observation; retained.
5.b	Missing fsck-style checker	❌	Not a bug — `tools/slim64fs_check.c` (~900 LOC) exists.

OpenAI GPT5.5

Audit: audit/20260603_gpt5.5_audit.md. Manual read of src/ focused on malformed-image hardening, extreme-size arithmetic, and ENOMEM rollback. All eight findings fixed.

Finding (severity)	Status	Justification / commit
Superblock geometry trusted before validation (High)	✅	`e8a4250` — `s64_validate_super_geometry()` (+ follow-on `inode_count` validator bugfix that had rejected valid images).
Decoded extents/runs not range-validated (High)	✅	`e8a4250` — `s64_extent_range_valid()` in decode/read/write.
File-size block rounding overflow (Med)	✅	`e8a4250` — overflow-safe layout/extend/write.
`s64_inode_table_add` silent ENOMEM (Med)	✅	`e8a4250` — returns int; add-then-rollback via `unstage`.
`write_file_disk` leak + NULL-buf (Med)	✅	`e8a4250` — payload-before-namespace reservation; NULL-buf rejected.
Dirlog name truncated before validation (Low)	✅	`45b2d0e` — reject `strlen > S64_NAME_MAX` before the `uint16_t` cast.
`s64_meta_lookup_child` always NULL (Low)	✅	`cb99ce3` — deleted (dead, broken-by-design).
Tracked stale `src/slim64fs_src.zip` (Low)	✅	`44ad588` — `git rm`.

Claude Opus 4.8

Audit: audit/20260603_claude_audit.md. Independent read of src/ for findings beyond the GPT-5.5 set.

#	Finding (severity)	Status	Justification / commit
1	Superblock CRC computed two inconsistent ways (Med)	✅	`a3ddd48` — single `s64_super_crc()` over the serialized form at all four sites.
2	`resolve_path` miss-path stderr spew + double lookup (Low/Med)	✅	`a3ddd48` — miss path returns NULL; no stderr, no redundant lookup.
3	`s64_create` never sets `fi->fh` (Cosmetic)	❌	Won't-fix by design — leak disproven (libfuse hidden-file lifecycle); assigning `fi->fh` would activate the dead `release_orphan` path for `.create` fds. No benefit.
4	`s64_extent_map_encode` oversized header count (Low)	✅	`45b2d0e` — encoder clamps `inline_count` to `S64_EXT_INLINE_MAX`.
5	Unbounded dirlog tail-walk → cycle hang (Low)	✅	`45b2d0e` — append tail-walk depth-capped (4096), mirroring `chain_ok`.
6	Missing NULL-source guards in meta helpers (Very Low)	✅	`a3ddd48` — guards added to `meta_write_file`/`read_file`.

We will also introduce a few Chinese variants so we do not get (Sins of Adam) problems.

Qwen3-235B-A22B-Thinking-2507

Audit: audit/20260603_qwen_audit.md. Ten findings framed against the Five Invariants. Several "Critical" items are misframed: under anticipatory sequencing, in-memory mutations are not durable until s64_fs_checkpoint, so a crash before checkpoint reverts to the last committed shadow — there is no persistent on-disk state to corrupt.

#	Finding (claimed sev)	Status	Justification / commit
1	Shadow init = primary at format (Critical)	❌	Rejected — the proposed fix is harmful. Zeroing `shadow_*_crc32c` at format would break dual-slot recovery. Current behavior is correct.
2	Alloc cursor updated before bitmap flush (Critical)	❌	Not a bug — cursor is in-memory; the bitmap isn't durable until checkpoint; a crash reverts.
3	Cross-block dirent validation gap (Critical)	❌	Invalid — `s64_dirent_validate_record` already rejects `reclen > block_size - offset`; records cannot span blocks.
4	Namespace dual-directory state on crash (Critical)	❌	Misframed — rename is not atomic on disk until checkpoint; dual-slot prevents the duplicate (see Grok 1.2 / V13 Finding E).
5	Orphan inode zeroed after block free (Critical)	✅	`cb99ce3` — zero the inode before freeing blocks (6 sites).
6	Unconditional debug logging in hot path (High)	✅	`cb99ce3` (+ `8f5492f`) — `[s64] detach` removed; all `src/` stderr gated behind `S64_DEBUG`.
7	Dirlog truncated after checkpoint (High)	❌	Misframed — dirlog replay is idempotent; worst case is slightly longer recovery, never corruption.
8	static/extern linkage conflict (High)	❌	Invalid — `s64_dirent_validate_record` is external (not `static`); builds clean.
9	Redundant inode read for mtime (Medium)	❌	Won't-fix — perf micro-opt, not correctness.
10	Error-path resource ordering (Medium)	✅	`cb99ce3` — same zero-before-free swap as #5.

DeepSeekV4-Flash

Audit: audit/20260603_deepseek_audit.md (pi coding agent). 25 findings, most self-verified safe in the audit itself; the actionable subset:

#	Finding (severity)	Status	Justification / commit
1 / 3	`s64_meta_lookup_child` returns NULL on match (High)	✅	`cb99ce3` — deleted (dead code).
2	static/extern linkage conflict (High)	❌	Invalid — function is external, not `static`; builds clean under WERROR.
18	Debug stderr spam every namespace mutation (Med)	✅	`cb99ce3` (+ `8f5492f`) — `detach` prints removed; `src/` stderr gated behind `S64_DEBUG`.
19	Block-free before inode-zero ordering (Med)	✅	`cb99ce3` — zero inode first, then free.
23	Partial write visible after failed merged-alloc (Low-Med)	❌	Accepted — in-place writes aren't durable until checkpoint; a crash reverts to the last commit.
16 / 20	Discarded return / double inode read (Low)	❌	Won't-fix — perf/style, not correctness.
5	Uninitialized `replaced_ino` in rename rollback (Low)	❌	Not a bug — guarded by `target_found`; never read uninitialized.
4–15, 17, 21, 22, 24, 25	Various	❌	Not bugs — deepseek self-verified these "safe/correct" in the audit; re-confirmed against the tree.

Claude Fable 5

Audit: pre-publish scrub of all 21 src/ files (~8.5k LOC), 2026-06-11. Fixes logged in logs/v14/v14.0-fable5-audit.ok. Verified: strict build (-Wall -Wextra -Wpedantic -Wconversion -Werror) clean, make test 7/7, make verify 77/0/3.

#	Finding (severity)	Status	Justification / reference
1	`s64_dirlog_replay_dir` walk unbounded → cyclic chain hangs mount; replay runs before `chain_ok` in `load_from_fs` (Med)	✅	Sibling gap of Opus 4.8 #5 (`45b2d0e` capped the append walk, missed the replay walk). 4096 depth cap added, mirroring `chain_ok`; exceed treated as stale chain.
2	Varargs UB in recovery debug logging: `uint32_t generation` passed for `%PRIu64` (10 sites), `uint64_t magic` for `%08x` (Med, debug-only)	✅	Root cause: `s64_open_debugf` lacked the printf `format` attribute, so `-Wformat -Werror` never inspected these. Attribute added; all call sites corrected (`PRIu32`/`PRIx64`); compiler now enforces. Garbage output on x86-64, arg misalignment on 32-bit ARM — the stated embedded target.
3	Failed same-parent rename leaves complete FROM/TO dirlog pair → crash-replay applies a rename the caller saw fail (Low, OOM+crash window)	✅	`rename_rollback` now appends a reversing FROM/TO pair (plus a CREATE restoring a displaced target whose inode is intact). Cross-parent pairs need no compensation — split across two per-directory logs, replay already reverts them. Rollback also now preserves the original errno.
4	`s64_txn_header` serialized by raw host-endian struct memcpy — the one on-disk structure bypassing the LE encoders (Low, portability)	✅	Explicit field-wise LE encode/decode + CRC over the serialized form. Byte-identical on little-endian hosts; existing images unaffected.
5	`s64_fs_format` size-checks regular files but not block devices against requested geometry (Low)	✅	`lseek(SEEK_END)` check added; undersized device → `ENOSPC` instead of writes past the device end.
6	`create`/`mkdir` discard `s64_vfs_chmod_disk` return — requested mode can silently not apply (Low)	✅	Return propagated in both FUSE callbacks.
7	`truncate`/non-append rewrite materialize the whole file in RAM (`calloc(new_size)`) — `truncate(f, 100G)` attempts a 100GB allocation (Med, DoS-shaped)	❌	Enshrined — documented in `known-limitations.html` (V14 section). Block-level truncate is a redesign of the rewrite path, out of scope for the audit round; bounded by volume size in practice.
8	`s64_create` never sets `fi->fh` (Cosmetic)	❌	Duplicate of Opus 4.8 #3 — already adjudicated won't-fix by design; ledger decision stands.

Cleared on inspection (no finding): readlink NUL-termination, checkpoint write/fsync ordering, bitmap-cache coherence on ENOSPC rollback paths, alloc_run skip arithmetic, extent-map range validation, alloc-cursor wrap invariants, unlink-while-open (libfuse hidden-file lifecycle).

Closure

Commits delivering the source fixes:

e8a4250 — GPT-5.5 malformed/extreme-state hardening (+ validator bugfix)
a3ddd48 — superblock CRC unification, log-spew removal, meta guards
cb99ce3 — deepseek/qwen Medium+ (dead meta_lookup_child, detach spam, error-path zero-before-free)
45b2d0e — low-severity malformed-input (dirlog cycle cap, dirlog name guard, extent-encode clamp)
8f5492f — gate all src/ debug stderr behind S64_DEBUG
44ad588 — remove stale tracked src/slim64fs_src.zip
546add7 — Fable 5 fixes: replay depth cap, format-attribute enforcement, rename-rollback compensation, txn LE serialization, block-device size check, chmod propagation (logs/v14/v14.0-fable5-audit.ok)

Six frontier models, one ledger, zero surviving showstoppers.

V14.1 — Fable 5 Deep Audit Round (2026-07-08 → 2026-07-09)

A second, deeper Fable 5 pass: full manual line-by-line scan of src/ (all 21 files) plus the build system, producing two standing reports in audit/:

audit/2026-07-08_security_recommendations.md — 13 findings (2 HIGH, 6 MEDIUM, 5 LOW), each with estimated diff size. Resolution: all 13 fixed (commit 0681eed), verified per finding (double-mount EBUSY, mkfs EEXIST/--force, deep-path ops, mode/owner enforcement under default_permissions, no ino recycling under a live handle, legacy-image mount compatibility for the commit-CRC change).
audit/2026-07-08_optimization_recommendations.md — 12 findings ranked by impact/effort. Fixed: O4 (statfs from bitmap cache), O5 (mtime folded into fs-layer write paths), O6 (dirlog tail cache, O(chain)→O(1) appends), O8 (batched data I/O + stack buffers) in the first batch (0681eed); then the three CRITICAL items — O1 (release build now -O2 -DNDEBUG; hardware CRC32C via a target("sse4.2") function attribute with runtime dispatch, replacing the #if defined(__SSE4_2__) guard that compiled the hardware path out of the default build — CRC throughput ~10.8× on the dev host, 1.15→12.4 GB/s, making Invariant 4 true of the shipped binary at last), O2 (debug verification gated behind !NDEBUG — the O(n²) per-op inode-read scans leave the release hot path), and O3 (per-bitmap-block dirty tracking — allocation no longer rewrites the whole bitmap; verified CLEAN on a 4-bitmap-block image under scattered churn). Open (next wave): O7 incremental checkpoint, O9–O12. Media re-baseline (docs/media-matrix.html, captured on the old software-CRC binary) is a tracked V14.2 item.

Also delivered under V14.1:

Directory depth ≤ 16 promoted from documented constraint to writer-enforced invariant (S64_DIR_DEPTH_MAX, ENAMETOOLONG; baby_xfstests 106; writer-MUST / reader-SHOULD-tolerate; rename edge enshrined in known-limitations.html).
Doc accuracy pass (e8bbd38): format.html commit-CRC coverage corrected to the true 104 bytes (100-byte wire + 4 enshrined zero-pad bytes — the previous "bytes 0–99" text would have produced non-matching CRCs for any independent implementer); filename-encoding, releasedir, permissions, and LOC claims aligned with code; slim64fs.org re-rendered in sync.
Shootout: POSIX permissions — → shared ✅ win (b0763de) — stored uid/gid/mode are now kernel-enforced, caller ownership at create.

Commits: 0681eed (fixes), 41511bd (clean-rebuild gate evidence), e8bbd38 (doc accuracy), b0763de (shootout), fd0e820 (O1/O2/O3 perf fix — build flags + HW CRC, gate debug verify, dirty bitmap). Gates: strict build clean, make test 7/7, make verify 78/0/3 (test 106 added), run_v9_ci PASS. On-disk format unchanged (V9 0x00090002); core LOC 7,755 (cloc, 2026-07-09, after fd0e820).

Same model, second look, thirteen more findings — the ledger stays open as long as the findings keep coming.

V14.1.1 — Same-Day Follow-Up Pass (2026-07-10)

A seventh independent model — ChatGPT 5.6 — audited src/ and produced two standing reports (audit/2026-07-10_security_audit.md, audit/2026-07-10_optimization_audit.md): 13 security findings and 11 performance findings. The four cheapest, highest-confidence findings were fixed the same day rather than queued for a future wave.

Fixed:

Security O4 — s64_fs_format refused an existing valid image without --force but truncated any other pre-existing regular file; a wrong path or symlink race could destroy unrelated data. O_NOFOLLOW on the non-block-device open path, plus refusal of every pre-existing regular file without --force, not only ones with a valid superblock.
Security O1 (quick mitigation) — s64_vfs_load_from_fs accepted an attacker/corruption-controlled directory size up to the whole allocatable region and treated an allocation/read failure as an empty directory, risking a silently-vacated tree and subsequent data loss on write. Split into s64_vfs_load_from_fs() (tolerant — unchanged, used by fsck and diagnostic tooling that must be able to open a corrupted image to repair it) and a new s64_vfs_load_from_fs_strict() (used only by the FUSE mount path) that fails the whole mount instead of silently loading an empty directory. The full streaming/validating-parser rewrite remains open for V14.2.
Optimization P2 — statfs still popcounted the entire cached bitmap under the global mutex on every call. s64_fs now carries an incremental free-block counter maintained by the bitmap set/clear mutators (transition-aware, since free is idempotent); statfs is O(1).
Optimization P8 — mkdir timestamped the new directory and its parent via two separate read-modify-write passes on top of writes s64_vfs_mkdir_disk already makes. Both folded into the existing writes; net LOC negative.
Optimization P9c — deleted ~220 LOC of if (1) return;-gated namespace/readdir debug scaffolding, dead since it was written.

Open: O1's full streaming rewrite, O2/O3/O5 (security), P1/P3–P7/P9a–b (optimization) — tracked in the two 2026-07-10 audit reports for V14.2.

Verification: make all clean (zero warnings), make test 7/7, make verify 78/0/3 unchanged, real_phase9_smoke.sh matched the pre-pass baseline exactly (32/56 — confirmed via git stash that the 24 "idempotence" fails are that harness's own deliberate commit-block corruption, not a regression). Core LOC 7,489 (cloc, 2026-07-10) — the first V14.x pass to net LOC-negative, driven almost entirely by P9c's dead-code removal.