2026-09-01 Security Assessment Remediation Queue

Priority supersedes the unfinished PIN hardware-validation queue; that queue remains preserved in tasks/plan.md and tasks/todo.md for follow-up.

• [ ] PB-26-025 - Remove plaintext signing secrets; complete exposure and rotation decision.
  • [x] v2.14.90 no longer reads release credentials from local.properties; protected environment injection is mandatory and release tasks fail closed.
  • [x] local.properties is excluded by both .kohignore and .gitignore.
  • [x] Remove the four obsolete secret entries from the ignored local file; only sdk.dir remains.
  • [x] Formally retain the existing signer: local.properties appears in zero local Koh manifests and zero of 812 remote manifests; the 0600 keystore remains under ~/.peach-release, and live v2.14.79 plus local v2.14.96 share certificate e10b…7668. Rotate only if separate compromise/backup exposure evidence emerges.
  • [ ] Produce and verify a signed release from a fresh protected environment.
• [ ] PB-26-026 - Enable and validate release shrinking.
  • [x] v2.14.91 enables R8 minification and resource shrinking with a reviewed minimal project rules file.
  • [x] Full JVM/lint/release build passes; both signed split APKs are approximately 7.5-7.7 MiB and R8 mapping/usage/configuration artifacts exist.
  • [ ] Run the release device smoke matrix for unlock, autofill, passkeys, updates, import/crypto, and sync/pairing when a device is attached.
• [x] PB-26-027 - Restrict external URL dispatch to canonical HTTPS (v2.14.92, focused abuse-case tests plus full JVM/lint/shrunk-release gate).
• [ ] PB-26-028 - Require independently signed update metadata.
  • [x] Trust-path discovery: Peach currently parses Kepr JSON directly; Kepr emits unsigned release rows; Koh has a verifier schema but no production metadata-signing producer.
  • [x] Choose the personal Peach vault as custodian; Koh reads only a one-shot protected environment value and Kepr never receives the seed.
  • [x] Checkpoint and implement the publication path: production Koh v2.1.1 signs the canonical per-platform envelope and Kepr v2.0.19 stores/serves it byte-for-byte. The earlier compatibility-port implementation remains supplemental, not the production publisher.
  • [x] Pin the production public key in Peach v2.14.97; unsigned, unknown-key, malformed, and alternate-URL metadata are rejected before download.
  • [ ] Confirm the generated seed was copied into the personal Peach vault. The temporary 0600 file is already absent; custody remains UNCONFIRMED rather than inferred.
  • [x] Deploy Kepr v2.0.19; install the signed-metadata-aware production Koh v2.1.1 locally. Functional deploy checks and both live release JSON parsers pass; the upload gate decodes real 64-byte Ed25519 signatures, while three pre-existing latency thresholds remain over budget.
  • [ ] Publish a fresh signed Peach release after the metadata seed and four APK-signing values are injected directly into the release shell.
  • [x] Verify local stale/rollback behavior: signed-manifest tests and version-order tests pass; equal and older versions are not offered as updates.
  • [ ] Verify one end-to-end signed publication without exposing private key material.
• [x] PB-26-029 - Remove demo credential literals from production source and release artifacts (v2.14.93; source path removed and both shrunk split APKs/R8 outputs scanned clean).
• [x] PB-26-030 - Require informed consent for DuckDuckGo favicon inventory disclosure (pre-existing v2.14.74 resolution independently revalidated against v2.14.94).
• [x] PB-26-031 - Restrict release logging to redacted opaque events (v2.14.95; all sync logging centralized, fixed release vocabulary tested, full JVM/lint/shrunk-release gate).
• [x] PB-26-032 - Pin Rust toolchain and native artifact provenance (v2.14.96; exact compiler/Cargo enforcement, locked host/NDK builds, generated provenance, byte-identical four-target rebuild).
• [x] PB-26-033 - Validate favicon hosts and contain cache paths at the helper boundary (v2.14.94; RED/GREEN traversal and canonical-host tests plus full JVM/lint/shrunk-release gate).

Checkpoints

• [ ] Release-root blockers PB-26-025 through PB-26-027 verified and saved atomically.
• [ ] Integrity/privacy findings PB-26-028 through PB-26-031 verified and saved atomically.
• [ ] Supply-chain/helper findings PB-26-032 and PB-26-033 verified and saved atomically.
• [ ] Full final gate and finding-to-save evidence matrix complete.