# 2026-09-01 Security Assessment Remediation Queue

Priority supersedes the unfinished PIN hardware-validation queue; that queue remains preserved in
`tasks/plan.md` and `tasks/todo.md` for follow-up.

- [ ] PB-26-025 - Remove plaintext signing secrets; complete exposure and rotation decision.
  - [x] v2.14.90 no longer reads release credentials from `local.properties`; protected environment injection is mandatory and release tasks fail closed.
  - [x] `local.properties` is excluded by both `.kohignore` and `.gitignore`.
  - [x] Remove the four obsolete secret entries from the ignored local file; only `sdk.dir` remains.
  - [x] Formally retain the existing signer: `local.properties` appears in zero local Koh manifests and zero of 812 remote manifests; the 0600 keystore remains under `~/.peach-release`, and live v2.14.79 plus local v2.14.96 share certificate `e10b…7668`. Rotate only if separate compromise/backup exposure evidence emerges.
  - [ ] Produce and verify a signed release from a fresh protected environment.
- [ ] PB-26-026 - Enable and validate release shrinking.
  - [x] v2.14.91 enables R8 minification and resource shrinking with a reviewed minimal project rules file.
  - [x] Full JVM/lint/release build passes; both signed split APKs are approximately 7.5-7.7 MiB and R8 mapping/usage/configuration artifacts exist.
  - [ ] Run the release device smoke matrix for unlock, autofill, passkeys, updates, import/crypto, and sync/pairing when a device is attached.
- [x] PB-26-027 - Restrict external URL dispatch to canonical HTTPS (v2.14.92, focused abuse-case tests plus full JVM/lint/shrunk-release gate).
- [ ] PB-26-028 - Require independently signed update metadata.
  - [x] Trust-path discovery: Peach currently parses Kepr JSON directly; Kepr emits unsigned release rows; Koh has a verifier schema but no production metadata-signing producer.
  - [x] Choose the personal Peach vault as custodian; Koh reads only a one-shot protected environment value and Kepr never receives the seed.
  - [x] Checkpoint and implement the publication path: production Koh v2.1.1 signs the canonical per-platform envelope and Kepr v2.0.19 stores/serves it byte-for-byte. The earlier compatibility-port implementation remains supplemental, not the production publisher.
  - [x] Pin the production public key in Peach v2.14.97; unsigned, unknown-key, malformed, and alternate-URL metadata are rejected before download.
  - [ ] Confirm the generated seed was copied into the personal Peach vault. The temporary 0600 file is already absent; custody remains UNCONFIRMED rather than inferred.
  - [x] Deploy Kepr v2.0.19; install the signed-metadata-aware production Koh v2.1.1 locally. Functional deploy checks and both live release JSON parsers pass; the upload gate decodes real 64-byte Ed25519 signatures, while three pre-existing latency thresholds remain over budget.
  - [ ] Publish a fresh signed Peach release after the metadata seed and four APK-signing values are injected directly into the release shell.
  - [x] Verify local stale/rollback behavior: signed-manifest tests and version-order tests pass; equal and older versions are not offered as updates.
  - [ ] Verify one end-to-end signed publication without exposing private key material.
- [x] PB-26-029 - Remove demo credential literals from production source and release artifacts (v2.14.93; source path removed and both shrunk split APKs/R8 outputs scanned clean).
- [x] PB-26-030 - Require informed consent for DuckDuckGo favicon inventory disclosure (pre-existing v2.14.74 resolution independently revalidated against v2.14.94).
- [x] PB-26-031 - Restrict release logging to redacted opaque events (v2.14.95; all sync logging centralized, fixed release vocabulary tested, full JVM/lint/shrunk-release gate).
- [x] PB-26-032 - Pin Rust toolchain and native artifact provenance (v2.14.96; exact compiler/Cargo enforcement, locked host/NDK builds, generated provenance, byte-identical four-target rebuild).
- [x] PB-26-033 - Validate favicon hosts and contain cache paths at the helper boundary (v2.14.94; RED/GREEN traversal and canonical-host tests plus full JVM/lint/shrunk-release gate).

## Checkpoints

- [ ] Release-root blockers PB-26-025 through PB-26-027 verified and saved atomically.
- [ ] Integrity/privacy findings PB-26-028 through PB-26-031 verified and saved atomically.
- [ ] Supply-chain/helper findings PB-26-032 and PB-26-033 verified and saved atomically.
- [ ] Full final gate and finding-to-save evidence matrix complete.