Summary
Low-severity items from the 2026-08-23 adversarial audit of v0.4.0 @ b460d70 — batched; each a small standalone fix.
1. TS MathGuard vacuous passes (CONFIRMED)
String output ("total should be 999") and total without subtotal both pass — the guard only acts when both keys exist. Python MathGuard has similar shape-dependence. Either verify what's present or return a distinct "no verifiable math found" status that isn't passed.
2. TS parseResponse accepts everything (CONFIRMED — folds into the cross-language parity issue for the fix)
parseResponse wraps numbers/arrays/anything as {type:'unknown', raw} and verification proceeds (verified=true under empty guards). Python raises ValueError. Align strictness.
3. No request/trace IDs anywhere (STATIC)
Results carry self-reported generation timestamps only — no correlation ID, no tool-call ID. Operators cannot reconstruct which response a verdict belonged to across logs. Ties to the forgeability finding's binding fix.
4. datetime.utcnow() deprecated (STATIC)
core.py:56 — removed in Python 3.12+ direction; use datetime.now(timezone.utc). Hygiene.
5. npm/node_modules/ untracked in working tree (STATIC)
Local install artifact sitting untracked in the repo root — add to .gitignore to avoid accidental commits.
Summary
Low-severity items from the 2026-08-23 adversarial audit of v0.4.0 @
b460d70— batched; each a small standalone fix.1. TS MathGuard vacuous passes (CONFIRMED)
String output ("total should be 999") and
totalwithoutsubtotalboth pass — the guard only acts when both keys exist. Python MathGuard has similar shape-dependence. Either verify what's present or return a distinct "no verifiable math found" status that isn'tpassed.2. TS parseResponse accepts everything (CONFIRMED — folds into the cross-language parity issue for the fix)
parseResponsewraps numbers/arrays/anything as{type:'unknown', raw}and verification proceeds (verified=true under empty guards). Python raises ValueError. Align strictness.3. No request/trace IDs anywhere (STATIC)
Results carry self-reported generation timestamps only — no correlation ID, no tool-call ID. Operators cannot reconstruct which response a verdict belonged to across logs. Ties to the forgeability finding's binding fix.
4.
datetime.utcnow()deprecated (STATIC)core.py:56 — removed in Python 3.12+ direction; use
datetime.now(timezone.utc). Hygiene.5.
npm/node_modules/untracked in working tree (STATIC)Local install artifact sitting untracked in the repo root — add to .gitignore to avoid accidental commits.