Measured security, dated

Not measured since 2026-09-14 — this statement is withheld until it is re-measured.

Measured:

2026-09-14 · GitHub Actions · CI run 34796640258 (suite) · operator:ashley@cyntech.co.za (table counts, build seat, ORDER B §4.2a)

Scope:

The production database, public schema, measured from pg_class and pg_policies. The isolation suite runs against a freshly migrated throwaway database in CI, seeding two tenants as ordinary members with no app role; it proves the policies, not production data. The one unforced table (github_connection_config) carries no tenant_id. Platform administrators hold a declared read authority over device data across workspaces (N-685); this is disclosed, not hidden by the count.

Evidence:

ci_run — CI run 34796640258 · DB Migrations & Tenant Isolation · bun run test:isolation · PASS: 123 probes, 0 cross-tenant leaks open

Reopened if:

A public base table is created without FORCE ROW LEVEL SECURITY (force-rls-coverage, daily); a tenant_id table is found unforced; the isolation suite fails on develop or main.

Not measured since 2026-09-13 — this statement is withheld until it is re-measured.

Measured:

2026-09-13 · GitHub Actions · CI run 34786787610

Scope:

The lockfile this project resolves from (bun.lock), development and runtime dependencies together. Advisories below high are listed in the job log and are not zero.

Evidence:

ci_run — CI run 34786787610 · Dependency Audit (blocking, high/critical) open

Reopened if:

A new high or critical advisory is published against a pinned version (the job goes red); the audit step is removed from build.needs.

Not measured since 2026-09-14 — this statement is withheld until it is re-measured.

Measured:

2026-09-14 · operator:ashley@cyntech.co.za (build seat, ORDER B §4.2c)

Scope:

Accounts holding the admin or editor role in user_roles. Workspace (tenant) users are not counted here. This is an enrolment count, not a login-time count.

Evidence:

query — user_roles ⨝ auth.mfa_factors (status = 'verified'), 14 Sep 2026 01:10Z; receipt AR4-mfa-enforcement

Reopened if:

A privileged role is granted or revoked; a factor is unenrolled; the enforcement mode changes. The figure is re-measured and the date advanced, never edited in place.

Not measured since 2026-09-14 — this statement is withheld until it is re-measured.

Measured:

2026-09-14 · operator:ashley@cyntech.co.za (build seat, ORDER B §4.2d, re-measured §6)

Scope:

The CI workflows in this repository and the pg_cron schedule for the backup. 'Completed' means status ok with a manifest row; 'verified' means an independent read-back matched the manifest byte for byte — the two dates differ and both are printed. Nothing described here runs daily except the backup attempt; there is no daily vulnerability scan and the page no longer says there is.

Evidence:

receipt — N-724 (28 Aug export read back through getObject, SHA-256 9cbbf77f…, 4 of 4 manifest fields match); offsite_backup_runs run_date 2026-09-10 (status ok, manifest present, total_rows 14659276, total_bytes 10504084499); watchdog_findings offsite-backup-artifact subject offsite-backup:run:2026-09-10 = run_not_reconciled, 14 Sep 01:07Z; .github/workflows/ci.yml; security-scan.yml; N-728

Reopened if:

A job is removed from build.needs or set continue-on-error; the Semgrep schedule changes; a backup run completes or the failures are dispositioned (the dates above are then re-measured).

Every response carries HSTS (max-age 63072000; includeSubDomains; preload), X-Content-Type-Options nosniff, X-Frame-Options DENY, Referrer-Policy strict-origin-when-cross-origin, a Permissions-Policy denying powerful APIs, COOP same-origin, CORP same-site and a Content-Security-Policy whose script-src is a per-request nonce with 'strict-dynamic' and no 'unsafe-eval' or 'unsafe-inline'. These are set in the server entry; they are not currently asserted by an automated test.

Measured:

2026-09-13 · operator:ashley@cyntech.co.za (build seat, ORDER A §3) · Good until 2026-12-12

Scope:

Responses served by src/server.ts. style-src still allows 'unsafe-inline' (component library inline styles) — stated in N-728. The hstspreload.org submission has not been made.

Evidence:

receipt — N-728 (CSP nonce, unsafe-eval removed, 13 Sep 2026); src/server.ts

Reopened if:

A directive is loosened in src/server.ts; a CSP violation report reaches /api/public/csp-report; a header test is added (the claim is then re-based on the test).

Device telemetry arrives over MQTT with TLS, on a per-integration token. Each message is idempotent on (integration_id, msg_id); a repeat with the same value is counted and dropped, a repeat with a different value is quarantined with both values kept. Nothing is derived from a device's data until a person has onboarded it and declared each metric's class.

Measured:

2026-09-13 · operator:ashley@cyntech.co.za (basis of design Rev E) · Good until 2026-12-12

Scope:

The Nexus ingest path as designed and governed. Messages are not individually signed by the device; integrity rests on TLS and the broker token, not on a payload signature.

Evidence:

document — docs/00-basis-of-design-RevE.md — Payload and Onboarding sections; receipt N-402 (dedup and quarantine)

Reopened if:

The envelope, the idempotency key or the onboarding gate changes by migration; a token is found shared across purposes (check_token_purpose_drift).

Not measured since 2026-09-14 — this statement is withheld until it is re-measured.

Measured:

2026-09-14 · operator:ashley@cyntech.co.za (build seat, ORDER B §6)

Scope:

control_register_heartbeat (one row) and external_heartbeat_pings (all rows). A failed ping means a required scheduled job did not report an outcome, not that the site was down; no availability figure is derived from it.

Evidence:

query — select * from control_register_heartbeat; select outcome, min(sent_at), max(sent_at), count(*) from external_heartbeat_pings group by 1 — 14 Sep 2026 02:05Z

Reopened if:

A ping succeeds again (the figure is re-measured); the heartbeat cadence or the required-job list changes; a 90-day record accrues.

Not measured since 2026-09-14 — this statement is withheld until it is re-measured.

Measured:

2026-09-14 · operator:ashley@cyntech.co.za (build seat, ORDER B §6)

Scope:

ingest_deadman_subjects and the ingest-outcome-deadman check in watchdog_findings, a tenant-neutral aggregate. Producer liveness, not per-device completeness; a device silent behind a live bridge is a separate finding.

Evidence:

query — select expected_to_produce, state_reason, count(*) from ingest_deadman_subjects group by 1,2; watchdog_findings where check_name = 'ingest-outcome-deadman', latest run — 14 Sep 2026 02:05Z

Reopened if:

Any active subject reads other than declared_kind_rows_landing; a subject is added or retired.

Not measured since 2026-09-14 — this statement is withheld until it is re-measured.

Measured:

2026-09-14 · operator:ashley@cyntech.co.za (build seat, ORDER B §6)

Scope:

offsite_backup_runs and the offsite-backup-artifact / offsite_backup_lease_progress checks. The backup covers the five-year rollup record, configuration and tenancy — not the 72-hour raw telemetry window, which the rollups supersede (src/lib/backup/spec.ts).

Evidence:

query — select run_date, kind, status, started_at, finished_at, manifest is not null, completion_mode from offsite_backup_runs order by run_date desc limit 6; select count(*) from export_restore_scratch — 14 Sep 2026 02:05Z; N-693, N-724

Reopened if:

A run completes with a manifest (the date advances); a restore-verify is run (the restore time is then quoted); the schedule changes.