From 8508513d5df00d39853e1d008d7c5f929ad363e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=86=B0=E6=9C=94?= <565183519@qq.com>
Date: Wed, 12 Aug 2026 11:35:10 +0800
Subject: [PATCH] audit(hololake): record legacy Tauri security boundaries

---
 .../audit/donor-audit.json                    | 23 ++++++++++++++++---
 .../scripts/donor-audit.test.mjs              |  5 +++-
 routing/hololake-canonical-desktop-shell.json |  4 ++--
 3 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/product-source/hololake-native-desktop/audit/donor-audit.json b/product-source/hololake-native-desktop/audit/donor-audit.json
index 9ca6949..d413156 100644
--- a/product-source/hololake-native-desktop/audit/donor-audit.json
+++ b/product-source/hololake-native-desktop/audit/donor-audit.json
@@ -3,7 +3,7 @@
   "record_id": "HLP-DONOR-AUDIT-001",
   "development_id": "DEV-20260811-010",
   "audited_source_commit": "cff488bb033051909ae078991787e0c272a2d5eb",
-  "state": "BASELINE_RECORDED_SECURITY_PARTIAL_LICENSE_AND_DATA_GATES_ACTIVE",
+  "state": "THREE_DONOR_SECURITY_REVIEWS_RECORDED_LICENSE_PROVENANCE_AND_DATA_GATES_ACTIVE",
   "truth_boundary": "This record permits capability and behavior extraction only. It does not authorize donor source copying, donor deletion, data migration, product UI implementation, release, or deployment.",
   "donors": [
     {
@@ -12,7 +12,18 @@
       "source_license": "AGPL-3.0-or-later",
       "declared_authors": ["Luca Rossi"],
       "code_reuse": "BLOCKED_PENDING_FILE_PROVENANCE_AND_PRODUCT_LICENSE_DECISION",
-      "security_scan": "NOT_COMPLETE"
+      "security_scan": "FOCUSED_STATIC_REVIEW_COMPLETE_AT_AUDITED_COMMIT",
+      "validated_security_findings": [
+        "MODEL_TOOL_MUTATIONS_WITHOUT_EXACT_HUMAN_CONFIRMATION",
+        "UNAUTHENTICATED_LOOPBACK_MCP_TOOL_BRIDGE",
+        "RENDERER_WRITABLE_VAULT_AUTHORIZATION_REGISTRY",
+        "UNSCOPED_GIT_AND_RECURSIVE_FOLDER_COMMANDS",
+        "VAULT_SCANNERS_FOLLOW_EXTERNAL_SYMLINKS",
+        "MODEL_SECRET_NOT_BOUND_TO_APPROVED_ENDPOINT",
+        "SAFE_MODE_ADAPTER_ENABLES_ALL_TOOLS",
+        "WORKSPACE_CONFIG_SELECTS_HOST_ENVIRONMENT_SECRETS",
+        "UNPINNED_RUNTIME_EXTENSION_AND_EXECUTABLE_DISCOVERY"
+      ]
     },
     {
       "path": "../hololake-desktop",
@@ -60,9 +71,15 @@
     "LEXICAL_ONLY_PATH_CONTAINMENT_OR_UNVALIDATED_GIT_REVISION_REMOTE",
     "UPSTREAM_OR_DONOR_UPDATE_ENDPOINTS",
     "DONOR_SOURCE_WITHOUT_FILE_PROVENANCE_AND_LICENSE_AUTHORIZATION"
+    ,"MODEL_OUTPUT_DIRECT_WRITE_DELETE_WITHOUT_EXACT_EXPIRING_HUMAN_CONFIRMATION"
+    ,"RENDERER_WRITABLE_FILESYSTEM_AUTHORIZATION_REGISTRY"
+    ,"GIT_OR_RECURSIVE_FOLDER_OPERATIONS_WITHOUT_CANONICAL_REGISTERED_ROOT_BINDING"
+    ,"VAULT_SCANNERS_THAT_FOLLOW_SYMLINKS_OUTSIDE_THE_CANONICAL_ROOT"
+    ,"WORKSPACE_SELECTED_HOST_ENVIRONMENT_SECRET_INJECTION"
+    ,"PROMPT_ONLY_SAFE_MODE_OR_ADAPTERS_THAT_IGNORE_PERMISSION_MODE"
+    ,"RUNTIME_PACKAGE_ACQUISITION_OR_PATH_FIRST_EXECUTABLE_DISCOVERY"
   ],
   "open_gates": [
-    "LEGACY_TAURI_SECURITY_SCAN",
     "DIRECT_AND_TRANSITIVE_DEPENDENCY_LICENSE_SBOM",
     "FILE_LEVEL_PROVENANCE",
     "PHYSICAL_USER_DATA_INVENTORY_AND_BACKUP",
diff --git a/product-source/hololake-native-desktop/scripts/donor-audit.test.mjs b/product-source/hololake-native-desktop/scripts/donor-audit.test.mjs
index 3e38d31..f14be97 100644
--- a/product-source/hololake-native-desktop/scripts/donor-audit.test.mjs
+++ b/product-source/hololake-native-desktop/scripts/donor-audit.test.mjs
@@ -25,6 +25,9 @@ test('audit preserves security and secret migration prohibitions', () => {
 
 test('visual implementation cannot start while audit gates remain open', () => {
   assert.ok(audit.open_gates.includes('VISUAL_DIRECTION_SELECTION'))
-  assert.ok(audit.open_gates.includes('LEGACY_TAURI_SECURITY_SCAN'))
+  assert.ok(!audit.open_gates.includes('LEGACY_TAURI_SECURITY_SCAN'))
+  const legacyTauri = audit.donors.find((entry) => entry.path === '../hololake-platform')
+  assert.match(legacyTauri.security_scan, /REVIEW_COMPLETE/)
+  assert.ok(legacyTauri.validated_security_findings.includes('MODEL_TOOL_MUTATIONS_WITHOUT_EXACT_HUMAN_CONFIRMATION'))
   assert.ok(audit.open_gates.includes('REVERSIBLE_DATA_MIGRATION_REHEARSAL'))
 })
diff --git a/routing/hololake-canonical-desktop-shell.json b/routing/hololake-canonical-desktop-shell.json
index 9e2263e..82bbf47 100644
--- a/routing/hololake-canonical-desktop-shell.json
+++ b/routing/hololake-canonical-desktop-shell.json
@@ -1,7 +1,7 @@
 {
   "schema": "hololake.canonical-desktop-shell/v2",
   "record_id": "HLP-CANONICAL-DESKTOP-SHELL-001",
-  "version": "2026-08-12.3",
+  "version": "2026-08-12.4",
   "state": "CURRENT_CANONICAL_NATIVE_TAURI_FOUNDATION_WITH_UPDATE_TRUST_ROOT_AND_PARTIAL_DONOR_AUDIT",
   "development_id": "DEV-20260811-010",
   "decision": {
@@ -85,7 +85,7 @@
     "record": "product-source/hololake-native-desktop/audit/donor-audit.json",
     "electron_shell_security_scan_complete": true,
     "knowledge_core_security_scan_complete": true,
-    "legacy_tauri_security_scan_complete": false,
+    "legacy_tauri_security_scan_complete": true,
     "file_provenance_and_dependency_license_audit_complete": false,
     "physical_user_data_inventory_and_migration_rehearsal_complete": false,
     "allowed_outcomes": [