Skip to content
LQMS
LQMS Security Posture
Initializing search
nburri/lqms
LQMS
nburri/lqms
Home
Evaluate LQMS
Evaluate LQMS
LQMS Known Limits
LQMS Security Posture
LQMS Security Posture
Table of contents
1. The claim
2. Trust boundaries — what the system deliberately does NOT defend
3. The separation boundary, and how it held
4. Authentication and session
5. Authorization
6. Evidence integrity — the audit trail
7. Concurrency and data integrity
8. The deployed perimeter
9. Supply chain
10. Residuals — the complete list, each with its home
Sources
Architecture
Architecture
1. Introduction and Goals
2. Architecture Constraints
3. Context and Scope
4. Solution Strategy
5. Building Block View
6. Runtime View
7. Deployment View
8. Crosscutting Concepts
9. Architecture Decisions
10. Quality Requirements
11. Risks and Technical Debt
12. Glossary
The arrival bundle format
Decisions (ADRs)
Decisions (ADRs)
ADR-0001: Content-Addressed Document Storage with PostgreSQL as Source of Truth
ADR-0002: Single Instance with Scope Hierarchy and Copy-on-Derive
ADR-0003: Fixed Life Cycle States with Configurable Review Processes
ADR-0004: Global Catalogs for Roles and Document Types with Per-Scope Activation
ADR-0005: Modular Monolith
ADR-0006: Three-Layer Search with In-Database Index and Pluggable LLM
ADR-0007: Angular Frontend with Server-Side-Only Enforcement
ADR-0008: Flyway Migrations and jOOQ Codegen from the Migrated Schema
ADR-0009: RLS Enforcement via a Session-Scoped Authorized Scope Set
ADR-0010: Self-Managed QMS via an Internal Mandator
ADR-0011: Authentication via OIDC SSO with Server-Side (BFF) Sessions
ADR-0012: Permission-Based Authorization and System Bootstrap
ADR-0013: User Identity Lifecycle
ADR-0014: Electronic Signatures (Part 11 / Annex 11-Capable)
ADR-0015: Document Effectivity, Periodic Review & Validity
ADR-0016: Data Retention, Disposal & Privacy (FADP / GDPR)
ADR-0017: Multi-Part Version Content
ADR-0018: Non-Functional Targets (Capacity, Availability, Security)
ADR-0019: Notifications & Tasks
ADR-0020: Internationalization (Content Language, Time Zones, Formatting)
ADR-0021: General Typed Document Relationships
ADR-0022: Read-Acknowledgement & Questionnaires
ADR-0023: Migration / Import — Current Released State
ADR-0024: Draft / In-Review Cancellation
ADR-0025: Disposal & Erasure Mechanics (Storage, Index, Backups)
ADR-0026: RLS Runtime Safety — Connection-Pool Scope Isolation
ADR-0027: RLS Boundary — Content-Plane vs Control-Plane
ADR-0028: Stateless Encrypted Token-State Cookie (no server-side session store)
ADR-0029: Document Content Model — Draft-Freeze, Content-Table RLS, Append-Only Audit
ADR-0030: Review & Life-Cycle Realization Model
ADR-0031: Released-base readability enforcement & copy-on-derive mechanics
ADR-0032: Frontend realization — Quinoa, Angular Material, i18n & E2E
ADR-0033: CSRF control for the BFF session — SameSite + JSON content-type
ADR-0034: Notification realization — in-process domain events + system-context fan-out
ADR-0035: Fan-out contract as shipped — gate semantics, count disclosure, audit protocol
ADR-0036: Repository layer — services carry rules, repositories carry jOOQ
ADR-0037: Task scheduler — in-process tick, advisory-lock election, SQL sweep
ADR-0038: Periodic-review realization — derived due date, policy-gated confirmation
ADR-0039: Sweep & periodic-review contract as shipped — grants, guards, addressing
ADR-0040: Disposal-due surfacing — closure-anchored retention, scope-level legal hold
ADR-0041: Email channel & notification i18n — notification-as-outbox, structured messages
ADR-0042: Disposal execution — document tombstoning, single-actor hard-gated destruction
ADR-0043: Disposal blob deletion is post-commit, GC-backstopped
ADR-0044: Search FTS baseline — event-indexed, RLS-scoped search_index
ADR-0045: Image Attachments as Content Parts (Rich-Content Slice R2)
ADR-0046: Four-Eyes — Submitter Excluded from Approval
ADR-0047: Four-Eyes — Submitter-Only Exclusion
ADR-0048: Document Organization — Folder Tree per Scope
ADR-0049: Content Model Round 2 — Type Categories, Template Instantiation, Trace Relations, Completeness Rules
ADR-0050: Live Frontend — SSE State Push, CodeMirror 6, Draft Presence
ADR-0051: In-Text Document Links (doc: Scheme)
ADR-0052: Addressees & Read-Acknowledgement (REQ-TRN Realization)
ADR-0053: Addressees Per Document + Process Owner (amends ADR-0052 K-1)
ADR-0054: Process Owner Is a Role (amends ADR-0053 P-3)
ADR-0055: WYSIWYG Editing Mode over Markdown (editor step R4)
ADR-0056: Visual-Editor Chrome via Milkdown Crepe (gated adoption)
ADR-0057: Content Record Is the ProseMirror Document Tree; Markdown Becomes a Derived Projection
ADR-0058: PM_DOC Is the Only Content Format (pre-production cut; amends ADR-0057 §5)
ADR-0059: Editor Engine Switches to TipTap (spike-gated; supersedes the Milkdown/Crepe choice)
ADR-0060: Backup & Restore — Scripted Ordered Backup with Automated Restore Rehearsal
ADR-0061: CSV — Generated Validation Package per Release
ADR-0062: SBOM — CycloneDX over the Production Layers, Validated Against the Artifact
ADR-0063: User Identity Binds on Subject Only (Issuer Becomes Provenance)
ADR-0064: Per-Document Workflow Role Bindings (Author / Reviewer / Releaser), Enforced
ADR-0065: Diagrams — Excalidraw as the Manual Layer, Mermaid Stays for Text-First/UML
ADR-0066: WITHDRAW — the Author Side May Reclaim a Version from Review
ADR-0067: Review Comments — Anchored, Immutable, Resolvable
ADR-0068: Confluence/Jira QMS Import — Staged, Read-Only, Repeatable
ADR-0069: Arbitrary File Attachments — Download-Only Confinement
ADR-0070: Training Questionnaires — Versioned, Auto-Scored, Release-Gated
ADR-0071: Training Plans — Document Obligations + External Trainings & Certifications
ADR-0072: Diagrams — Self-Hosted draw.io Replaces Excalidraw
ADR-0073: Per-Scope QMS Configuration Surface
ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection
ADR-0075: Source History Import — Continuity Without Forged Audit
ADR-0076: Periodic-review status visibility (completing MVP gap #2)
ADR-0077: Requirement Items — Keyed Blocks Inside Controlled Documents
ADR-0078: Generalized Trace Items (Traceability Model — Stage A)
ADR-0079: Risk & Risk-Control Items (Traceability Model — Stage B)
ADR-0080: Traceability Workspace — Hub, Sub-Pages, and Role-Gated Views
ADR-0081: Draft-Only Trace-Structure Changes, Server-Enforced
ADR-0082: Table-Shaped Risk Authoring over Risk Blocks
ADR-0083: The TD Dossier — a Versioned, Cross-Scope, Regulatory-Structured Deliverable
ADR-0084: Validation & Regulatory Axes (Traceability Model — Stage C)
ADR-0085: Relation-Layer Consolidation — One Trace Vocabulary, One Surface
ADR-0086: Requirement Traceability Chains — End-to-End Path View + Flat Path Export
ADR-0087: The Scope Traceability Report — One Derived Overview Artifact, Never a Controlled Document
ADR-0088: Verification Evidence Classes — Planned vs. Verified, Derived at the Read Layer
ADR-0089: Recurring Obligations — Periodic Tasks With Record Evidence, Not Calendar Series
ADR-0090: Release & Versioning Policy — Deliberate Releases, One Auditor-Facing Number
ADR-0091: Release Modes — Single-Person Record Release With a Structural Four-Eyes Floor
ADR-0092: Orphan-Blob Garbage Collection With a Quarantine Bin
ADR-0093: One Scope Context — the Toolbar Switcher Is the Only Scope Selector
ADR-0094: Calendar-Anchored Obligation Schedules (Clamped, Never Too Late)
ADR-0095: Key-Rule Governance — Free Until First Use, Then Frozen
ADR-0096: Transition Permissions — Always Visible, Deny Unless Granted
ADR-0097: A Governed Provisioning Surface — MANAGE_SCOPES
ADR-0098: Org Chart × Role System — Marriage at the Evidence Level, Never in Authorization
ADR-0099: The User Manual is an In-App Topic Reference, Not a Document
ADR-0100: LQMS Is the Living Quality Management System
ADR-0101: The Executable Validation Journey (PQ Evidence That Cannot Drift)
ADR-0102: Typed Template Variables (text | date | number — and Deliberately No Enum)
ADR-0103: npm audit Joins the Verification Gate as a Second Standing Input
ADR-0104: The Issued Dossier Is a Persisted Artifact of Record — and Clones to a New Draft
ADR-0105: Navigation Information Architecture — Group by Moment-of-Use
ADR-0106: The Client Reflection Follows Assignments, Not Only Content Reach
ADR-0107: The Audit Append Gate Follows Assignment Reach, Not Content Reach
ADR-0108: Mandator Membership — Invite-Accept, with Pre-Assigned Responsibilities
ADR-0109: Organization Founding Is Its Own Process
ADR-0110: The Audit Trail Is Not a Read Model
ADR-0111: The Imported-Person Model, and Project Portability's First Doctrines
ADR-0112: The Element-Kind Catalog — Semantics in the Model, Not Only in the Code
ADR-0113: Project Arrival Import — Records Arrive as They Are, People Arrive as They Were
ADR-0114: The Operating Model Arrives — Roles as Functions, Names as Words, People as This Instance's Decision
ADR-0115: Collaborative Draft Editing — Two Carets, One Truth, Honest Credit
ADR-0116: The System Maintenance Surface — the App Backs Itself Up, the Host Keeps One Dumb Job
ADR-0117: Role Documentation — a Link, a Finding, Per-Source Recognizers; Substitution Rejected
ADR-0118: The Offline QMS Copy — the Repo Carries the Audit Pack, Not a Second Renderer
ADR-0119: Module-Internal Package Structure — Capabilities First, Layers Second, the Root Is the Surface
ADR-0120: The Shared Kernel — the Domain-Exception Vocabulary Leaves the Authorization Module
ADR-0121: The Project Administrator Role — Per-Scope Administration With Read Access, Seeded in the Base Catalog
ADR-0122: Organization-Level Administration — the Cascade Stays, Becomes Visible, and Founds Projects
ADR-0123: Draft Save-Points — Every Save Restorable, Kept for the Life of the Version
ADR-0124: The Birth Path Completes Without Borrowing Content Clothes
ADR-0125: The Export Twin — Export Emits an Arrival Bundle
ADR-0126: Project Dissolution — the Un-Birth of an Unused Scope
ADR-0127: The Base-QMS Layers — One Library, Derived Adaptations, Local Records
ADR-0128: The GLOBAL Cascade Carries Administration, Never Content
ADR-0129: Role Identity from a GLOBAL Assignment Acts in GLOBAL Alone
ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act
ADR-0131: Role Substitution as Declared Adoption Edges — Emergency Cover Is Governed, Own-Name, Timed Staffing
ADR-0132: Dual-Hat Reviewer Satisfaction Is a Declared Policy Choice — the Strict Floor Stays the Default
ADR-NNNN:
</span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" > <div class="md-nav__link md-nav__container"> <a href="../requirements/" class="md-nav__link "> <span class="md-ellipsis"> Requirements </span> </a> <label class="md-nav__link " for="__nav_5" id="__nav_5_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_5"> <span class="md-nav__icon md-icon"></span> Requirements </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../requirements/stakeholder_requirements/" class="md-nav__link"> <span class="md-ellipsis"> Stakeholder Requirements </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/gap-analysis/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Gap Analysis </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_admin/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Administration, Permissions & Onboarding </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_api_ui/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: API & User Interface </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_audit_reporting/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Audit Trail & Regulatory Reporting </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_auth/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Authentication & Session </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_backup/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Backup & Restore </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_catalogs/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Catalogs, Roles & Users </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_data_protection/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Data Protection, Retention & Disposal </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_documents/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Documents, Versions & Storage </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_dossiers/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Technical Documentation Dossiers </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_effectivity/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Effectivity, Periodic Review & Validity </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_gspr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Regulatory Conformity (GSPR / Essential Principles) </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_i18n/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Internationalization </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Life Cycle & Reviews </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_memberships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Mandator Membership & Invitations </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_migration/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Migration & Import </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_nfr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Non-Functional </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_notifications/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Notifications & Tasks </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_obligations/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_relationships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Document Relationships </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_risk/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Risk Management (ISO 14971 Hazards & Controls) </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_sbom/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Software Bill of Materials & Supply-Chain Assurance </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_search/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Search </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_separation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Scopes, Mandators & Separation </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_signatures/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Electronic Signatures </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_training/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Read-Acknowledgement & Questionnaires </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_users/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: User Identity & Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../requirements/req_validation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Design Validation & the Validation Traceability Axis </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" > <div class="md-nav__link md-nav__container"> <a href="../process/" class="md-nav__link "> <span class="md-ellipsis"> Process (IEC 62304) </span> </a> <label class="md-nav__link " for="__nav_6" id="__nav_6_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_6"> <span class="md-nav__icon md-icon"></span> Process (IEC 62304) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../process/configuration_management_plan/" class="md-nav__link"> <span class="md-ellipsis"> Configuration Management Plan </span> </a> </li> <li class="md-nav__item"> <a href="../process/problem_resolution/" class="md-nav__link"> <span class="md-ellipsis"> Problem Resolution Process </span> </a> </li> <li class="md-nav__item"> <a href="../process/risk_management/" class="md-nav__link"> <span class="md-ellipsis"> Risk Management </span> </a> </li> <li class="md-nav__item"> <a href="../process/software_development_plan/" class="md-nav__link"> <span class="md-ellipsis"> Software Development Plan </span> </a> </li> <li class="md-nav__item"> <a href="../process/verification_plan/" class="md-nav__link"> <span class="md-ellipsis"> Verification Plan </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" > <label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0"> <span class="md-ellipsis"> Operations </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_7"> <span class="md-nav__icon md-icon"></span> Operations </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../operations/genesis-installation/" class="md-nav__link"> <span class="md-ellipsis"> Genesis: Birthing an LQMS Installation with a Base Library </span> </a> </li> <li class="md-nav__item"> <a href="../operations/deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Deployment Guide </span> </a> </li> <li class="md-nav__item"> <a href="../operations/server-deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Server Deployment (single Linux host, public HTTPS) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" > <div class="md-nav__link md-nav__container"> <a href="../traceability/" class="md-nav__link "> <span class="md-ellipsis"> Traceability </span> </a> <label class="md-nav__link " for="__nav_8" id="__nav_8_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_8"> <span class="md-nav__icon md-icon"></span> Traceability </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../traceability/matrix/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Traceability Matrix </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_9" > <div class="md-nav__link md-nav__container"> <a href="../validation/" class="md-nav__link "> <span class="md-ellipsis"> Validation (tool lane) </span> </a> <label class="md-nav__link " for="__nav_9" id="__nav_9_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_9_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_9"> <span class="md-nav__icon md-icon"></span> Validation (tool lane) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../validation/templates/ai-authorship-posture/" class="md-nav__link"> <span class="md-ellipsis"> AI-Authorship Posture — How LQMS Is Built, and Why the Validation Evidence Does Not Rest on It (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../validation/templates/intended-use/" class="md-nav__link"> <span class="md-ellipsis"> Intended-Use Specification — LQMS as a QMS / Document-Control Tool (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../validation/templates/tool-risk-assessment/" class="md-nav__link"> <span class="md-ellipsis"> Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_10" > <label class="md-nav__link" for="__nav_10" id="__nav_10_label" tabindex="0"> <span class="md-ellipsis"> Regulatory </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_10_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_10"> <span class="md-nav__icon md-icon"></span> Regulatory </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../regulatory/mdr-annex-i-skeleton/" class="md-nav__link"> <span class="md-ellipsis"> MDR Annex I — GSPR authoring skeleton (paraphrased) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_11" > <div class="md-nav__link md-nav__container"> <a href="../user-guide/" class="md-nav__link "> <span class="md-ellipsis"> User guide </span> </a> <label class="md-nav__link " for="__nav_11" id="__nav_11_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_11_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_11"> <span class="md-nav__icon md-icon"></span> User guide </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../user-guide/tutorial/" class="md-nav__link"> <span class="md-ellipsis"> Tutorial — from zero to a released document </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/administration/" class="md-nav__link"> <span class="md-ellipsis"> Administering an LQMS Installation </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/diagrams/" class="md-nav__link"> <span class="md-ellipsis"> Diagrams </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/documents-lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Documents & the Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/exports/" class="md-nav__link"> <span class="md-ellipsis"> PDF Exports & the Audit Pack </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/obligations/" class="md-nav__link"> <span class="md-ellipsis"> Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/project-context/" class="md-nav__link"> <span class="md-ellipsis"> The Project Context & App Version </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/review-comments/" class="md-nav__link"> <span class="md-ellipsis"> Review Comments </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/activity-trail/" class="md-nav__link"> <span class="md-ellipsis"> Who did what, when — reading a project's activity </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/admin-scopes/" class="md-nav__link"> <span class="md-ellipsis"> Renaming a project, and what can never change </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/authority-view/" class="md-nav__link"> <span class="md-ellipsis"> Who holds each function here, and what may it do </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/break-glass/" class="md-nav__link"> <span class="md-ellipsis"> The permission I need is held by a role I do not hold — what now? </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/coverage-and-chains/" class="md-nav__link"> <span class="md-ellipsis"> Coverage or chains? — which requirement view answers your question </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/credentials/" class="md-nav__link"> <span class="md-ellipsis"> Your password: changing it, resetting it — and why LQMS never sees it </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/emergency-cover/" class="md-nav__link"> <span class="md-ellipsis"> Who may cover for whom here — declaring emergency cover, and reading where the glass was broken </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/key-rules/" class="md-nav__link"> <span class="md-ellipsis"> Special elements: what a project declares, and when its names freeze </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/memberships/" class="md-nav__link"> <span class="md-ellipsis"> Belonging to an organization: invitations, acceptance, and what they change </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/provisioning-birth-path/" class="md-nav__link"> <span class="md-ellipsis"> How a new organization and project are born </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/review-policies/" class="md-nav__link"> <span class="md-ellipsis"> What a review policy controls, and what an empty grant means </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/setup-wizard-lanes/" class="md-nav__link"> <span class="md-ellipsis"> The setup wizard: the lanes, and what it writes </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/staffing-and-assignments/" class="md-nav__link"> <span class="md-ellipsis"> Staffing people into roles, and the accountable holder </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/topics/technical-dossier/" class="md-nav__link"> <span class="md-ellipsis"> How do I assemble a technical dossier? </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/trace-items/" class="md-nav__link"> <span class="md-ellipsis"> Trace Items — Requirements, Risks & Risk Controls </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/trace-links/" class="md-nav__link"> <span class="md-ellipsis"> Trace Links & the Suspect Cycle </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/traceability-workspace/" class="md-nav__link"> <span class="md-ellipsis"> The Traceability Workspace </span> </a> </li> <li class="md-nav__item"> <a href="../user-guide/training/" class="md-nav__link"> <span class="md-ellipsis"> Training & Acknowledgements </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" > <div class="md-sidebar__scrollwrap"> <div class="md-sidebar__inner"> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#1-the-claim" class="md-nav__link"> <span class="md-ellipsis"> 1. The claim </span> </a> </li> <li class="md-nav__item"> <a href="#2-trust-boundaries--what-the-system-deliberately-does-not-defend" class="md-nav__link"> <span class="md-ellipsis"> 2. Trust boundaries — what the system deliberately does NOT defend </span> </a> </li> <li class="md-nav__item"> <a href="#3-the-separation-boundary-and-how-it-held" class="md-nav__link"> <span class="md-ellipsis"> 3. The separation boundary, and how it held </span> </a> </li> <li class="md-nav__item"> <a href="#4-authentication-and-session" class="md-nav__link"> <span class="md-ellipsis"> 4. Authentication and session </span> </a> </li> <li class="md-nav__item"> <a href="#5-authorization" class="md-nav__link"> <span class="md-ellipsis"> 5. Authorization </span> </a> </li> <li class="md-nav__item"> <a href="#6-evidence-integrity--the-audit-trail" class="md-nav__link"> <span class="md-ellipsis"> 6. Evidence integrity — the audit trail </span> </a> </li> <li class="md-nav__item"> <a href="#7-concurrency-and-data-integrity" class="md-nav__link"> <span class="md-ellipsis"> 7. Concurrency and data integrity </span> </a> </li> <li class="md-nav__item"> <a href="#8-the-deployed-perimeter" class="md-nav__link"> <span class="md-ellipsis"> 8. The deployed perimeter </span> </a> </li> <li class="md-nav__item"> <a href="#9-supply-chain" class="md-nav__link"> <span class="md-ellipsis"> 9. Supply chain </span> </a> </li> <li class="md-nav__item"> <a href="#10-residuals--the-complete-list-each-with-its-home" class="md-nav__link"> <span class="md-ellipsis"> 10. Residuals — the complete list, each with its home </span> </a> </li> <li class="md-nav__item"> <a href="#sources" class="md-nav__link"> <span class="md-ellipsis"> Sources </span> </a> </li> </ul> </nav> </div> </div> </div> <div class="md-content" data-md-component="content"> <article class="md-content__inner md-typeset"> <a href="https://github.com/nburri/lqms/edit/main/docs/security-posture.md" title="Edit this page" class="md-content__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id="lqms-security-posture">LQMS Security Posture<a class="headerlink" href="#lqms-security-posture" title="Permanent link">¶</a></h1> <ul> <li><strong>Status:</strong> the C-5 <em>security posture document</em> from <a href="https://github.com/nburri/lqms/blob/main/docs/planning/v1.0-criteria.md">v1.0-criteria.md</a> — assembly of evidence that already exists, not new claims.</li> <li><strong>As of:</strong> <strong>v0.9.44</strong> (2026-09-04). This is a hardening-era snapshot, and it says so: two fix waves are <strong>in flight</strong> toward v0.9.45 — lane A (<em>audit walls</em>: the V128 append predicate, the record-site census guard, the trail-honesty fixes) and lane B (<em>second doors</em>: the concurrency review's X-1..X-4). Where a control is in flight rather than shipped, this document marks it <strong>[in flight]</strong> instead of claiming it.</li> <li><strong>Audience:</strong> a customer's security assessor, and an auditor. It assumes no prior contact with the codebase; every claim carries a pointer into the evidence that proves it.</li> <li><strong>Reading rule:</strong> positives cite their proof (a review's attack number, a test class, a migration line). Negatives — what the system deliberately does <strong>not</strong> defend — are declared in §2, not omitted. The deliberate product limitations live in the companion <a href="../known-limits/">known-limits statement</a>.</li> </ul> <hr /> <h2 id="1-the-claim">1. The claim<a class="headerlink" href="#1-the-claim" title="Permanent link">¶</a></h2> <p>One LQMS installation serves many organizations (<em>mandators</em>), and <strong>mandator/project data separation is the top quality goal</strong> of the system (<a href="../decisions/adr-0002-single-instance-scope-hierarchy/">ADR-0002</a>; the risk criteria make cross-tenant harm S4 — never acceptable at any probability, <a href="../process/risk_management/">risk_management.md</a>). The specific promise:</p> <blockquote> <p>A user authorized in organization A cannot read, infer, or influence organization B's data — and controlled records, together with the audit trail that witnesses them, cannot be forged, silently lost, or changed without a record.</p> </blockquote> <p>That promise was not merely designed; it was attacked. Two independent efforts stand behind it as of this writing:</p> <ul> <li><strong>The C-1a review arc</strong> (2026-08-31, eight modules, six lenses): <strong>82 findings, 0 CRITICAL, no separation breach</strong>; the fix queue emptied 2026-09-02 — every code-needing finding is in production since v0.9.42 (<a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-c1a-findings.md">review-c1a-findings.md</a> and the <code>review-c1a-module3..8.md</code> registers).</li> <li><strong>The adversarial separation review</strong> (2026-09-04): a dedicated cross-cutting assault on the seams <em>between</em> mechanisms — 30 attacks across seven surfaces, each with a named actor, held permissions and exact calls, traced through real code to a verdict. <strong>No breach. 29 of 30 attacks died at a named line; the thirtieth had no scope-boundary bearing at all.</strong> (<a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-separation-adversarial.md">review-separation-adversarial.md</a>)</li> </ul> <p>The rest of this document is the anatomy of that claim: the trust boundaries (§2), the mechanisms and the attacks they killed (§3), authentication (§4), authorization (§5), evidence integrity (§6), concurrency (§7), the deployed perimeter (§8), the supply chain (§9), and — because a posture that lists only its walls is advertising — the complete residual list with each item's register or risk home (§10).</p> <h2 id="2-trust-boundaries--what-the-system-deliberately-does-not-defend">2. Trust boundaries — what the system deliberately does NOT defend<a class="headerlink" href="#2-trust-boundaries--what-the-system-deliberately-does-not-defend" title="Permanent link">¶</a></h2> <p>The separation promise is made <strong>between tenants</strong>, below a set of trusted parties. Each boundary below is a design decision with a recorded home, not an oversight.</p> <ul> <li><strong>The installation operator.</strong> A GLOBAL assignment carrying <code>IMPORT_PROJECTS</code> / <code>EXPORT_PROJECTS</code> / <code>MANAGE_*</code> reaches every tenant — that is what a GLOBAL administrative grant <em>means</em> (<a href="../decisions/adr-0128-global-cascade-classification/">ADR-0128</a>: administrative classes cascade from GLOBAL; content classes do not). The adversarial review set its breach bar accordingly: an operator path is a finding only if it exceeds what the GLOBAL grant already grants — none did. In particular, the portability export of <em>any</em> scope is the exporter grant's documented meaning (ADR-0125 §4's installation-wide disclosure ruling; narrowing which scope <em>kinds</em> are exportable is ruled — register row 55 — and queued). An installation's tenants trust its operator; the system does not pretend otherwise.</li> <li><strong>The database superuser and the migration role.</strong> <code>lqms_migration</code> holds <code>BYPASSRLS</code> by design — the SECURITY DEFINER functions require an RLS-bypassing owner, and the app <strong>refuses to boot</strong> if that is not so (<code>FanoutDeploymentCheck</code>, <a href="../operations/deployment/">deployment.md §4</a>). Anyone holding database-superuser or migration-role credentials is outside the defended perimeter: the runtime RLS discipline defends against <em>application</em> defects, not against a hostile DBA.</li> <li><strong>The host.</strong> Root on the server holds the PostgreSQL volume, the content blob store, Keycloak's identity file, the backup archives and the secrets in <code>server.env</code>. Encryption at rest is <strong>platform-level by decision</strong> (disk/volume encryption, managed by the platform — <a href="../decisions/adr-0018-nonfunctional-targets/">ADR-0018</a>); application-level per-scope encryption / crypto-shredding is a documented future option (GAP-06), not a shipped control.</li> <li><strong>The identity provider.</strong> LQMS stores no passwords and no second-factor secrets. MFA/2FA, password policy, brute-force and credential-stuffing protection, and session idle/absolute timeouts are the IdP's controls (<a href="../decisions/adr-0011-authentication-oidc-bff/">ADR-0011</a>; REQ-AUTH-005 is an accepted-gap in the <a href="../traceability/matrix/">traceability matrix</a> precisely because it is IdP-enforced). The bundled Keycloak provides all of these; configuring them is the deployment's act, not the application's.</li> <li><strong>The backup archive holder.</strong> A backup archive is every tenant's data plus the full trail. Its custody is the operator's; its <em>acquisition</em> is today unaudited — that is trail-honesty finding TH-1 (MAJOR), fix <strong>[in flight]</strong> (§10).</li> <li><strong>A whole-database restore</strong> replaces the world, trail included — a substrate-level act the trail it replaces cannot record (trail-honesty review, argued-exempt E-7 — an inherent limit). What IS defended: the restore validates the archive fully before its destructive point (RISK-007), and rehearsal records are graded against evidence <em>outside</em> the restored copy (<a href="../operations/server-deployment/">server-deployment.md §9.3</a>).</li> </ul> <h2 id="3-the-separation-boundary-and-how-it-held">3. The separation boundary, and how it held<a class="headerlink" href="#3-the-separation-boundary-and-how-it-held" title="Permanent link">¶</a></h2> <p>The architecture in one paragraph: every content-bearing table is <code>ENABLE</code>/<code>FORCE</code> row-level security, keyed on a transaction-local authorized-scope set (<a href="../decisions/adr-0009-rls-session-scope-context/">ADR-0009</a>); the set is published with <code>SET LOCAL</code> bind parameters so it can never outlive its transaction or leak across the connection pool (<a href="../decisions/adr-0026-rls-connection-pool-safety/">ADR-0026</a>, proven by <code>RlsConnectionReuseTest</code>); the boundary runs between content plane (RLS-guarded) and control plane (permission-guarded) (<a href="../decisions/adr-0027-rls-content-vs-control-plane/">ADR-0027</a> — with its declared trade-off: scope/mandator <em>metadata</em> is defended by permission filtering, not by the DB backstop). Every scope-keyed content table is FORCE-RLS with a DB-level cross-scope proof (37 tables at the 2026-08-21 re-verification, RISK-001), and <code>RlsPolicyInventoryTest</code> classifies the whole table inventory and fails the build on an unclassified newcomer — mutation-proven: nine policy mutations applied to the live schema, all nine caught.</p> <p>The adversarial review's defense map is the honest inventory of which mechanism actually stopped which attack. Reproduced here as the posture's spine — rows 1–9 are <strong>structure</strong> (predicates, policies, path shapes) and survived every attack aimed at them, usually redundantly; row 10 is <strong>convention</strong>, and is the subject of the current hardening wave:</p> <table> <thead> <tr> <th>#</th> <th>Mechanism</th> <th>Proven by (attacks blocked, at the review's named lines)</th> </tr> </thead> <tbody> <tr> <td>1</td> <td><strong>The V121 resolver predicate</strong> — the RLS scope set is VIEW-gated; the MANDATOR disjunct keys on non-NULL mandator equality; the GLOBAL disjunct keys on the <em>generated</em> <code>cascades_from_global</code> column, never a literal</td> <td>A2 (NULL-edge widening), A3 (riding the universal Base Reader assignment into tenants — blocked at V121:176-177), A8, A10, A18, A30. Every "effective at GLOBAL" gate in the system bottoms out here</td> </tr> <tr> <td>2</td> <td><strong>FORCE-RLS content policies over the transaction-local GUC</strong> (V002:26-35; per-table <code>scope_id = any(...)</code>, including the newest table, V125 save-points)</td> <td>A11 (audit-pack citation closure as a drag-net — invisible documents are <em>silently absent</em>), A13, A14, A19, A24, A25</td> </tr> <tr> <td>3</td> <td><strong>Gate-then-publish</strong> — authority is checked before any scope set replaces the caller's (import cage, export twin, folder governance)</td> <td>A8 (steering the import family), A9 (cage narrowing fails shut), A10 (aiming an export at a foreign scope — the 403 precedes any publish, asked again inside the plan transaction), A26, A30</td> </tr> <tr> <td>4</td> <td><strong>Self-gating SECURITY DEFINER bodies</strong> — every user-callable definer re-asks its own gate in its body; the sweeps are owner-only EXECUTE</td> <td>A5 (roster functions as a directory), A6, A7 (fan-out bodies), A18</td> </tr> <tr> <td>5</td> <td><strong>The 404-merge / gate-first refusal posture</strong> — "not found" and "not authorized" answer identically; unknown ids resolve to GLOBAL and are refused namelessly</td> <td>A17 (existence oracles), A21, A23 (refusal payloads carry only what the caller already supplied)</td> </tr> <tr> <td>6</td> <td><strong>Per-scope blob partitioning + hash shape check</strong> — dedup is per-partition; no API accepts a hash as input</td> <td>A24 (a hash known from A read or attached in B — blocked at FilesystemContentStore.kt:87)</td> </tr> <tr> <td>7</td> <td><strong>Connect-time scope-set keying of live channels</strong> (SSE routing, collab room admission)</td> <td>A20, A21 (collab join requires the identical triple as typing into the draft; frames relay only within the admitted room)</td> </tr> <tr> <td>8</td> <td><strong>Explicit cross-scope boundary gates on the deliberate readers</strong> — dossier pins, trace links, the citation closure, the V124 base-relation policies all ask VIEW-or-authorized <em>in the target scope</em> on top of RLS</td> <td>A11, A13 (a foreign trace verdict is computed only inside an authorized branch; the degrade emits the caller's own recorded claim), A15, A16 (the pin's disclosure table withholds everything live from an invisible target)</td> </tr> <tr> <td>9</td> <td><strong>Bind-parameter publish discipline</strong> — all ten <code>set_config</code> sites feed UUIDs read from this database, never request strings; a malformed value raises rather than widens</td> <td>A1 (GUC forgery)</td> </tr> <tr> <td>10</td> <td><strong>Call-site convention</strong> — gate-then-record (103 audit sites), pass-own-user-id (14 sites), oracle-behind-gate (10 sites)</td> <td>A12, A22 — every site verified correct, <strong>and this is the one wall with no mechanism behind it</strong> (findings F-1, F-3)</td> </tr> </tbody> </table> <p><strong>The honest asymmetry, stated as the review stated it:</strong> <em>reads</em> are defended by mechanism — RLS plus gated publishes plus self-gating definers, defense-in-depth that killed most read attacks twice — while <em>audit appends</em> (the influence channel into another tenant's evidence) were defended by convention alone. Three individually-argued migrations had composed into a void backstop: since V117 gave every active user a GLOBAL Base Reader assignment, the DB-level append policy admitted any user's transaction writing into any tenant's trail, and the only wall was the unanimity of ~103 hand-written call sites — correct at every one, pinned by nothing (finding <strong>F-1</strong>, MAJOR as defense-in-depth, <em>not a live hole</em>: no caller-steered un-gated record site exists). Ruled 2026-09-04 (register row 57, option c): <strong>both</strong> remedies — the V128 predicate (append reach from GLOBAL requires a permission that actually cascades out of GLOBAL, the same generated column the read side already obeys) <strong>and</strong> the <code>AuditRecordCensusTest</code> call-site census guard. <strong>[in flight]</strong> — both are in the working tree for v0.9.45 at this writing.</p> <h2 id="4-authentication-and-session">4. Authentication and session<a class="headerlink" href="#4-authentication-and-session" title="Permanent link">¶</a></h2> <ul> <li><strong>OIDC only, no credentials stored</strong> (<a href="../decisions/adr-0011-authentication-oidc-bff/">ADR-0011</a>). Any standards-compliant provider; standalone installs bundle Keycloak. LQMS holds no passwords, no MFA secrets, no local-account fallback.</li> <li><strong>Browser sessions are BFF-style with a stateless encrypted cookie</strong> (<a href="../decisions/adr-0028-stateless-session-cookie/">ADR-0028</a>): <code>httpOnly</code>, <code>Secure</code>, <code>SameSite=Lax</code>, encrypted with a server-held key, carrying no client-extractable claims; no server-side session store. Authorization is <strong>re-evaluated on every request</strong> against live state, so administrative revocation (deactivation, role removal) is effective on the user's next request. <strong>Declared trade-off (ADR-0028):</strong> a <em>stolen</em> cookie cannot be force-killed mid-lifetime; the window is bounded by token/session lifetimes and closable globally by rotating the cookie-encryption key.</li> <li><strong>CSRF</strong> (<a href="../decisions/adr-0033-csrf-control-for-bff-session/">ADR-0033</a>): <code>SameSite=Lax</code> plus JSON-only mutating endpoints, deliberately no synchronizer-token filter; the recorded guardrail is that permissive CORS or non-JSON mutation bodies may not be introduced without revisiting the decision.</li> <li><strong>Token rejection is verified, not just configured</strong> (RISK-009, <code>backend/api/src/test/kotlin/ch/lqms/api/WrongAudienceTokenTest.kt</code>): a genuine same-realm token whose only defect is its audience — and a second specimen with a tampered signature — get a named 401, mint no <code>app_user</code>, and settle no open invitation (the concrete "authenticated foothold" the risk row describes). Red-proven: widening the configured audience made the specimen pass, so a green run demonstrably reads the control, not the fixture. <strong>Named residue:</strong> wrong-issuer and expiry rejection are configured but untested, with the reason in the test's KDoc (§10).</li> <li><strong>JIT provisioning grants nothing.</strong> Authentication ≠ authorization: a provisioned user with no role assignment sees no scope's data (deny-by-default, enforced by RLS). The JIT mint itself currently leaves no trail row — trail-honesty TH-3, MINOR, in the hardening wave (§10).</li> <li><strong>MFA/2FA</strong> is available through the IdP (the bundled Keycloak supports OTP/WebAuthn) and is a deployment configuration, not an application control — see §2, trust boundary four.</li> </ul> <h2 id="5-authorization">5. Authorization<a class="headerlink" href="#5-authorization" title="Permanent link">¶</a></h2> <ul> <li><strong>Deny-unless-granted, with no fallback policy.</strong> An unconfigured transition denies everyone (ADR-0096: "empty means NOBODY"); seeds and presets write explicit grants.</li> <li><strong>GLOBAL is not a skeleton key.</strong> Permission classes are structural (<a href="../decisions/adr-0128-global-cascade-classification/">ADR-0128</a>/<a href="../decisions/adr-0129-global-role-identity/">ADR-0129</a>): content-class permissions and role identity from a GLOBAL assignment act <strong>in GLOBAL alone</strong>; only administrative classes cascade. The classification is a generated column, pinned by <code>GlobalCascadeClassificationTest</code> — it cannot be widened by editing a function body.</li> <li><strong>Admin ≠ content</strong> (ADR-0012 as amended by ADR-0121): system administration does not grant content read; the Project Administrator role is the recorded, narrow project-level exception.</li> <li><strong>Review governance is structural.</strong> Four-eyes reads a stored, constraint-held submitter stamp (RISK-003: the V107 biconditional CHECK makes a missing stamp fail <em>closed</em>, mutation-proven); the cross-role distinct-person floor is on everywhere (<a href="../decisions/adr-0132-dual-hat-reviewer-policy/">ADR-0132</a> — its declared relaxation flag is post-1.0, see <a href="../known-limits/">known-limits</a>); the last-administrator invariant is held under an advisory lock, so two admins cannot deactivate each other concurrently.</li> <li><strong>Escalation is a witness, not a capability.</strong> Break-glass and role substitution are decided as own-name, timed, audited self-staffing — never impersonation (<a href="../decisions/adr-0130-break-glass-escalation/">ADR-0130</a>/<a href="../decisions/adr-0131-role-substitution-edges/">ADR-0131</a>). <strong>At this writing the mechanism is not yet built</strong> (it is in the 1.0 runway, v1.0-criteria C-4c); the doctrine is already enforced in practice — see the register's row-48/QMB trail, where granting a role via API <em>as</em> a real person was refused as a false witnessed act.</li> </ul> <h2 id="6-evidence-integrity--the-audit-trail">6. Evidence integrity — the audit trail<a class="headerlink" href="#6-evidence-integrity--the-audit-trail" title="Permanent link">¶</a></h2> <ul> <li><strong>Append-only, twice-locked.</strong> No UPDATE/DELETE <em>policy</em> and no UPDATE/DELETE <em>grant</em> exist on <code>audit_event</code>, both asserted by <code>RlsPolicyInventoryTest</code> (RISK-004) — a stray future <code>GRANT UPDATE</code> fails the build rather than silently making evidence mutable. Unpaired surrogates are refused with a 400 rather than stored corrupted; a link-borne decline records <em>no</em> actor rather than forging one; caps are disclosed on the wire.</li> <li><strong>The census.</strong> The trail-honesty review (2026-09-04, <a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-trail-honesty.md">review-trail-honesty.md</a>) walked ~110 distinct action kinds from both directions — every recording site, and every mutation asking what records nothing. Verdict: <em>"the trail's writing discipline is unusually strong"</em> — with the hard attribution cases (token declines, acceptance staffing, scheduler acts, imported provenance) already argued and right. The gaps it found are omission-shaped and are the current hardening wave: TH-1 (backup download unaudited), TH-2 (task resolution anonymous — for <code>DISPOSAL_DUE</code> a retention deferral with no recorded actor), TH-8/TH-9 (payload-less governance-config events — the trail cannot reconstruct the review policy in force at a past release; the matrix's REQ-AUD-005 "verified" over-claims until this lands), TH-11 (within one transaction, display order is a stable coin flip). All <strong>[in flight]</strong>, lane A (§10).</li> <li><strong>Exports record before bytes.</strong> Every derived-artifact pull (audit pack, dossier, CSV, portability bundle, per-version PDF) records its <code>EXPORTED</code> event on the transaction that decides the copy, <em>before</em> the first byte can stream — verified exporter-by-exporter (the D-11/row-51 family). The one artifact pull still outside the discipline is TH-1's backup download.</li> <li><strong>Destruction is witnessed.</strong> Only two designed destroyers can remove trail rows (project dissolution, mandator deletion); both record what they destroy — counts per table, trail included — at a surviving anchor, in the same transaction, and one witnessed act in a scope makes it undissolvable (the V106 working-record tripwire; a single trail row makes an organization permanent). Legal hold blocks disposal outright.</li> </ul> <h2 id="7-concurrency-and-data-integrity">7. Concurrency and data integrity<a class="headerlink" href="#7-concurrency-and-data-integrity" title="Permanent link">¶</a></h2> <p>The whole-system concurrency review (2026-09-04, <a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-concurrency.md">review-concurrency.md</a>) built the system lock/ordering map and hunted cross-service interleavings. Verdict: <strong>zero CRITICAL, zero MAJOR.</strong> The load-bearing mechanisms were attacked and held, with the refutations recorded as results:</p> <ul> <li>the <strong>RISK-006 collab-buffer fix</strong> (a stale flush replaying over a newer save) is certified <em>"airtight in both orderings"</em> — the generation re-check happens under the buffer lock, and no interleaving exists in which a stale batch both holds the lock and sees a current generation;</li> <li>the <strong>ADR-0092 blob-deletion mutex</strong> is a genuine mutex against every writer counterparty (import, restore, disposal-immediate, sweep-vs-sweep); RISK-005's named model residual (a third ordering) is on the post-1.0 list;</li> <li><strong>SSE never notifies uncommitted state</strong> (post-commit relay through the one wrapper every content transaction uses); invitation redemption and the last-administrator invariant are closed by conditional UPDATEs and a held advisory lock.</li> </ul> <p>Four findings stand — X-1 (export stream vs disposal's immediate purge: one lost export attempt, retryable, no corruption), X-2 (a disposal/dissolution lock-order inversion: a detectable deadlock two admins can trigger in a teardown), X-3/X-4 (retried approve/restore double-fire: a misleading 500, a duplicated history entry) — three MINOR, one NOTE, none a separation or corruption path. <strong>[in flight]</strong>, lane B (§10).</p> <h2 id="8-the-deployed-perimeter">8. The deployed perimeter<a class="headerlink" href="#8-the-deployed-perimeter" title="Permanent link">¶</a></h2> <p>The reference topology (<a href="../operations/server-deployment/">server-deployment.md</a>) is a single Linux host, and its exposure summary is the deployment's security claim:</p> <ul> <li><strong>Public: 443 (and 80 for ACME/redirect) only.</strong> Automatic TLS with HSTS via Caddy. PostgreSQL is never published; the app's HTTP port is never published; Keycloak's <strong>admin console and master realm are not routed publicly</strong> (Caddy answers 404 — not 403, no confirmation an admin console exists) and are reached only via an SSH tunnel to a loopback-bound port.</li> <li><strong>Outbound: the server never fetches a user-supplied URL.</strong> No server-side request is ever made to a URL an author or a user provides — not to render content, not to preview a reference, not to validate one. The only URLs the application dials are its operator-configured infrastructure (the IdP, the database); document content reaches the server, never the reverse. Consequently the whole <strong>SSRF class is structurally absent</strong> rather than filtered: there is no fetching code path to defend, no allow-list to keep correct, no DNS-rebinding window. Content follows the same line: a document's only embeddable image is one of its own attachments, and an external image reference degrades to an inert chip on <em>every</em> surface, reader and author alike (register row 73, ruled 2026-09-06 — a third party's bytes cannot be part of a released record). This is a <strong>standing rule, overturnable only by ADR</strong>: the one feature that wants such a fetch — the external-image snapshot with provenance (register row 74, same day) — is designed client-side, as Tier 1 (browser CORS fetch) and Tier 2 (guided copy-paste), <em>because</em> the server-side Tier 0 is closed.</li> <li><strong>Host hardening is in the guide, not assumed:</strong> ufw plus the <code>DOCKER-USER</code> rule (Docker publishes around ufw — stated, with the iptables counter-rule), unattended OS updates, secrets via an env file with a §5.1 regeneration inventory, and a rotation runbook (§10 there).</li> <li><strong>The deliberate negatives are named in the guide's own §14</strong> so none reads as an oversight, and this posture repeats the security-relevant ones: Keycloak runs on its dev-file (H2) store (backed up as a realm export every run — the volume is load-bearing); <strong>the runtime datasource is a single BYPASSRLS credential</strong> with separation enforced by the per-transaction <code>SET LOCAL ROLE lqms_app</code> discipline — DEBT-001, see §10 and <a href="../known-limits/">known-limits</a>; the published image is neither signed nor attested; the registry pull credential is one personal token; there is no metrics/log-aggregation stack; the reverse proxy's access logs are <strong>off as a privacy decision</strong> (client IPs + document URLs are personal data needing a retention decision first).</li> <li><strong>Backups:</strong> nightly <code>pg_dump</code> + blob copy with re-hash + Keycloak realm export; restore validates fully before the destructive point (RISK-007); rehearsals are graded against the archive's own manifest, and an aborted rehearsal is never a PASS. The reference installation's own two host-side gaps (off-server target, dead-man ping) are stated in §9.1 in present tense rather than papered over.</li> </ul> <h2 id="9-supply-chain">9. Supply chain<a class="headerlink" href="#9-supply-chain" title="Permanent link">¶</a></h2> <ul> <li><strong>The production frontend dependency set is gated at any severity</strong>: <code>npm audit --omit=dev</code> blocks the pipeline, with a dated-expiry exceptions file as the only bypass (ADR-0103). This gate has teeth in practice: the 2026-09-03 @tiptap prototype-pollution advisory <strong>blocked the release pipeline until the bump shipped</strong> (v0.9.43).</li> <li><strong>Release gating over the SBOM</strong>: the tag-only job runs grype over the CycloneDX SBOMs; any finding ≥ High blocks unless a <em>human decision</em> exists in <a href="https://github.com/nburri/lqms/blob/main/docs/security/vuln-triage.md">vuln-triage.md</a> — a <code>PENDING</code> row still blocks, never silently. Dependabot is the closure authority for the continuous posture. The SBOM is attached to every GitHub release.</li> <li><strong>Declared limits:</strong> base images are pinned by tag, not digest (releases are not bit-reproducible from source — on the post-1.0 list with the 62304 §8 argument), and the image's own layer-level SBOM is the registered follow-up.</li> </ul> <h2 id="10-residuals--the-complete-list-each-with-its-home">10. Residuals — the complete list, each with its home<a class="headerlink" href="#10-residuals--the-complete-list-each-with-its-home" title="Permanent link">¶</a></h2> <p>Nothing below is hidden behind the walls above. State column: <strong>shipped</strong> = the control exists and is verified in a released version; <strong>in flight</strong> = in the v0.9.45 hardening waves at this writing; <strong>registered</strong> = decided/tracked, not yet built; <strong>accepted</strong> = a recorded acceptance with its argument.</p> <table> <thead> <tr> <th>Residual</th> <th>Class</th> <th>Home</th> <th>State</th> </tr> </thead> <tbody> <tr> <td>F-1 — the audit-append DB backstop void as a tenant boundary (convention-only wall)</td> <td>MAJOR (defense-in-depth; no live path)</td> <td>register row 57©: V128 predicate + <code>AuditRecordCensusTest</code></td> <td><strong>in flight</strong> (lane A)</td> </tr> <tr> <td>F-2 — the source-event fan-out count is a standing cross-tenant time-series readable at GLOBAL</td> <td>MINOR (designed disclosure, ADR-0035)</td> <td>adversarial review F-2; revisit if a non-operator librarian persona ever exists</td> <td>accepted</td> </tr> <tr> <td>F-3 — four call-site conventions (gate-then-record, pass-own-id, oracle-behind-gate, bind-publish) have no census</td> <td>MINOR</td> <td>adversarial review F-3; row 57's census guard covers the first</td> <td>partly <strong>in flight</strong></td> </tr> <tr> <td>F-4 — <code>lqms_scope_contents</code> answers existence before authority (both callers gate first)</td> <td>NOTE</td> <td>adversarial review F-4, S remedy named</td> <td>registered</td> </tr> <tr> <td>F-5 — the anchor-append republish window is ordering, not mechanism</td> <td>NOTE</td> <td>adversarial review F-5, S remedy named</td> <td>registered</td> </tr> <tr> <td>Four NEEDS-RUNTIME-TEST separation probes (save-point RLS, pin degrade, append backstop pin, fan-out entry gates)</td> <td>test debt</td> <td>adversarial review, specified for a lane</td> <td>registered</td> </tr> <tr> <td>TH-1 backup download unaudited · TH-2 anonymous task resolution/disposal deferral · TH-3 JIT mint · TH-8/9 payload-less governance events · TH-11/12 ordering</td> <td>2 MAJOR-unaudited, 2 MAJOR-payload, rest MINOR/NOTE</td> <td><a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-trail-honesty.md">review-trail-honesty.md</a>; candidate hazard row drafted for the register's audit-trail-integrity category</td> <td><strong>in flight</strong> (lane A)</td> </tr> <tr> <td>REQ-AUD-005 marked <em>verified</em> in the matrix while three of its named examples are unrealized</td> <td>evidence over-claim</td> <td>trail-honesty TH-8 rider — downgrade until the payload fixes land</td> <td><strong>in flight</strong></td> </tr> <tr> <td>X-1..X-4 — export-vs-purge stream abort, disposal/dissolve lock inversion, approve/restore retry double-fires</td> <td>3 MINOR, 1 NOTE</td> <td><a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-concurrency.md">review-concurrency.md</a></td> <td><strong>in flight</strong> (lane B)</td> </tr> <tr> <td>RISK-001..009 — residual ratings all ⚠/acceptable, none ✗; <strong>formal acceptance of every row is OPEN</strong> pending the D-3 recording mechanism (acceptance document type + Quality Responsible role, neither built)</td> <td>risk process</td> <td><a href="../process/risk_management/">risk_management.md</a>; register rows 61 (D-3 realization) and 60</td> <td>registered (1.0 build lane)</td> </tr> <tr> <td>RISK-002 / DEBT-001 — single BYPASSRLS datasource; two-role packaging staged</td> <td>accepted residual, compensated (Konsist rule + <code>PrivilegedDataAccessInventoryTest</code>, mutation-proven; residual re-rated P2→P1)</td> <td>D-4 ruling 2026-08-21; arc42 §11 DEBT-001; <a href="../known-limits/">known-limits</a></td> <td>accepted</td> </tr> <tr> <td>RISK-005 — the quarantine model's uncovered third ordering</td> <td>named model limitation</td> <td>ADR-0092 honesty note; post-1.0 list (shared-(scope,hash)-lock amendment)</td> <td>accepted, registered</td> </tr> <tr> <td>RISK-009 — wrong-issuer and expiry rejection configured but untested</td> <td>test residue</td> <td><code>WrongAudienceTokenTest</code> KDoc (reason: no second-realm path in the harness)</td> <td>accepted</td> </tr> <tr> <td>Trail readback: no evidence artifact carries trail extracts (REQ-AUD-006 accepted-gap; TH-14)</td> <td>MINOR</td> <td>matrix accepted-gap; post-1.0 trail-extract lane</td> <td>accepted, registered</td> </tr> <tr> <td>Image signing/attestation absent; tag-pinned base images; personal registry token</td> <td>supply chain</td> <td>server-deployment §14; post-1.0 list (digest pinning)</td> <td>accepted</td> </tr> <tr> <td>Reference installation: off-server backup target + dead-man ping not yet applied</td> <td>operational</td> <td>server-deployment §9.1 (host-side, named owner); v1.0-criteria C-5</td> <td>registered (his hands)</td> </tr> </tbody> </table> <h2 id="sources">Sources<a class="headerlink" href="#sources" title="Permanent link">¶</a></h2> <p>The five 2026-09-04 cross-cutting reviews (<a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-separation-adversarial.md">separation-adversarial</a> · <a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-concurrency.md">concurrency</a> · <a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-trail-honesty.md">trail-honesty</a> · <a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-adr-coherence.md">adr-coherence</a> · <a href="https://github.com/nburri/lqms/blob/main/docs/planning/review-v1-criteria-truth.md">v1-criteria-truth</a>), the C-1a findings registers, the <a href="../process/risk_management/">risk register</a>, the <a href="https://github.com/nburri/lqms/blob/main/docs/planning/open-decisions.md">open-decisions register</a>, ADR-0002/0009/0011/0012/0018/0026/0027/ 0028/0033/0092/0125/0128/0129/0130/0131/0132, the <a href="../traceability/matrix/">traceability matrix</a>, and <a href="../operations/server-deployment/">server-deployment.md</a> / <a href="../operations/deployment/">deployment.md</a>. Line-level citations in §3 are the adversarial review's own, quoted as it recorded them.</p> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type="button" class="md-top md-icon" data-md-component="top" hidden> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> Back to top </button> </main> <footer class="md-footer"> <nav class="md-footer__inner md-grid" aria-label="Footer" > <a href="../known-limits/" class="md-footer__link md-footer__link--prev" aria-label="Previous: LQMS Known Limits"> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class="md-footer__title"> <span class="md-footer__direction"> Previous </span> <div class="md-ellipsis"> LQMS Known Limits </div> </div> </a> <a href="../architecture/01_introduction_and_goals/" class="md-footer__link md-footer__link--next" aria-label="Next: 1. Introduction and Goals"> <div class="md-footer__title"> <span class="md-footer__direction"> Next </span> <div class="md-ellipsis"> 1. Introduction and Goals </div> </div> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class="md-copyright"> <div class="md-copyright__highlight"> Built from <code>v0.9.56-4-g06c7f811</code> (commit <code>06c7f811</code>, 2026-09-09) — the same Markdown the repository ships. </div> </div> </div> </div> </footer> </div> <div class="md-dialog" data-md-component="dialog"> <div class="md-dialog__inner md-typeset"></div> </div> <script id="__config" type="application/json">{"base": "..", "features": ["navigation.instant", "navigation.tracking", "navigation.top", "navigation.footer", "navigation.indexes", "toc.follow", "search.suggest", "search.highlight", "content.code.copy", "content.action.edit"], "search": "../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src="../assets/javascripts/bundle.83f73b43.min.js"></script> </body> </html>