[audit][P01] Make the accepted proof policy explicit for current-state verification

[QuantumExplorer]

Audit group: P01. Classification: hardening. Provisional severity: low. The recovered audit originally rated this high / security; tracking is qualified using the duplicate and compatibility review below.

Track this as low-priority API hardening. Generic verification allows a received envelope to select historical authentication semantics unless the caller independently restricts accepted proof policy. The useful follow-up is an explicit current-state policy across public wrappers; intentionally supported V0 behavior is not a new vulnerability.

Expose and consistently enforce a caller-selected minimum proof policy across current-state verification wrappers, while preserving deliberate historical replay compatibility.

PR #643 deliberately preserves V0 compatibility, and merged PR #819 freezes unchanged V0 review scope. PR #782 also states that Platform no longer accepts V0. This is a narrowly scoped library API/policy follow-up, not a new report about frozen V0 or evidence of Platform exposure.

Source-based assessment only; this audit did not reproduce the reported behavior at runtime.

Validation to complete

• Check trusted policy selection across raw, typed, subset, parent-info, and unified wrappers using existing valid historical and current fixtures.

Limits and existing work

• Tracking calibration: low hardening/API policy question, not a new high-severity V0 vulnerability. Preserve the original provisional high rating only in audit provenance.

Related tracking: PR #553 (merged), PR #643 (merged), PR #782 (merged), PR #819 (merged).

Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_238118b989a4a24732f50b94

Primary fingerprint: codex-security/v1:sha256:7eecab845912a4abb8da51822d06bb887408532360720090f2c56c6774ed66cb

Canonical finding ID: csf_7498084ea7714fec76cdad6d

Primary fingerprint: codex-security/v1:sha256:3e86ec14818868fffa2066fa357cf68572f581555638e445dda60b5c337e9f02

Canonical finding ID: csf_da36ed2fe82e4a93169613be

Primary fingerprint: codex-security/v1:sha256:f5fafc6801d5e8624397ce26d979b1662a8a1e64e93d6c5a72fca4061d16e903

Canonical finding ID: csf_fe09c6272c12e034ffbefe39

Primary fingerprint: codex-security/v1:sha256:5961ce9f5655149f49c4cb553b359e810698aa3823c8004d0a1b102abf494bad

Canonical finding ID: csf_51404340bfe222c0b740508d

Primary fingerprint: codex-security/v1:sha256:c082d8cb73ec58c8266de62c5e986fd085b90327631973c5268719a729c66882

Canonical finding ID: csf_ca3069d5339882af93fb83df

Primary fingerprint: codex-security/v1:sha256:b46eaeebd8f35f6c5c5dfc7e2d5215370def6f27721667843803b6b7b1ff6a75

Canonical finding ID: csf_ccad3e1e6a5ea3f8613912d9

Primary fingerprint: codex-security/v1:sha256:1eb051dc6d56c4e844aa4f8413eb9e70a84fab48c0b1b46bb91b9ff28fa05fa9

Canonical finding ID: csf_a3bb1c090214f4d9e3a43f38

Primary fingerprint: codex-security/v1:sha256:81a71280adcbe556bc4f0f5a0913202e466952d3981578c552021f73c9cee05e

Source locations:

• Location (root_control): grovedb/src/operations/proof/verify.rs:231
• Location (root_control): grovedb/src/operations/proof/verify.rs:370
• Location (propagation): grovedb/src/operations/proof/verify.rs:2989
• Location (propagation): merk/src/proofs/query/verify.rs:381
• Location (outcome): grovedb/src/operations/proof/verify.rs:3221
• Location (entrypoint): grovedb/src/operations/proof/verify.rs:231-238
• Location (entrypoint): grovedb/src/operations/proof/verify.rs:365-370
• Location (propagation): grovedb/src/operations/proof/verify.rs:2989-2996
• Location (root_control): merk/src/proofs/query/verify.rs:381-394
• Location (sink): merk/src/proofs/tree.rs:153-158
• Location (outcome): grovedb/src/operations/proof/verify.rs:3221-3268
• Location (outcome): grovedb/src/query_result_type.rs:532-544
• Location (entrypoint): grovedb/src/operations/proof/verify.rs:229-238
• Location (propagation): grovedb-version/src/version/v4.rs:247-254
• Location (propagation): grovedb/src/operations/proof/verify.rs:2989-3002
• Location (root_control): merk/src/proofs/query/verify.rs:375-394
• Location (sink): merk/src/proofs/tree.rs:153-165
• Location (propagation): grovedb/src/operations/proof/verify.rs:3221-3238
• Location (outcome): grovedb/src/operations/proof/verify.rs:3252-3260
• Location (outcome): grovedb/src/query_result_type.rs:529-545
• Location (root_control): grovedb/src/operations/proof/verify.rs:2989-2995
• Location (propagation): merk/src/proofs/query/verify.rs:375-398
• Location (propagation): grovedb/src/operations/proof/verify.rs:3221-3227
• Location (outcome): grovedb/src/operations/proof/verify.rs:3248-3272
• Location (expected_control): grovedb-version/src/version/v4.rs:248-255
• Location (root_control): grovedb/src/operations/proof/verify.rs:227-235
• Location (propagation): grovedb/src/operations/proof/verify.rs:2989-2999
• Location (root_control): merk/src/proofs/query/verify.rs:370-395
• Location (entrypoint): grovedb/src/operations/proof/verify.rs:356-376
• Location (entrypoint): grovedb/src/operations/proof/verify_path_query.rs:163-170
• Location (propagation): grovedb-version/src/version/v4.rs:250-258
• Location (root_control): grovedb/src/operations/proof/verify.rs:231-237
• Location (propagation): grovedb/src/operations/proof/verify.rs:2989-2995
• Location (sink): merk/src/proofs/query/verify.rs:381-394
• Location (supporting): merk/src/proofs/tree.rs:153-158
• Location (entrypoint): grovedb/src/operations/proof/verify_path_query.rs:163-174
• Location (entrypoint): grovedb/src/operations/proof/verify.rs:88-120
• Location (entrypoint): grovedb/src/operations/proof/verify.rs:3555-3568
• Location (propagation): grovedb/src/operations/proof/verify.rs:3633-3636
• Location (outcome): grovedb/src/operations/proof/verify.rs:3700-3717
• Location (supporting): grovedb/src/operations/proof/verify.rs:3752-3758
• Location (entrypoint): grovedb/src/operations/proof/verify.rs:226-237
• Location (root_control): grovedb/src/operations/proof/verify.rs:2992-3000
• Location (propagation): merk/src/proofs/tree.rs:153-165
• Location (entrypoint): grovedb-version/src/version/v4.rs:249-260
• Location (root_control): grovedb/src/operations/proof/verify.rs:231-236
• Location (entrypoint): grovedb/src/operations/proof/verify.rs:369-374
• Location (sink): grovedb/src/operations/proof/verify.rs:3221-3268
• Location (entrypoint): grovedb/src/operations/proof/verify.rs:115-120
• Location (root_control): grovedb/src/operations/proof/verify.rs:229-238
• Location (expected_control): merk/src/proofs/query/verify.rs:381-394
• Location (propagation): grovedb/src/operations/proof/verify.rs:3221-3225
• Location (outcome): grovedb/src/operations/proof/verify.rs:3268-3272
• Location (expected_control): grovedb-version/src/version/v4.rs:243-258