[audit] Track September 2026 GroveDB audit follow-up

[QuantumExplorer]

This issue indexes all 73 reconciled groups from the September 2026 GroveDB audit, covering 140 source records.

The review used a saved worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. Ratings are provisional and based on source review. Full runtime and deployment validation remains outstanding. Known historical compatibility behavior is retained in this index and linked to existing work.

Labels separate four areas (P: proofs/queries; S: sync/restoration; M: mutations/references; C: parsing/costs), finding type, and provisional severity.

New-report links search for the stable group ID in the issue title. Existing-report links lead to the original issue; an audit addendum preserves its prior title and open/closed state.

Group	Audit follow-up	Tracking disposition
P01	Make the accepted proof policy explicit for current-state verification	New follow-up; needs validation
P02	Verified query and restore results may include data outside the committed tree	New follow-up; needs validation
P03	MMR and dense limited proofs can select the wrong authenticated page	New follow-up; needs validation
P04	Descending bulk and commitment proof reads return the opposite end of a range	New follow-up; needs validation
P05	Broad non-Merk proof checks allocate heavily before parent metadata is authenticated	New follow-up; needs validation
P06	Merging a valid empty subquery path can terminate with a panic	New follow-up; needs validation
P07	MMR index conversion still needs canonical-size and arithmetic-domain checks	Existing #692 (open); audit addendum
P08	Direct and batch references can disagree on wrapped terminal commitments	New follow-up; needs validation
P09	Historical terminal append-tree metadata binding is tracked by the V4 transition	Historical/compatibility review; no duplicate bug issue. PR #781, PR #782, PR #819
P10	Trunk and branch results can expose tree metadata not bound to the expected root	New follow-up; needs validation
P11	Formatting an invalid inner proof can fail to terminate	New follow-up; needs validation
P12	Optional absence projection needs coverage-aware terminal enumeration	Existing #689 (closed); audit addendum
P13	A generated shallow proof can exceed the decoder’s child-layer budget	New follow-up; needs validation
P14	V1 result and descent handling can consume unbound raw reference metadata	New follow-up; needs validation
P15	Regular query proof orientation can produce an incorrect verified absence	New follow-up; needs validation
P16	Count-offset proofs can paginate by descendant totals instead of selected rows	New follow-up; needs validation
P17	Bulk and commitment proof generation consumes limits for unselected range gaps	New follow-up; needs validation
P18	A direct key query with a zero result limit can still return a row	New follow-up; needs validation
P19	Sum-budget queries can omit or reject supported wrapped references	New follow-up; needs validation
P20	V1 descent can treat unbound tree classification as verified absence	New follow-up; needs validation
P21	Sum-budget verification can classify skipped rows without retaining their binding evidence	New follow-up; needs validation
P22	Historical empty-trunk verification is already tracked by the V1 transition	Historical/compatibility review; no duplicate bug issue. PR #646, PR #643, PR #819
S01	State restoration can accept item contents without authenticating them	New follow-up; needs validation
S02	State sync can complete with committed child data missing	New follow-up; needs validation
S03	Non-root chunk restoration can panic before structural rejection	New follow-up; needs validation
S04	Restore feature mismatches can reach aggregate verification panics	Existing #706 (open); audit addendum
S05	Rejected state-sync chunks prevent valid in-session retry	Existing #695 (open); audit addendum
S06	Failed synchronization leaves earlier subtree groups durable	Existing #679 (open); audit addendum
S07	Aggregate snapshot restoration can change restored totals or fail	Existing #671 (open); audit addendum
S08	Failed MMR flush loses pending nodes needed for retry	New follow-up; needs validation
S09	Commitment client append can return an error after persisting a leaf	New follow-up; needs validation
S10	Chunk identifier recovery exceeds the valid tree-depth work bound	New follow-up; needs validation
M001	Typed append updates discard NonCounted participation metadata	New follow-up; needs validation
M002	Skipped conditional inserts supply the wrong target commitment to references	New follow-up; needs validation
M003	CommitmentTree batch insertion omits conditional and overwrite-policy checks	New follow-up; needs validation
M004	Reference replacement bypasses the tree-only overwrite option	New follow-up; needs validation
M005	Recursive cleanup omits secondary namespaces owned by nested indexed trees	New follow-up; needs validation
M006	Partial continuation reads stale state for previously modified Merks	Existing #842 (open); audit addendum
M007	Continuation operations replace pending ancestor propagation	Existing #708 (open); audit addendum
M008	Callback DeleteTree omits deletion policy and cleanup preflight	Existing #709 (open); audit addendum
M009	Tree-carrying batch operations reset populated child caches before policy resolution	Existing #779 (open); audit addendum
M010	Ordinary batch commits a paused result while discarding its continuation	New follow-up; needs validation
M011	Recursive discovery treats non-Merk descendant storage as Merk records	New follow-up; needs validation
M012	Empty aggregate-tree creation accepts nonzero totals	New follow-up; needs validation
M013	Generic append-tree creation accepts unsupported initial metadata	New follow-up; needs validation
M014	Populated-child deletion reopens the parent with the wrong mode and type	Existing #686 (closed); audit addendum
M015	Append-tree clear retains the old parent metadata and commitment	New follow-up; needs validation
M016	Indexed replacement can retain cleanup after failure in a borrowed transaction	New follow-up; needs validation
M017	Partial callbacks silently omit typed append operations	New follow-up; needs validation
M018	Recursive batch reference resolution misses a nonempty-path guard	New follow-up; needs validation
M019	Indexed metadata overwrite does not validate canonical secondary-root identity	New follow-up; needs validation
M020	Failed standalone Merk mutation can detach reusable in-memory state	New follow-up; needs validation
M021	Directly constructed invalid wrappers reach batch assertions	New follow-up; needs validation
M022	Keyed child writes under new append trees use incompatible Merk storage	New follow-up; needs validation
M023	SumItem reference prediction uses flags different from the effective stored value	New follow-up; needs validation
C001	Element decoding can exceed its intended recursion bound	New follow-up; needs validation
C002	Inner Element decoding can allocate beyond the proof input budget	New follow-up; needs validation
C003	Public ChunkOp decoding allocates before validating resource limits	New follow-up; needs validation
C004	Read paths can panic during prefix length conversion	Existing #680 (open); audit addendum
C005	Missing-path diagnostics can panic when truncating UTF-8	New follow-up; needs validation
C006	Reconcile bulk and commitment read/hash accounting with the versioned cost model	New follow-up; needs validation
C007	Batched commitment appends omit their accumulated BLAKE3 cost	New follow-up; needs validation
C008	Mixed removal-cost addition drops default-owner allocations	Existing #683 (open); audit addendum
C009	Epoch flags accept ambiguous records and can lose removal attribution	Existing #701 (open); audit addendum
C010	Ordinary replacements retain stale specialized storage charges	New follow-up; needs validation
C011	Ordinal Serde Element formats disagree on variant identity	New follow-up; needs validation
C012	Batch estimates silently omit typed append operations	Existing #812 (closed); audit addendum
C013	Fallback deletion costs credit absent or already deleted data	New follow-up; needs validation
C014	Average insertion estimates omit wrapped-tree storage overhead	New follow-up; needs validation
C015	Indexed mirror estimates omit mixed sum-carrier key widths	New follow-up; needs validation
C016	Multichunk encoding can exceed its requested byte budget	New follow-up; needs validation
C017	Delete-up-tree results discard completed planning costs	New follow-up; needs validation
C018	Worst-case delete-up-tree estimates omit the requested leaf	New follow-up; needs validation

Remaining validation on closed reports

• P12: assess variable-length terminal enumeration and page-coverage assumptions on the intended target version. PR fix(query): apply terminal-key conditionals per item #734 addresses per-item conditional routing; the audit does not establish that its fix resolves every P12 subcase. Keep [audit][medium] terminal_keys resolves conditional branches differently from query execution #689 closed unless new target-version evidence warrants separate follow-up.

Historical compatibility dispositions

P09

This is a historical compatibility disposition, not a proposed new bug issue. V1 proofs under GROVE_V1–V3 can return terminal append-tree metadata without child-root binding. The saved finding already records the effective GROVE_V4 requirement that closes this particular gap.

Document the accepted protocol/envelope policy and track the existing V4 transition; preserve released replay behavior as required.

Merged PR #782 documents this exact gap, implements the V4 transition, and intentionally pins the old V1–V3 outcomes. PR #781 first records the separate terminal gap, while #819 preserves historical V0 policy. This group is retained in the audit index as already addressed by a versioned transition; it should not create a new bug issue.

Source-based assessment only; this audit did not reproduce the reported behavior at runtime.

These canonical records are indexed here for provenance; no separate open bug issue is proposed.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_77478aa514ef44f1bd545d13

Primary fingerprint: codex-security/v1:sha256:7831eb39f9e7cd0762022337ff1b62db038c6393052e0fa25b6616e932972cad

Source locations:

• Location (root_control): grovedb/src/operations/proof/bind_terminal_non_merk_tree/mod.rs:19-73
• Location (implementation): grovedb/src/operations/proof/bind_terminal_non_merk_tree/v0.rs:1-35
• Location (implementation): grovedb/src/operations/proof/verify.rs:2173-2220

P22

This is a historical compatibility disposition, not a proposed new bug issue. The legacy trunk path can return an empty result before checking the parent-child chain. The saved finding’s own counterevidence establishes that V1 performs the chain check before returning.

Document the supported current trunk-envelope policy and retain the existing V1 transition as the remediation reference.

Merged PR #646 documents this exact historical root cause and its V1 correction, with tests preserving the contrast. PR #819 explicitly freezes unchanged V0 review behavior, and #643 documents broader legacy compatibility. This group belongs in the audit index as an existing historical limitation, not a new bug issue.

Source-based assessment only; this audit did not reproduce the reported behavior at runtime.

These canonical records are indexed here for provenance; no separate open bug issue is proposed.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_9d9be6eb50a4a476d067cc6a

Primary fingerprint: codex-security/v1:sha256:d093ab0aa10c213b02ab13215fa11404d3413dcb959c4805430da1357ca920f0

Source locations:

• Location (entrypoint): grovedb/src/operations/proof/verify.rs:3550-3571
• Location (propagation): grovedb/src/operations/proof/verify.rs:3617-3680
• Location (root_control): grovedb/src/operations/proof/verify.rs:3684-3723
• Location (expected_control): grovedb/src/operations/proof/verify.rs:3748-3778
• Location (counterevidence): grovedb/src/operations/proof/verify.rs:3987-4028

Historical compatibility entries do not assert a newly introduced bug or a current deployment exposure. Issue state and proposed-fix status must be read from the linked live items.

Provenance: recovered scan 526001a9-f199-4923-ad7a-0f182f3b8ba7; manual reconciliation completed after native scan termination. Each actionable issue carries its canonical finding IDs and fingerprints.