AIIR verification and policy gates could report success without enforcing the control (fail-open)
### Summary Several of AIIR's verification and policy paths could return a success/"verified" result without actually enforcing the control they represent — they could **fail open** rather than fail closed. For a tool whose purpose is trustworthy verification, a consumer relying on these gates may have treated unverified or non-conforming input as verified. Found during an internal adversarial hardening review of AIIR (not a third-party audit). All paths are fixed in **1.7.0**. ### Affected paths - A `require_signing` policy gate could be satisfied by a forgeable/empty field, so an unsigned or forged-bundle receipt could pass a "signing req
- Auf 1.7.0 aktualisieren
Veröffentlicht Aktualisiert