audit: Wave-32 reaudit after #266-#271 (375/402, 93% A)

audit/.lane-c01/C01.md

@@ -1,5 +1,5 @@
 CLUSTER_START cluster=C01 repo=SessionLedger pillars=L10-L19 date=2026-07-14
-# Wave-27 reaudit tip 114428a (#227-#232)
+# Wave-32 reaudit tip 776910b (#266-#271)
 
 ### L10 — CI/CD Hygiene
 score: 3  glyph: ✓
@@ -82,14 +82,17 @@ gaps:
 soft_goal_delta: +95% toward polished CLI UX (completions + help examples landed Wave-27 #230; score held at pillar max)
 
 ### L16 — Internationalization (i18n / l10n)
-score: 0  glyph: ✗
+score: 1  glyph: ~
 evidence:
-  - MISSING: gettext/fluent/i18n crates or locale catalogs (grep returned no i18n framework)
-  - crates/sl-viewer/src/theme.rs:7-8 — English-only UI strings inline
-  - README.md:1-44 — English-only docs
+  - locales/en.json — Phase-0 English JSON catalog with required keys (#269)
+  - src/i18n.rs — catalog lookup helper (`t` / `try_catalog`) (#269)
+  - docs/ops/i18n.md — English-only posture + future Fluent/ICU hooks (#269)
+  - scripts/i18n-check.ps1 — hermetic SelfCheck for catalog + module anchors (#269)
+  - tests/i18n.rs — cargo test wrapper for SelfCheck (#269)
+  - MISSING: Fluent/ICU multi-locale catalogs; viewer string migration beyond stub
 gaps:
-  - Not started; add fluent/ICU if multi-locale becomes a goal — effort: L
-soft_goal_delta: not started
+  - Expand beyond English stub; wire Fluent/ICU if multi-locale becomes a goal — effort: L
+soft_goal_delta: +20% — Phase-0 locale catalog + lookup helper Wave-32 #269; multi-locale unpaid
 
 ### L17 — Accessibility (a11y)
 score: 3  glyph: ✓
@@ -141,5 +144,6 @@ Wave-21: L10 CI concurrency + auxiliary SHA pins (#185); L15 CLI exit-code polis
 Wave-24: L18 .env.example + env-example CI gate + rotation docs (#201); L18 +1.
 Wave-26: L10 quality-gate.yml commit-SHA pin (#225); score held — L10 already pillar max.
 Wave-27: L15 clap completions + richer help (#230); score held — L15 already pillar max.
-CLUSTER_TOTAL score=27/30 pct=90% grade=A
+Wave-32: L16 i18n scaffold / locale catalog stub (#269); L16 +1 (0→1; Fluent/ICU unpaid).
+CLUSTER_TOTAL score=28/30 pct=93% grade=A
 CLUSTER_DONE cluster=C01 repo=SessionLedger

audit/.lane-c04/C04.md

@@ -1,5 +1,5 @@
 CLUSTER_START cluster=C04 repo=SessionLedger pillars=L31-L40 date=2026-07-14
-# Wave-31 reaudit tip a7d1a8e (#259-#264)
+# Wave-32 reaudit tip 776910b (#266-#271)
 
 ### L31 — Secrets in repo
 score: 3  glyph: ✓
@@ -123,14 +123,16 @@ evidence:
   - Containerfile:1-11 — multi-stage rust→debian image for sl-daemon
   - .github/workflows/ci.yml:15 — ubuntu-latest hosted runner; no privileged: true
   - .github/workflows/security.yml:11-12 — permissions: contents: read (least privilege)
-  - docs/ops/sandbox-boundary.md — sandbox boundary checklist SSOT (USER/VOLUME/loopback/least-priv) (#255)
-  - scripts/sandbox-boundary-check.ps1 — hermetic SelfCheck for Containerfile + trust-boundary anchors (#255)
+  - docs/ops/sandbox-boundary.md — sandbox boundary checklist + soft seccomp/no-net operator guidance (#255/#268)
+  - packaging/oci/sl-daemon-seccomp.json — checked-in seccomp deny-list sample (#268)
+  - packaging/oci/compose.sl-daemon.soft-hardening.yml — no-new-privileges / cap-drop ALL sample (#268)
+  - scripts/sandbox-boundary-check.ps1 — hermetic SelfCheck for Containerfile + seccomp/compose anchors (#255/#268)
   - tests/sandbox_boundary.rs — cargo test wrapper for SelfCheck (#255)
-  - .github/workflows/security.yml — soft `sandbox-boundary` job (`continue-on-error`) (#255)
-  - MISSING: seccomp profile / rootless / no-net CI sandbox policy
+  - .github/workflows/security.yml — soft `sandbox-boundary` job (`continue-on-error`) (#255/#268)
+  - MISSING: hard rootless / blocking no-net CI sandbox policy
 gaps:
-  - Add seccomp profile and documented no-net CI sandbox — effort: M
-soft_goal_delta: +55% — sandbox checklist + SelfCheck Wave-30 #255; seccomp/no-net unpaid (score held)
+  - Make seccomp/no-net CI blocking and document hard rootless runtime — effort: M
+soft_goal_delta: +70% — soft seccomp/no-net policy Wave-32 #268; hard CI unpaid (score held)
 
 Wave-15: L31 gitleaks pre-commit hook (+1).
 Wave-16: L31 TruffleHog dual-scan CI (#152); score held at pillar max.
@@ -139,5 +141,6 @@ Wave-26: L37 Renovate + patch automerge (#220); L37 +1 (L33 gitleaks SARIF evide
 Wave-27: L34 branch-protection verify script (#228); score held — L34 already pillar max; L36 2FA unpaid.
 Wave-30: L40 sandbox boundary checklist + SelfCheck (#255); score held — seccomp/no-net unpaid; soft CI.
 Wave-31: L38 OSV/NVD CVE feed SSOT + SelfCheck (#259); L38 +1 (2→3).
+Wave-32: L40 soft seccomp/no-net sandbox policy (#268); score held — soft CI; hard rootless/no-net unpaid.
 CLUSTER_TOTAL score=26/30 pct=87% grade=B
 CLUSTER_DONE cluster=C04 repo=SessionLedger

audit/.lane-c05/C05.md

@@ -1,5 +1,5 @@
 CLUSTER_START cluster=C05 repo=SessionLedger pillars=L41-L50 date=2026-07-14
-# Wave-30 reaudit tip 27435e5 (#252-#257)
+# Wave-32 reaudit tip 776910b (#266-#271)
 
 ### L41 — Structured logs
 score: 3  glyph: ✓
@@ -41,14 +41,14 @@ soft_goal_delta: +95% (per-route RED histogram buckets landed Wave-19 #169; OTLP
 ### L44 — Distributed trace propagation
 score: 3  glyph: ✓
 evidence:
-  - crates/sl-daemon/src/http.rs:151-188 — validates W3C v00 traceparent IDs and rejects zero/malformed contexts
-  - crates/sl-daemon/src/http.rs:190-225 — records upstream trace fields on request spans and echoes valid traceparent responses
-  - crates/sl-daemon/src/http.rs:599-648 — parser and end-to-end HTTP propagation/counting tests
-  - docs/ops/observability.md:141-148 — propagation behavior and HTTP-only limitation documented
-  - MISSING: OpenTelemetry parent-context extraction/tracestate/baggage and propagation into worker/pipeline spans
+  - crates/sl-daemon/src/traceparent.rs — W3C v00 traceparent parse + helper API (#271)
+  - crates/sl-daemon/src/http.rs — validates upstream traceparent IDs and echoes valid response headers
+  - crates/sl-daemon/src/worker.rs — worker/pipeline span propagation of parsed trace context (#271)
+  - docs/ops/observability.md — propagation behavior + worker helper contract documented (#271)
+  - MISSING: OpenTelemetry parent-context extraction/tracestate/baggage and OTLP cross-process parentage
 gaps:
-  - Convert parsed headers into OTel parent context and carry context through pipeline stages — effort: M
-soft_goal_delta: +60% (HTTP traceparent correlation landed; true cross-process parentage remains)
+  - Convert parsed headers into OTel parent context with tracestate/baggage — effort: M
+soft_goal_delta: +85% — worker propagation helper Wave-32 #271; OTel parent-context unpaid (score held at pillar max)
 
 ### L45 — Continuous profiling
 score: 2  glyph: ~
@@ -145,5 +145,6 @@ Wave-22: L46 multi-window SLO burn rules + game-day/alert routing (#189); L46 +1
 Wave-24: L45 pprof operator docs + pprof-smoke CI (#204); L45 +1.
 Wave-27: L45 unix CPU pprof protobuf sampler (#232); score held — continuous agent / Windows unpaid.
 Wave-30: L45 continuous profiling agent stub soft (#254); score held — Pyroscope/OTLP push unpaid.
+Wave-32: L44 W3C traceparent worker propagation helper (#271); score held — L44 already pillar max; OTel parent-context unpaid.
 CLUSTER_TOTAL score=29/30 pct=97% grade=A
 CLUSTER_DONE cluster=C05 repo=SessionLedger

audit/.lane-c07/C07.md

@@ -1,5 +1,5 @@
 CLUSTER_START cluster=C07 repo=SessionLedger pillars=L61-L70 date=2026-07-14
-# Wave-31 reaudit tip a7d1a8e (#259-#264)
+# Wave-32 reaudit tip 776910b (#266-#271)
 
 ### L61 — Devcontainer / .devcontainer
 score: 3  glyph: ✓
@@ -86,9 +86,13 @@ evidence:
   - fuzz/corpus/jsonl_ingest/two_sessions.jsonl — corpus seed (#203)
   - fuzz/Cargo.toml — registers jsonl_ingest target (#203)
   - .github/workflows/ci.yml — fuzz smoke runs okf_roundtrip and jsonl_ingest (#203)
+  - docs/ops/fuzz-cadence.md — sustained soft fuzz cadence SSOT (#266)
+  - .github/workflows/fuzz-cadence.yml — scheduled/soft sustained fuzz (`continue-on-error`) (#266)
+  - scripts/fuzz-cadence-check.ps1 — hermetic SelfCheck for cadence anchors (#266)
+  - tests/fuzz_cadence.rs — cargo test wrapper for SelfCheck (#266)
 gaps:
-  - Longer-running fuzz cadence / crash corpus triage beyond PR smoke — effort: M
-soft_goal_delta: +55% — two cargo-fuzz targets + CI smoke landed Wave-9/#203; sustained fuzz remains
+  - Longer-running crash corpus triage / blocking sustained fuzz beyond soft cadence — effort: M
+soft_goal_delta: +70% — soft sustained cadence Wave-32 #266; blocking longer fuzz unpaid (score held)
 
 ### L68 — Flake detection
 score: 3  glyph: ✓
@@ -143,5 +147,6 @@ Wave-24: L67 jsonl_ingest fuzz target + corpus/CI (#203); L67 +1 (L66 evidence r
 Wave-26: enforced pipeline perf-budget gate (#223) evidence lives under C08 L74 (already pillar max); WBS-6.2 perf soft goal closed — C07 score held.
 Wave-30: L64 test pyramid SSOT + SelfCheck (#253); L64 +1 (2→3).
 Wave-31: L66 broaden property tests for lifecycle FSM (#261); L66 +1 (2→3).
+Wave-32: L67 sustained fuzz cadence soft job (#266); score held — soft `continue-on-error`; blocking longer fuzz unpaid.
 CLUSTER_TOTAL score=29/30 pct=97% grade=A
 CLUSTER_DONE cluster=C07 repo=SessionLedger

audit/.lane-c08/C08.md

@@ -1,5 +1,5 @@
 CLUSTER_START cluster=C08 repo=SessionLedger pillars=L71-L80 date=2026-07-14
-# Wave-31 reaudit tip a7d1a8e (#259-#264)
+# Wave-32 reaudit tip 776910b (#266-#271)
 
 ### L71 — Eval Corpus Coverage
 score: 3  glyph: ✓
@@ -56,18 +56,18 @@ gaps:
 soft_goal_delta: +90% — enforced per-PR perf-budget SelfCheck + blocking bench-gate landed Wave-26 #223
 
 ### L75 — Cross-Language Parity
-score: 1  glyph: ~
+score: 2  glyph: ~
 evidence:
   - Cargo.toml:1-16 — Rust workspace (session-ledger + sl-viewer); no Py/Go/TS packages
-  - docs/ops/cross-language-parity.md — fixture parity SSOT matrix (Python/TypeScript/Go tags) (#260)
-  - scripts/cross-language-parity-check.ps1 — hermetic SelfCheck for matrix fixtures + language tags (#260)
+  - docs/ops/cross-language-parity.md — fixture parity SSOT + OKF v1.0 structural invariant harness (#260/#267)
+  - scripts/cross-language-parity-check.ps1 — hermetic SelfCheck for matrix tags + shared-core structural fingerprint (#260/#267)
   - tests/cross_language_parity.rs — cargo test wrapper for SelfCheck (#260)
-  - .github/workflows/eval-compression.yml — blocking `cross-language-parity` SelfCheck job (#260)
-  - docs/EVAL_SCOPE.md — cross-language fixture parity in-scope; Harbor N/A retained (#260)
-  - MISSING: native language adapters / SDK ports beyond OKF fixture tags
+  - .github/workflows/eval-compression.yml — blocking `cross-language-parity` SelfCheck job (#260/#267)
+  - docs/EVAL_SCOPE.md — cross-language fixture + structural parity in-scope; Harbor N/A retained (#260/#267)
+  - MISSING: native language adapters / SDK ports beyond fixture + structural harness
 gaps:
-  - Ship language adapters or consumer harnesses beyond fixture-tag parity — effort: L
-soft_goal_delta: +25% — fixture parity scaffold + blocking SelfCheck Wave-31 #260; adapters unpaid
+  - Ship language adapters or consumer harnesses beyond structural fixture parity — effort: L
+soft_goal_delta: +50% — structural OKF invariant harness Wave-32 #267; adapters unpaid
 
 ### L76 — Agent-Eval Pipeline
 score: 2  glyph: ~
@@ -141,5 +141,6 @@ Wave-26: L71/L80 seventeen-fixture task-family corpus (#221); L74 enforced perf-
 Wave-28: L77 compression/token fixtures + eval gate (#239); L77 +1; L71 corpus 20 fixtures (held at max).
 Wave-29: L78 token-burn ledger smoke (#248); L78 +1.
 Wave-31: L75 cross-language fixture parity SSOT + SelfCheck (#260); L75 +1 (0→1; adapters unpaid).
-CLUSTER_TOTAL score=27/30 pct=90% grade=A
+Wave-32: L75 structural OKF invariant harness across Py/TS/Go fixtures (#267); L75 +1 (1→2; adapters unpaid).
+CLUSTER_TOTAL score=28/30 pct=93% grade=A
 CLUSTER_DONE cluster=C08 repo=SessionLedger

audit/.lane-c09/C09.md

@@ -1,5 +1,5 @@
 CLUSTER_START cluster=C09 repo=SessionLedger pillars=L81-L95 date=2026-07-14
-# Wave-31 reaudit tip a7d1a8e (#259-#264)
+# Wave-32 reaudit tip 776910b (#266-#271)
 
 ### L81.1 — WCAG 2.2 Level A Baseline
 score: 3  glyph: ✓
@@ -150,17 +150,19 @@ gaps:
 soft_goal_delta: +85% — production responsive shell + overflow/touch CI landed Wave-16 #155
 
 ### L81.12 — Recognition Over Recall
-score: 2  glyph: ~
+score: 3  glyph: ✓
 evidence:
   - crates/sl-viewer/src/app.rs:243-295 — persistent tab bar for primary navigation
   - crates/sl-viewer/src/timeline.rs:156-247 — tooltip panel for selected timeline bar
   - crates/sl-viewer/src/command_palette.rs — Cmd+K / Ctrl+K command palette (focus search, toggle theme) (#236)
   - crates/sl-viewer/src/app.rs — palette wired with dialog/listbox/option roles (#236)
-  - tests/visual/harness/a11y.spec.js — palette a11y harness coverage (#236)
+  - crates/sl-viewer/src/search_view.rs — advanced Search filters collapsed behind progressive-disclosure control + active-filter badge (#270)
+  - docs/a11y/progressive-disclosure.md — recognition-first progressive disclosure SSOT beyond Cmd+K (#270)
+  - tests/visual/harness/a11y.spec.js — palette + progressive-disclosure aria-expanded/panel/badge coverage (#236/#270)
   - crates/sl-daemon/src/main.rs:89-90 — `sl list` surfaces compiled bundles
 gaps:
   - Wizard breadcrumbs / prefilled edit forms where multi-step flows appear — effort: S
-soft_goal_delta: +55% — Cmd+K palette Wave-28 #236; progressive disclosure beyond palette remains
+soft_goal_delta: +95% — progressive disclosure beyond palette Wave-32 #270
 
 ### L81.13 — Help & Documentation Accessibility
 score: 3  glyph: ✓
@@ -212,5 +214,6 @@ Wave-28: L81.12 Cmd+K command palette (#236); L81.12 +1; live-daemon native atta
 Wave-29: L81.14 expand command palette actions (#249); L81.14 +1.
 Wave-30: L81.9 overlay Escape consistency + a11y (#257); L81.9 +1 (2→3).
 Wave-31: L81.8 design-token single source (#263); L81.8 +1 (2→3).
-CLUSTER_TOTAL score=43/45 pct=96% grade=A
+Wave-32: L81.12 progressive disclosure beyond command palette (#270); L81.12 +1 (2→3).
+CLUSTER_TOTAL score=44/45 pct=98% grade=A
 CLUSTER_DONE cluster=C09 repo=SessionLedger

audit/SCORECARD.md

@@ -3,8 +3,8 @@
 **Repo:** KooshaPari/SessionLedger
 **Date:** 2026-07-14
 **Repo-type profile:** CLI+daemon + desktop (sl-daemon + sl-viewer)
-**Auditor:** cursor-w31-reaudit
-**Commit audited:** a7d1a8e (origin/main / Wave-31)
+**Auditor:** cursor-w32-reaudit
+**Commit audited:** 776910b (origin/main / Wave-32)
 
 > Rubric SSOT: phenotype-org-audits/audit-v38
 
@@ -13,41 +13,40 @@
 | Cluster | Category | Pillars | Score (sum/max) | Pct | Grade | Notes |
 |---------|----------|---------|:---------------:|:---:|:-----:|-------|
 | C00 | Architecture + Module | L0-L9 | 28/30 | 93% | A | see audit/.lane-c00 |
-| C01 | CI, DX, Observability | L10-L19 | 27/30 | 90% | A | see audit/.lane-c01 |
+| C01 | CI, DX, Observability | L10-L19 | 28/30 | 93% | A | see audit/.lane-c01 |
 | C02 | Error handling, API, Governance | L20-L29 | 28/30 | 93% | A | see audit/.lane-c02 |
 | C03 | Agent Readiness | L30 | 36/36 | 100% | A | see audit/.lane-c03 |
 | C04 | Security | L31-L40 | 26/30 | 87% | B | see audit/.lane-c04 |
 | C05 | Observability (deep) | L41-L50 | 29/30 | 97% | A | see audit/.lane-c05 |
 | C06 | Supply Chain | L51-L60 | 26/30 | 87% | B | see audit/.lane-c06 |
 | C07 | DX, QEng, Portability | L61-L70 | 29/30 | 97% | A | see audit/.lane-c07 |
-| C08 | Eval Coverage | L71-L80 | 27/30 | 90% | A | see audit/.lane-c08 |
-| C09 | Accessibility + UX | L81-L95 | 43/45 | 96% | A | see audit/.lane-c09 |
+| C08 | Eval Coverage | L71-L80 | 28/30 | 93% | A | see audit/.lane-c08 |
+| C09 | Accessibility + UX | L81-L95 | 44/45 | 98% | A | see audit/.lane-c09 |
 | C10 | Visual Identity | L96-L107 | 36/36 | 100% | A | see audit/.lane-c10 |
 | C11 | Packaging + Distribution | L108-L122 | 37/45 | 82% | B | see audit/.lane-c11 |
 
 ## Overall
 
 **Weighted overall score:** 93% · **Overall grade:** A
 
-(Raw rubric total across all 12 clusters. Sum 372 / 402.)
+(Raw rubric total across all 12 clusters. Sum 375 / 402.)
 
-## Wave-31 Delta
+## Wave-32 Delta
 
 | Cluster | Before | After | Raw delta | Evidence-backed movement |
 |---------|:------:|:-----:|:---------:|--------------------------|
-| C04 | 25/30 | 26/30 | +1 | OSV/NVD CVE feed SSOT + SelfCheck (#259); L38 2→3 |
-| C07 | 28/30 | 29/30 | +1 | Lifecycle FSM property tests (#261); L66 2→3 |
-| C08 | 26/30 | 27/30 | +1 | Cross-language fixture parity SSOT + blocking SelfCheck (#260); L75 0→1 |
-| C09 | 42/45 | 43/45 | +1 | Design-token single source (#263); L81.8 2→3 |
-| **Overall** | **368/402 (92% A)** | **372/402 (93% A)** | **+4** | Conservative; four pillars only |
+| C01 | 27/30 | 28/30 | +1 | i18n scaffold / locale catalog stub (#269); L16 0→1 |
+| C08 | 27/30 | 28/30 | +1 | Cross-language structural OKF invariant harness (#267); L75 1→2 |
+| C09 | 43/45 | 44/45 | +1 | Progressive disclosure beyond command palette (#270); L81.12 2→3 |
+| **Overall** | **372/402 (93% A)** | **375/402 (93% A)** | **+3** | Conservative; three pillars only |
 
 ## Headline Findings
 
-- **Strongest:** C03/C10 (100% A); C05/C07 (97% A); C09 (96% A); C00/C02 (93% A)
+- **Strongest:** C03/C10 (100% A); C09 (98% A); C05/C07 (97% A); C00/C01/C02/C08 (93% A)
 - **Weakest:** C11 Packaging (82% B); C04/C06 (87% B)
-- **Wave-30 → Wave-31:** 92% A (368/402) → 93% A (372/402), +4 raw points
-- **Held (no score):** #262 crypto inventory KMS/at-rest Phase-0 deferred guidance (C02 L22 already 2; in-tree KMS unpaid); #264 soft loom concurrency smoke (C00 L7 soft `continue-on-error`; full loom/shuttle/blocking miri unpaid)
-- **Remaining unpaid:** maintainer 2FA (C04 L36), full SLSA-L3 isolation (C06), unconditional release-blocking OCI (C06), Authenticode/notarization (C11 L112), live brew/winget publish, live Alertmanager webhooks, continuous profiling push backend, full loom/shuttle/miri, jemalloc/production allocator, cross-language adapters beyond fixture parity (C08 L75), multi-tenant / in-tree PII redaction pipeline (C02 L24), in-tree KMS/envelope encryption (C02 L22)
+- **Wave-31 → Wave-32:** 93% A (372/402) → 93% A (375/402), +3 raw points
+- **Held (no score):** #266 sustained fuzz cadence soft job (C07 L67 soft `continue-on-error`; longer crash-corpus triage unpaid); #268 seccomp/no-net soft policy (C04 L40 soft CI; hard rootless/no-net unpaid); #271 W3C traceparent worker helper (C05 L44 already pillar max; OTel parent-context/tracestate unpaid)
+- **Remaining unpaid:** maintainer 2FA (C04 L36), full SLSA-L3 isolation (C06), unconditional release-blocking OCI (C06), Authenticode/notarization (C11 L112), live brew/winget publish, live Alertmanager webhooks, continuous profiling push backend, full loom/shuttle/miri, jemalloc/production allocator, native language adapters beyond structural fixture parity (C08 L75), multi-tenant / in-tree PII redaction pipeline (C02 L24), in-tree KMS/envelope encryption (C02 L22), Fluent/ICU multi-locale (C01 L16), hard seccomp/no-net CI (C04 L40)
 
 ## N/A / soft goals