# CodeMark 0.3.0 source and security review

Date: 2026-10-16 UTC. Reviewed runtime source:
`d5b0d57e0a29d998d5d9c2b5514952b97eae075c`.

## Scope and outcome

The review covered source preservation, manifest integrity, GPG/OpenSSH key
pinning, CLI report transactions, resource bounds, portable packaging and release
content selection. A separate reviewer inspected the functional changes and
independently ran all **81 tests**, with zero failures, errors or skips.
The reviewed Python and packaging changes were approved with **no blocking
findings in that scope**.

This is a focused internal release review. Its evidence consists of source
inspection, regressions and local synthetic fixtures. It does not certify legal
ownership, all supported source-language parsers, Windows, GUI rendering, hostile
concurrent modification, or recovery after power loss. Website and deployment
checks have their own release records.

## Corrections verified

### Source freshness before GPG signing

The previous GPG path could sign a valid manifest after a source file had changed.
It now verifies the current tree under the project lock and checks that the
prepared manifest matches the verified digest. A real GPG regression confirms
that a stale tree is refused before a signature is published.

### Comment prologues preserve program data

A second-line encoding directive inside a Python multiline string could cause a
mark to be inserted into that string. An analogous CSS case could place a nested
comment marker into an existing comment. Header scanning now stops at code,
strings and unterminated block comments. Regression tests check Python runtime
output, CSS comment preservation and byte-exact removal. Each regression failed
against the previous implementation and passed after the correction.

### Publication inputs stay bounded

The source builder rejects symlinks before emitting a portable executable,
excludes local execution material, and produces an explicit source staging tree
and SHA-256 manifest. Regressions check that a symlink cannot leave a portable
containing external bytes and that local execution files are excluded. The
portable package is built twice, compared byte for byte, then exercised outside
the checkout.

## Validation and remaining limits

The complete log is [0.3.0-tests.txt](0.3.0-tests.txt). Qualification metadata is
[0.3.0-validation.json](0.3.0-validation.json). Tests ran in isolated user, mount,
network and PID namespaces, with read-only source/toolchains, a clean environment,
bounded resources and temporary fixture keys. GPG, OpenSSH, Python, Node and Guile
were exercised locally. No user keys or unrelated sources were used.

Marks can be removed or forged. A local unsigned manifest can be replaced.
Authenticity requires a trusted public key and independently pinned fingerprint.
Similarity remains heuristic. Locks and symlink checks support normal local use;
they do not establish safety against a process actively replacing paths during an
operation. Maintain a clean version-control checkpoint before applying marks.

## Português brasileiro

A revisão focal da versão 0.3.0 cobriu preservação dos fontes, integridade do
manifesto, pinagem de chaves GPG/OpenSSH, relatórios da CLI, limites de recursos e
empacotamento. Um revisor separado examinou as alterações e executou novamente
os **81 testes**, sem falhas, erros ou testes ignorados. Não foram identificados
bloqueadores nesse escopo.

Foram corrigidos a assinatura GPG de uma árvore divergente e a inserção de marcas
em strings Python ou comentários CSS que pareciam diretivas de cabeçalho. Os
testes de regressão reproduziram os problemas antes das correções e verificaram
preservação do comportamento e remoção byte a byte depois delas. O empacotamento
também recusa links simbólicos antes de produzir o executável e exclui material
local de execução.

Esta é uma revisão interna com fontes e fixtures locais. Windows, renderização da
GUI, modificações concorrentes hostis, falhas de energia e validação exaustiva dos
parsers de cada linguagem exigem avaliação própria. Marcas, similaridade e
assinaturas não provam titularidade legal ou data de criação. Use uma chave
pública confiável, fixe o fingerprint por canal independente e preserve um estado
limpo no controle de versão antes de aplicar marcas.