What has been established
- Independent technical review. An independent network engineer reviewed VIRP against production Cisco hardware: nine of nine observations HMAC-verified, and the findings filed during that review were fixed with regression tests. This was not an independent security audit or production evaluation.
- Live demonstration of the approval flow (July 23, 2026). On a live Cisco switch: a read executed and verified; a config change was blocked with an authenticated rejection; an approved change executed under a signed Ed25519 approval; reusing that approval was refused, as were expired and missing approvals, each with a typed error. The transcript and hashes are pinned in
docs/LIVE-PROOF-2026-07-23.md. - Formal verification, with its scope stated exactly. ProVerif proofs cover the v2 observation path: master O-Key secrecy, session key secrecy, and injective agreement (every accepted observation corresponds to exactly one authentication by the O-Node). These results hold under a documented trace restriction encoding the replay store's contract, which is itself demonstrated by negative tests in C. v1 messages are not covered; there is no Tamarin model. The model and checked-in output are in the proofs directory. This is the one place the word “proof” is used in its formal sense on this site.
- Tested chain logic. Genesis, linking, tamper detection, and crash recovery are covered by tests. We claim no integrity percentage.
What has not been established
- Security against a compromised collector. Observations are HMAC-authenticated, a symmetric mechanism: anyone holding the collector's key can produce a valid record and can rewrite the chain. The chain is tamper-evident within a trusted collector, not against it. External anchoring of chain checkpoints and hardware-backed keys are designed, not done.
- Operation-to-response correlation, fully. The security docs record a live case where a collector authenticated output that did not correspond to the command it was labeled with. Cryptography preserves that kind of error rather than correcting it. Tightening the correlation is active work, and the problem class is assumed wider than the closed cases until shown otherwise.
- AI-output completeness. The claim-verification layer relies on the agent declaring which statements need evidence, so the untrusted model is partly responsible for enumerating what gets checked. It is an accountability mechanism, not a proof that every assertion in the model's prose was verified.
- Client-side verification depth. The O-Node daemon is the verification authority; client-side verification currently differs in depth from the daemon's while a consumer upgrade is pending.
- Full gating for every device class. Host and SIEM integrations currently run in a monitored, read-only mode rather than tiered classification.
- OT write governance. The read-only evidence path is the mature, deployable capability; governing writes on live OT equipment is design-complete but not yet demonstrated with a client.
- Tier classification completeness. BLACK operations have no message type and the classifier fails closed (unrecognized commands escalate to blocked). That is a design property that removes the paths we know how to remove, not a guarantee that nothing destructive can ever be mis-tiered.
- Production hours for newer primitives. Baseline deviation detection is implemented but not validated end-to-end. Multi-tenant federation crypto is tested; no multi-tenant deployment exists yet.
- Independent production evaluation. VIRP is a research prototype run on the author's own gear, not installed on client networks. It would need independent evaluation before anyone should trust it in production.
Claim-to-evidence matrix
Every load-bearing claim on this site should lead to enforcing code and a test, not merely another explanation. Where a row says Open, the property is not provided today.
| Claim | Mechanism | Implementation | Test | External evidence | Status |
|---|---|---|---|---|---|
| Unknown operations fail closed | Classifier default: deny by absence | gate_classify(), virp_onode.c |
gate tests, BLACK tests | Live rejection with “RED by absence” reason in the walkthrough | Demonstrated |
| RED requires approval | Tier gate plus propose / approve / apply | virp_onode.c, virp_approval.c | approval tests (reuse, expiry, absence) | July 23 live transcript | Demonstrated |
| Approval binds the exact command and device | Ed25519 signature over the proposal's command hash and device | command_hash, virp_approval.c |
approval tests | Live refusal of reuse and expiry with typed errors (same transcript) | Demonstrated |
| An accepted observation corresponds to exactly one collector authentication | Session HMAC, v2 observation path | virp_sign_observation_v2 / virp_verify_observation_v2 |
protocol and replay tests | ProVerif result, under its documented trace restriction | Scoped proof |
| Collector cannot rewrite history | Not presently provided (requires external anchoring or trusted checkpoints) | None | None | None | Open |
Open findings and disclosure
Findings from independent review are tracked in the repository's SECURITY.md, and fixes ship with regression tests that pin the behavior. To report a vulnerability in the verification path, chain integrity, HMAC authentication, or tier enforcement, do not open a public issue; email nhoward@thirdlevelit.com.
Incident history
The project's origin incident and red-team history are published, including the parts that failed: the forged-receipts walkthrough and the IronClaw story.