Parity audit: full AutoFirma replacement — feature matrix vs decompiled core → gap issues #49

Closed

EduarD3V wants to merge 0 commits from issue/44-parity-audit-full-autofirma-re into bullet-develop

EduarD3V commented

2026-10-15 03:47:27 +02:00

Owner

Implements #44.

Refs #44

Automated by bullet: reviewed (independent model) → gates green on merged tree. Auto-merge follows.

Implements **#44**. Refs #44 Automated by bullet: reviewed (independent model) → gates green on merged tree. Auto-merge follows.

EduarD3V added 6 commits

2026-10-15 03:47:29 +02:00

docs: parity audit vs decompiled AutoFirma 1.9 core (Refs #44 ) 53f478c9c6

Feature-by-feature matrix: signing formats, multi-signature operations,
verification, identity acquisition, batch, app surface. Every row cites a
decompiled path (tag reference/decompile-1.9) or a repo file/issue, with a
status and a needed/browser-moot verdict (moot rows name the web-native
replacement). Closes with a prioritized gap list for the operator.

docs(readme): correct stale PKCS#12 and XAdES status; link the parity audit (Refs #44 ) 1abb1103f6

PKCS#12: PBES1 (DES/RC2/RC4) is implemented in src/lib/legacy-pbe.ts and the
container MAC is verified — the section still said the opposite. XAdES:
browser-side verification is in src/lib/verify/ since #8, and the unsupported
variants are Detached/Enveloping, not verification.

docs(parity): fix 9 wrong/misleading citations; batch UI is shipped, not missing (Refs #44 ) 38f3cb1344

Verification pass over every citation in the audit against the extraction of
tag reference/decompile-1.9 (machine-resolves all 114 decompiled + 44 repo
citations, none past EOF) found:

- `validation/ValidateBinarySignature.java` -> `signvalidation/` (typo, prose)
- `AOCAdESSigner.java:229 applyTimeStamp` -> :40,234 (229 is a warning line)
- AOCAdESASiCSSigner :29 -> :27-30; AOPDFSigner :119 -> :118; AOOOXMLSigner
  :189 -> :188; verifyCades cms.ts :100 -> :101; mcp server tools -> :60,71,100
- FacturaE row now cites the actual policy/whitelist/enveloped-forcing lines
- SignatureFormatDetectorPadesCades :451 (private helper) -> :164 resolvePDFFormat
- Section B gained the missing Status column
- Section E: the multi-file queue is WIRED (FileDrop multiple + createBatchQueue
  + per-file rows + one ZIP, App.test.ts:251); the old row claimed one file at a
  time, contradicting README and the app. Gap #7 was therefore wrong: replaced by
  whole-directory input, folded into the massive-ops entry; gap list 19 -> 18.

review: fix 11 wrong citations and empty status cells in PARITY.md (Refs #44 ) df0e0b2d54

fix(review): pin PARITY.md table shape and the 11 corrected citations (Refs #44 ) 1f7279d53b

The review fixed eleven wrong/misleading citations and two empty Status cells by hand;
nothing kept them fixed. docs/check-parity-doc.py checks the doc's contract: five filled
cells per matrix row, full/partial/missing status, needed/browser-moot verdict, numbered
and prioritized §G gaps, every citation resolving inside its source tree (decompiled/ or
decompiled-configurador/, per the doc's Method section), and the eight multi-part
corrections of df0e0b2d pinned as file+line+identifier facts.

Fails on 38f3cb13: 2 empty-cell/status defects + 8 missing corrected citations.

fix(review): pin the main-window citation too (Refs #44 ) 30b7012b24

Covers the tenth corrected citation (SimpleAfirma.java:607 — the lines the review dropped,
637/705, are CLI/protocol dispatch, not the window). The pre-fix doc already cited 607, so
this one pins the fact rather than catching 38f3cb13.

EduarD3V referenced this pull request

2026-10-15 03:47:31 +02:00

Parity audit: full AutoFirma replacement — feature matrix vs decompiled core → gap issues #44

~~EduarD3V referenced this pull request 2026-10-15 03:47:37 +02:00~~

bullet: integrated work for human review #48

EduarD3V closed this pull request

2026-10-15 03:53:54 +02:00

EduarD3V referenced this pull request

2026-10-15 03:53:56 +02:00

Parity audit: full AutoFirma replacement — feature matrix vs decompiled core → gap issues #44