fix(audit): close oxaudit.md — the last four findings

[ojassug]

Closes oxaudit.md in full. DECISIONS §70. Three of the four were decisions rather than
defects; one was a paragraph.

OX-M15 — bench stops executing dataset code

BenchmarkRunner.run read config.evaluateQuality !== false, so quality evaluation defaulted
on, and the evaluator runs each fixture's code and its dataset checks through python -c. A
harness ARCHITECTURE.md calls offline and deterministic reached for an interpreter because
someone typed bench, escapable only via the undocumented TOKENDAMPER_BENCH_DISABLE_PYTHON.

Decided: default off, opt-in by name. --evaluate-quality asks for it, command-scoped per
DECISIONS §30.

Verified on the built artifact rather than in-process: plain bench humaneval --report-json
writes a report with 0 occurrences of python-subprocess; with the flag, 5.

Behaviour change worth reading before merging. Plain bench reports a different quantity
under the same field names — syntaxPassRate / passAt1Rate fall back to validation outcomes,
0.6 against the execution-derived 1.0 on the bundled fixtures. The two regression suites
that assert on the execution figure now request it by name, which is the half that keeps this
from being a silent loss of coverage.

OX-M8 — an exposed bind must be authenticated

The gate read if (this.config.gatewayToken && !isLoopbackPeer(req)) — enforced only if one was
configured. 0.0.0.0 with no token served an unauthenticated relay forwarding arbitrary bodies
to upstream providers.

Decided: refuse to start, with allowUnauthenticatedNonLoopback as the explicit opt-in.
Refusing rather than warning because the configuration this protects is a server nobody is
watching — stderr reaches whoever starts it in a terminal, and no one who starts it from a unit
file.

An existing exposed-bind config now breaks loudly. That is the decision, not a side effect.
tokendamper exec is unaffected (loopback bind and a generated token). Loopback trust
(audit C3) and the constant-time compare are untouched, and both are asserted so a later change
cannot buy this guarantee by revoking C3.

OX-M9 (+ OX-L13) — Origin and Host validation

A foreign Origin → 403 on every bind. A foreign Host → 403 on a loopback bind, where
DNS rebinding is the threat. localhost, any 127.x, ::1 and the configured bind are accepted,
so local clients are unchanged. The policy runs before /health.

GET /health now returns {"status":"ok"} only — activeSessions told an unauthenticated caller
how much traffic flows through the machine.

Two corrections to the finding, both from verifying before fixing:

1. The audit proposed an OPTIONS handler with a restrictive CORS policy. Measured first — the
   server already answers OPTIONS 405 with no Access-Control-* headers, which is that
   policy. No handler added. Preflight was never the gap: the threat is a simple text/plain
   POST, which skips it.
2. The recorded decision said non-browser clients "send neither header". True of Origin, false
   of Host — every HTTP/1.1 client sends it. The local contract is preserved by what is
   accepted, not by absence.

OX-M13 — documented, not fixed

--minimum-confidence and --max-debt are parsed, range-validated, threaded into optimize(),
and cannot change what the CLI emits. Validation confidence is binary (passed ? 1 : 0); the
ledger arm is a literal 1.0 with no ledger, and the CLI supplies none. --max-debt can enter
the rehydration branch, but attemptAutomatedRehydration returns on its first line without a
hasher or ledger.

That reason is stronger than the one DECISIONS §64 gave — §64 explained the default 75
threshold, and --max-debt is precisely the flag that lowers it. Right outcome, argument that
does not carry.

test/unit/cli/inert-dials.test.ts pins it as a characterization test in the
validator-guarantee.test.ts shape: it passes against this tree on purpose, and fails if either
dial becomes live, forcing the README section to be rewritten in the same commit.

Verification

• npm run typecheck, npm run lint, npm run build clean; 95 files / 859 tests passing
• Every new case confirmed failing against the unfixed tree first, except the two OPTIONS
  cases — labelled guards rather than proofs, since that behaviour was already correct
• Lane B verified on the built artifact, not only in vitest: exposed+tokenless refuses (message
  names host and opt-in), loopback+tokenless still starts and serves, /health is
  {"status":"ok"}, foreign Origin 403, foreign Host 403, OPTIONS 405
• Both gateway suites drive real sockets rather than mockUpstream, because both defects live
  in header handling a short-circuited upstream never exercises
• Typecheck caught a bad Parameters<...> in a new suite that vitest ran green — the reason the
  rule is typecheck and build, not just tests

The corpus was deliberately not run. Bench, the flag-parse loop and every Gateway path are off
the optimize route, so a byte-identical result would have been vacuous rather than reassuring —
§56's caution in the other direction.

🤖 Generated with Claude Code