{
  "completeness": "partial",
  "deferred": [
    {
      "id": "candidate-zhaiker-race",
      "paths": [
        "app/api/service/ZhaikerExamImporter.php"
      ],
      "reason": "Need deployed uniqueness constraints and a concurrent integration test.",
      "surfaceIds": [
        "health-callbacks"
      ]
    },
    {
      "id": "candidate-default-tenant-host",
      "paths": [
        "app/common.php",
        "app/api/controller/Controller.php"
      ],
      "reason": "Need an authorized alternate-Host or direct-IP ingress test.",
      "surfaceIds": [
        "tenant-client-gates"
      ]
    },
    {
      "id": "candidate-client-disable-gate",
      "paths": [
        "app/api/controller/Controller.php",
        "app/api/common.php"
      ],
      "reason": "Need product confirmation that the enable switch must cover unknown clients.",
      "surfaceIds": [
        "tenant-client-gates"
      ]
    }
  ],
  "documentType": "codex-security.coverage",
  "excludePaths": [],
  "explicitExclusions": [],
  "includePaths": [
    "."
  ],
  "inventoryStrategy": "repository",
  "mode": "repository",
  "openQuestions": [
    {
      "followUpPrompt": "Against authorized staging for a782c32b3a1c823e4f803ca07137187fbd2d32cb, verify gateway authentication and ingress policy for the named routes without changing production data.",
      "question": "Does production reject or authenticate requests to bank, Baidu face, Zhaiker callback, and terminal face routes at the gateway?"
    },
    {
      "followUpPrompt": "Have the credential owners rotate and inventory the referenced secrets without posting their values into Codex or logs.",
      "question": "Are the tracked environment and SQL credentials active?"
    },
    {
      "followUpPrompt": "Run an authorized read-only SHOW CREATE TABLE and compare the result with the Zhaiker importer race candidate.",
      "question": "Does the production Zhaiker session table enforce a unique vendor/raw_hash constraint?"
    },
    {
      "followUpPrompt": "Run an authorized staging request with an unmapped Host and confirm the request is rejected before tenant resolution.",
      "question": "Can an unmapped Host reach this application and fall back to tenant 10001?"
    }
  ],
  "scanId": "45fc7c79-225a-4c49-a5d0-2d456346a5f5",
  "schemaVersion": "1.0",
  "surfaces": [
    {
      "disposition": "reported",
      "id": "biometric-face",
      "label": "Biometric and face APIs",
      "notes": "Fail-open Baidu allowlist and unauthenticated terminal face synchronization survived validation.",
      "receiptRefs": [
        "artifacts/02_discovery/candidate_ledger.jsonl",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/inventory_summary.json"
      ],
      "riskArea": "Authentication and sensitive-data access"
    },
    {
      "disposition": "reported",
      "id": "health-callbacks",
      "label": "Health and vendor callbacks",
      "notes": "Unsigned Zhaiker import, HealthKit token logging, and weak OAuth state were reported; callback concurrency needs schema proof.",
      "receiptRefs": [
        "artifacts/02_discovery/candidate_ledger.jsonl",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/inventory_summary.json"
      ],
      "riskArea": "Callback authenticity, OAuth, token handling"
    },
    {
      "disposition": "reported",
      "id": "bank-auth",
      "label": "Bank identity and token issuance",
      "notes": "Two independently reachable token-mint paths lack caller ownership proof.",
      "receiptRefs": [
        "artifacts/02_discovery/candidate_ledger.jsonl",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/inventory_summary.json"
      ],
      "riskArea": "Authentication and account ownership"
    },
    {
      "disposition": "reported",
      "id": "terminal-authz",
      "label": "Terminal authentication and authorization",
      "notes": "Route privilege enforcement is disabled and a biometric sync route bypasses login.",
      "receiptRefs": [
        "artifacts/02_discovery/candidate_ledger.jsonl",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/inventory_summary.json"
      ],
      "riskArea": "Device authentication and role enforcement"
    },
    {
      "disposition": "reported",
      "id": "credentials",
      "label": "Configuration, repository secrets, and logs",
      "notes": "Tracked environment/SQL credentials and unredacted HealthKit token logs were reported; no credential values were copied to artifacts.",
      "receiptRefs": [
        "artifacts/02_discovery/candidate_ledger.jsonl",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/inventory_summary.json"
      ],
      "riskArea": "Credential disclosure"
    },
    {
      "disposition": "reported",
      "id": "payments-orders-refunds",
      "label": "Payments, orders, and refunds",
      "notes": "Refund owner binding and prepay scan idempotency failures survived validation.",
      "receiptRefs": [
        "artifacts/02_discovery/candidate_ledger.jsonl",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/inventory_summary.json"
      ],
      "riskArea": "Object authorization and atomic state transitions"
    },
    {
      "disposition": "reported",
      "id": "uploads-files",
      "label": "Uploads and file handling",
      "notes": "Anonymous repeatable image upload survived; no source-proven path traversal or code execution survived.",
      "receiptRefs": [
        "artifacts/02_discovery/candidate_ledger.jsonl",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/inventory_summary.json"
      ],
      "riskArea": "Unauthenticated resource consumption and unsafe files"
    },
    {
      "disposition": "needs_follow_up",
      "id": "tenant-client-gates",
      "label": "Tenant and client gates",
      "notes": "Unknown-Host tenant fallback and unknown-platform client bypass need runtime/product-intent confirmation.",
      "receiptRefs": [
        "artifacts/02_discovery/candidate_ledger.jsonl",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/inventory_summary.json"
      ],
      "riskArea": "Fail-open routing and shutdown controls"
    },
    {
      "disposition": "no_issue_found",
      "id": "injection-execution",
      "label": "Command, query, deserialization, SSRF, and dynamic execution hotspots",
      "notes": "All tracked files were pattern-inventoried and first-party hits were traced; no additional source-proven reportable instance survived.",
      "receiptRefs": [
        "artifacts/02_discovery/candidate_ledger.jsonl",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/inventory_summary.json"
      ],
      "riskArea": "Injection and unsafe parsing"
    },
    {
      "disposition": "no_issue_found",
      "id": "dependencies-vendor",
      "label": "Vendored dependencies and binary assets",
      "notes": "Files were byte-read and inventoried. A current external advisory audit was outside this scan and remains a limitation.",
      "receiptRefs": [
        "artifacts/02_discovery/candidate_ledger.jsonl",
        "artifacts/02_discovery/work_ledger.jsonl",
        "artifacts/02_discovery/inventory_summary.json"
      ],
      "riskArea": "Third-party and binary risk"
    }
  ]
}