§ NEW · Security Audit Report

Mesh-Native Ecosystem Security Audit

A full adversarial audit of the Distributed Intelligence Stack — covering identity fabric, node-level exploits, routing manipulation, inference tampering, DIU settlement spoofing, and cross-system attack surfaces. All findings are actionable and prioritized by severity.

Internal engineering document

This report is produced for internal engineering review and SOC 2 evidence. All findings are addressed against the current architecture. Residual risks are documented with owner-assigned remediation timelines. Do not redistribute externally without redaction review.

SA.1

Executive summary

Category	High	Medium	Low	Mitigated
Identity Fabric	1	3	2	7
Node-Level Security	2	4	3	8
Routing & Scheduling	1	3	2	6
Inference Execution	1	2	2	5
DIU + Settlement	1	3	1	6
Cross-System Surface	1	2	3	5
TOTAL	7	17	13	37

No critical findings

Zero critical vulnerabilities were identified in this audit cycle. All HIGH findings have architectural mitigations in place and assigned remediation owners. The PQC migration (§5.10) is the primary long-term hardening path for the remaining HIGH items.

SA.2

Identity Fabric Security Audit (@dosfi.ai)

SA.3

Node-Level Security Audit (20-Node Mesh)

SA.4

Routing + Scheduling Security Audit

SA.5

Inference Execution Security Audit

SA.6

DIU + Settlement Security Audit

SA.7

Cross-System Attack Surface Audit

SA.8

Identity Fabric Hardening Plan

Finding	Hardening action	Owner	Priority	ETA
ID-03	Add idempotent wallet creation on first wallet lookup	Platform team	P1	V1.1
ID-05	Enforce mandatory MFA at node registration	Identity team	P1	V1.2
ID-09	Require hardware-backed keystore for server-tier + elite nodes	Node team	P2	V2
ID-10	Force token refresh on org membership change event	Identity team	P2	V1.2
ALL	Complete Dilithium3 upgrade for all Ed25519 signing paths	Crypto team	P2	V2 (2026)

SA.9

Node-Level Security Checklist

Node operators and auditors verify security across six phases:

Pre-registration

Hardware-backed keystore verified; Ed25519 keypair generated in secure enclave; DOSFI-signed DeviceCert valid; org-scoped token presented for enterprise nodes.

Registration

mTLS handshake succeeds with DOSFI CA cert chain; NodeID issued and stored; DIU wallet auto-created and linked to owner identity.

Runtime

Heartbeat signatures verified; sandbox enforced with no filesystem writes outside cache dir; no plaintext prompt written to disk; task envelope decryption only inside sandbox; PoI attestation hash submitted after each task; verification sampling accepted gracefully.

Economics

Token count reported within model heuristic bounds; no self-reporting of issuance events; self-routed task rate within audit threshold.

Privacy

Privacy tier configured correctly; cross-org NACK rate within acceptable bounds; mobile nodes default to local-only unless explicitly opted in.

Ongoing

API key rotation on schedule; DeviceCert auto-renewed; heartbeat and verification pass rates meet operational SLOs.

SA.10

Consolidated Remediation Plan

ID	Title	Severity	Action	Owner	ETA
ID-03	Identity propagation delay	HIGH	Idempotent wallet create on first access	Platform	V1.1
ND-01	Rogue node injection via DeviceID collision	HIGH	Bind server-tier DeviceID to TPM EK cert	Infrastructure	V2
ND-04	Metering falsification	HIGH	ZK-proof of token count for V2 sharded inference	Billing	V2
RT-02	Routing loop injection	HIGH	Per-request dispatch circuit breaker (5 re-dispatches → 60s exclusion)	Router	V1.1
IE-03	Model spoofing	HIGH	Increase PoI sampling to 10% for BYOM + new nodes	PoI team	V1.1
DS-03	Settlement log tampering	HIGH	Ed25519-signed Coordinator settlement batch	Exchange	V2
XS-02	Token leakage in redirect	HIGH	Fragment mode for PKCE auth redirects	Identity	V1.2
ID-05	Recovery exploit via email takeover	MEDIUM	Mandatory MFA at node registration	Identity	V1.2
ND-06	Privacy tier escalation	MEDIUM	Cross-org NACK rate tracking + pool demotion	Router	V1.1
ND-08	Settlement dispute fraud	MEDIUM	request_id match required for dispute resolution	Exchange	V1.1
ND-09	Ghost node pool squatting	MEDIUM	Minimum 90% task acceptance rate for pool admission	Router	V1.1
DS-05	Compute collusion	MEDIUM	Self-routed task audit flag + 10% PoI sampling	Billing	V1.1
XS-04	Academy lab privacy mismatch	MEDIUM	Lab privacy disclaimer + local_only default	Academy	V1.1
XS-05	Exam impersonation	MEDIUM	WebAuthn required at Associate tier exam start	University	V1.2
ID-09	Software keystore risk	MEDIUM	Hardware keystore enforcement for elite nodes	Node	V2
ID-10	Org membership claim lag	MEDIUM	Force token refresh on membership change event	Identity	V1.2

Security Maps →Security Architecture Identity Fabric Architecture Bug Bounty & Disclosure