Hostile reviews, kept
Independent review sessions built it, ran it, and tried to break it. We publish what they found.
How to read this table
Most were AI-assisted reviews in fresh, isolated sessions. They are not reviews by a firm, and we say so.
| Date | Reviewer | What they did | Top finding | Outcome |
|---|---|---|---|---|
| 2026-08-05 | ai-assisted | Built and ran the C, Python, and Go suites; wrote four attack harnesses | Approver signatures not in the chain. | Fixed with the Ed25519 migration. |
| 2026-08-15 | ai-assisted | Built and ran the suite; independently confirmed two prior fixes | Restart laundering. | Fixed, confirmed by the reviewer. |
| 2026-08-21 | ai-assisted | Architecture review: needed or just neat? | Half of VIRP is unnecessary if you trust the operator. | You should not have to. |
| 2026-09-01 | ai-assisted | Re-review of the current tree | Three camera-path findings gating the “signed all the way through” claim. | Open. |