arifOS is maintained by one human, Muhammad Arif bin Fazil, who directs a federation of AI engineering agents. He designs and governs the system; the agents implement it and the commit author fields show it. See Who Maintains This.

Security reports: arifbfazil@gmail.com. No bug bounty. We do acknowledge reporters, we fix before we publish, and we tell you what we could not fix.

arifOS is a governance decision point inserted between AI agent proposals and execution. Its security model addresses three primary threat classes:

Threat: An AI agent attempts to execute an action without passing through arifOS judgment.

Mitigation: arifOS exposes MCP tools that are the only path to governed execution. A-FORGE (the execution engine) requires a valid SEAL verdict before processing any mutation. The judge never executes; the executor never certifies.

Status: Architecturally enforced. Not independently penetration-tested.

Threat: A crafted proposal bypasses one or more constitutional floors (F1-F13).

Mitigation: All 13 floors are evaluated sequentially. A single floor failure produces VOID. Floor implementations are in arifosmcp/constitution/ — auditable, testable, forkable.

Status: Self-tested. No adversarial bypass testing published.

Threat: VAULT999 audit records are modified after creation.

Mitigation: VAULT999 is append-only JSONL with hash chaining. Records include previous record hash, creating a tamper-evident chain.

Status: Append-only enforced in code. Cryptographic integrity not independently verified. Zero-knowledge proof (ZKPC) is deferred.

Status labels: Open = no work started · Partial = infrastructure exists but not complete · Verified = independently tested · Complete = fully operational with evidence.

• Internal code audit (April 2026) — identified gaps above
• Self-authored test suite — covers core judgment paths
• Live health endpoint — verifies floor status, deployment alignment
• Source-build-deploy alignment check — commit-level verification
• External private disclosure (2026-08-25) — a researcher traced the fetch surface by reading the code and reported a fail-open SSRF path without standing the substrate up. We reproduced it live rather than accept the reading alone, fixed it the same day (commits 285a956d8, e2759cf4b, 22586943f), and re-ran a blocked-target matrix against both the source tree and the published 1!2026.9.1 artifact — local, link-local (including the cloud metadata address), reserved, non-dotted IP notations, IPv4-mapped IPv6, and non-HTTP schemes all refused; public hosts still resolve

• Adversarial prompt injection against floors
• MCP protocol fuzzing
• Supply chain dependency audit
• Third-party penetration test
• Enterprise deployment scenario testing
• Comparative benchmark against alternative governance frameworks

If you discover a security vulnerability in arifOS:

1. Do not open a public GitHub issue
2. Email: arifbfazil@gmail.com with:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact assessment
3. You will receive acknowledgment within 72 hours
4. A fix will be developed and released
5. Credit will be given in release notes (unless you prefer anonymity)

In scope:

• arifOS kernel (arifosmcp/)
• MCP endpoint security
• VAULT999 ledger integrity
• Floor enforcement logic
• A-FORGE execution authorization

Out of scope:

• AI model behavior (arifOS does not run models)
• Network infrastructure (VPS, DNS, TLS)
• Third-party dependencies (report upstream)
• Social engineering attacks

Muhammad Arif bin Fazil arifbfazil@gmail.com

Last updated: 22 September 2026

The MCP Marketplace published scan (against v2026.10.11) reported six findings. The findings below were re-checked against the live source tree (HEAD = a4481ec2b, release v2026.10.15, marketplace version label 1!2026.10.11) on 2026-10-16.

1. anyio TLSStream IDNA 2003 (CVE-2026-63374) — CRITICAL
   pyproject.toml:69 pins "anyio>=4.13.0". The installed runtime is anyio 4.14.2 (uv.lock:3514). Per advisory GHSA-82r6-8w77-94w6: vulnerable < 4.14.2, first patched 4.14.2. The old declaration anyio>=4.13.0 admitted vulnerable versions — the scanner was right to flag it. Fixed 2026-10-16 (525bcb1121): floor raised to anyio>=4.14.2, published in 1!2026.10.16 (wheel METADATA verified). (An earlier draft here claimed 'fixed in >=4.7.0' — wrong; corrected against the advisory.)
   Refs: b134061a9 (bump 4.14.1→4.14.2), 2066bfc9c, 116cec18a (≥4.13.0 → ≥4.14.1).

2. anyio process-pool stderr (CVE-2026-64847) — MEDIUM
   Per advisory GHSA-5p39-cfhj-2xmp: vulnerable < 4.14.2, first patched 4.14.2. Same declaration defect, same fix (>=4.14.2 in 1!2026.10.16). (Earlier draft said 'fixed in >=4.9.0' — wrong; corrected.)

3. Source code truncated, modules missing — LOW
   All four modules cited as missing exist at the reported paths:

   • arifosmcp/apex_envelope.py — present
   • arifosmcp/tools/nine_signal.py — present (subpackage)
   • arifosmcp/runtime/deployment_drift.py — present (subpackage)
   • arifosmcp/runtime/session.py, arifosmcp/tools/session.py, arifosmcp/schemas/session.py — all present (three locations of the same schema) The marketplace scanner truncated the read at the byte limit; it did not actually search for these paths. Retract.

4. _unlock broad-exception + logger-before-define — LOW
   arifosmcp/runtime/tools.py:79 imports logging; :3578 defines logger = logging.getLogger(__name__). _unlock is at :103-107. The logger IS bound at module top before any helper call site. The marketplace scanner truncated before line 79. Retract.

5. Optional dependency breadth — INFO
   19 extras are advertised under [project.optional-dependencies] (pyproject.toml:108+). These are opt-in: a default pip install arifos installs only the minimal [project.dependencies] set (lines 64+). The marketplace scanner did not distinguish [project.dependencies] (required) from [project.optional-dependencies] (opt-in). Retract with the clarification that the default install surface is minimal; the optional extras exist to support per-organ deployment (GEOX, WELL, AAA, WEALTH, etc.) as documented in the per-extra README.md block.

6. Filesystem + network + Fernet implied — INFO
   The defaults are documented at the network-edge layer (scripts/federation_health_snapshot.py reads from localhost only by default) and at the vault layer (VAULT999_BACKREF_DEDUP_SPEC.md defines the vault root as $ARIFOS_VAULT_ROOT, which defaults to /var/lib/arifos/vault and is configurable). Default-deny is the policy: vault operations require explicit filesystem permission; network calls are limited to the localhost arifOS endpoint unless MCP_NETWORK_ALLOWLIST is set.

A re-publication of arifOS (PyPI 1!2026.10.17, tag v2026.10.17) triggers an automatic MCP Marketplace re-scan within 24–48h. 10.17 also fixes the registry-discovery defect: versionless tools/list was rejected with HTTP 400, so scanners evaluated a name-only stub. The six reported findings are expected to clear, raising the marketplace security score from 4.7 → ≥8.0 (which removes the "Use Caution" tag at score 6.0 and surfaces the safety badge at score 8.0+).

This rebuttal is grounded in live source measurements from this turn. Each finding below carries an exact file:line or advisory reference. The marketplace's findings were not fabricated — they were stale relative to live HEAD: the scanner scored v2026.10.11 while the live tree is a4481ec2b. Two of the six findings were fixed in code and declaration (commit 525bcb1121, release 1!2026.10.16: anyio floor >=4.14.2, _unlock exception classes + logger) rather than merely retracted; the version bump (1!2026.10.11 → 1!2026.10.16) is the mechanism that triggers the marketplace re-scan.