docs(audit): Eve-2 adversarial audit — 8 verified findings in fix-round code

[LinuxDevil]

Summary

Second competitor-style (\u0022Eve\u0022) audit of the SDK. Round 1 produced ~166 findings that were all fixed and merged (waves E1\u2013E21 + MAIN-HEALTH rounds). This round audited the fix code itself \u2014 run leases, the \u003cid\u003e.paused marker, secure-by-default routes, multi-approval pauses, abort handling.

8 verified findings, each with a deterministic repro (npx tsx audit/eve2/repro/\u003cfile\u003e):

#	Finding	Severity
1	Session-ownership check-then-act race \u2014 concurrent first-touch runs a turn inside another user's session and receives their data	Critical
2	recordFailure writes lastError onto a foreign run's checkpoint without lease fencing	High
3	\u003cid\u003e.paused marker lands after the pause checkpoint \u2014 a side run is admitted in the gap	High
4	Sub-agent grouped approvals execute schema-invalid edited args	High
5	Abort during tool execution never settles send()/approvals.resolve()	High
6	Re-paused checkpoint drops approvalIds \u2014 durable state names 1 of N approvals	Medium-High
7	uniqueToolCallIds fragments unindexed repeated-id stream deltas into phantom calls	Medium
8	isStreamingRequest regex false-positive rewrites a JSON reply into SSE	Medium

Finding 1 is an authorization-boundary breach \u2014 flagged as security-sensitive.

Also included: audit/eve/TRIAGE.md \u2014 all 166 round-1 findings re-verified on current main (142 fixed, 15 still-open, 9 changed). EVE-0 (resume divergence) confirmed fixed.

Test plan

• Every repro runs deterministically with mockModel/fileStore \u2014 no network needed
• No production source changed (docs + repro scripts only)
• Follow-up fix PRs per finding (tracked in audit/eve2/README.md)

Generated with Devin