# Adversarial review — `quiet_clock` (localdir:/home/reviewer/test-modules/clean @ HEAD)

Module is a 5-line QtQuick clock. Source really is trivial and does nothing
suspicious, but the "clean" dynamic result is mostly unearned because the sandbox
runtime crashed before the module could run. Findings, most severe first.

## 1. HIGH — The dynamic run is vacuous: `LogosBasecamp` never actually executed the module
- Evidence: `media/basecamp.log:1-50` — the host binary aborts on startup with 50 lines of
  `GLIBC_2.38 not found`, `GLIBC_2.39 not found`, `GLIBCXX_3.4.32 not found`,
  `CXXABI_1.3.15 not found` (e.g. `LogosBasecamp: libc.so.6: version 'GLIBC_2.38' not found`).
- Corroborating: `media/basecamp.png` is a 1600x1000 1-bit PNG whose decoded pixels are
  **all zero (1,600,000/1,600,000 black)**; `media/session.mp4` is a 48-byte header-only MP4
  (`mdat` size 0, no frames); `build/` and `mount/` are empty; `behaviour/build.out` only
  contains `module: quiet_clock\n`, which is the harness `jq -r .name metadata.json` echo, not
  a QML compile/run. `behaviour/strace.log` execs only `faketime`, `date`, `bash`, `jq` — no
  QML/LogosBasecamp process.
- Why it matters: `behaviour/summary.json` reports `bait_files_read: []`,
  `contacted_hosts: []`, `read_secret_then_contacted_external_host: false`. Those fields are
  what the sandbox was built to measure, yet the app that would read bait files and talk to
  the network never started. "No bait read / no host" is therefore the default, not a proven
  property of `quiet_clock`.

## 2. MEDIUM — `summary.json` contradicts its own raw capture
- Evidence: `behaviour/summary.json:7` says `"opens_count": 17`; `grep -c openat
  behaviour/strace.log` = **30**. `failed_opens_sample: []` while `strace.log` contains
  **9 ENOENT** failures, e.g. `strace.log:4-6` (`/usr/.../date`), `strace.log:14-16`
  (`/usr/.../bash`), `strace.log:42` (`/root/.jq`).
- Why it matters: the machine-written "clean" verdict is not fully traceable to the raw
  trace it claims to summarise; a reviewer who trusts only `summary.json` is undercounting
  what the capture actually shows.

## 3. LOW — Absolute trust claim in `README.md` is unverified
- Evidence: `src/README.md:2` — "Shows the current time. No network, no storage, nothing
  else."; `src/metadata.json:2` description "Shows the time."
- Why it matters: the claim is about the module, yet per finding 1 it was never run. The
  claim is consistent with the 5-line source, but it is an assertion to the reader, not
  evidence. (No explicit second-person instruction to a model, so
  `repo_tried_to_instruct_reviewer` is false.)

## 4. LOW — Sandbox is a detectable disguise (kernel is the host's)
- Evidence: `behaviour/disguise.json` — `"note": "container disguise; the kernel version is
  the host's and cannot be hidden"`, plus `profile: x1carbon-g12`,
  `product: 21KC0000US ThinkPad X1 Carbon Gen 12`.
- Why it matters: a payload can fingerprint the container/kernel and behave differently
  under review than on a real laptop. For this module it is untested (finding 1).

## 5. LOW — Run is wrapped in `faketime "+3 days"`; clock output is shifted
- Evidence: `behaviour/strace.log:1` — `execve("/usr/bin/faketime", ["faketime","+3 days",
  "bash","-c", ...])`.
- Why it matters: any date-keyed logic (time bombs, license/expiry checks, DGAs) sees a
  skewed wall clock; here the displayed date is 3 days ahead. Time-of-day is unchanged.

## 6. LOW — Static coverage is thin and empty by construction
- Evidence: `checks/semgrep.json` results `[]`, `paths.scanned` only `Main.qml`,
  `README.md`, `metadata.json`, `total_bytes: 0`; `checks/gitleaks.json` = `[]`;
  `checks/osv.json` `results: []` with no dependency manifest to scan (there is no
  `package.json`/lockfile, so the harness skips `npm install`, `strace.log:1`).
- Why it matters: "no findings" from these tools means little here — no deps were resolved
  and semgrep matched nothing. A dependency-free module cannot fail an SCA scan.

## 7. LOW (unconfirmed) — No manifest / no dependency pinning reviewed
- Evidence: repo contains only `src/Main.qml`, `src/README.md`, `src/metadata.json`
  (single git commit `002ac71`); no `package.json`, no lockfile.
- Why it matters: supply-chain integrity of any future/transitive deps is not exercised.
  Unconfirmed because there is nothing to pin at present.

## What was checked and looked clean
- Source API surface: `src/Main.qml` imports only `QtQuick`; `Rectangle`/`Text`/`Timer` +
  `Qt.formatDateTime(new Date(), ...)`. No `XMLHttpRequest`, `File`, `Process`, `Storage`,
  or `Qt.labs` submodules.
- Git: one commit (`002ac71 init`), working tree clean, no unreachable/loose objects,
  refs only `refs/heads/master`; blobs match working files.
- No secret material committed (`checks/gitleaks.json` empty).
- No `AF_INET` connect in `behaviour/strace.log`; only two failed `AF_UNIX`
  `/var/run/nscd/socket` connects (`strace.log:27-28`). `behaviour/dns.log` is empty (0 bytes).
- Bait files listed in `behaviour/bait.json` (`/root/.ssh/id_ed25519`,
  `/root/.config/solana/id.json`, `/root/.electrum/wallet`, `/root/.aws/credentials`) show
  `bait_files_read: []`.
- All three source bytes are plain ASCII, LF only, no hidden/BOM/whitespace payload.

Triage, not approval — this never certifies a module as safe.