PatchProof v0.1 是面向可信宿主上的单租户补丁验证器。它通过 Docker 加固降低执行候选代码的风险，但不承诺抵御内核漏洞、Docker 守护进程攻击或强对抗多租户工作负载。

PatchProof v0.1 is a single-tenant patch validator for a trusted host. Docker hardening reduces candidate-code risk, but the project does not claim resistance to kernel exploits, Docker-daemon attacks, or strongly adversarial multi-tenant workloads.

• 真实目标仓库及其前后快照 / real target repository and its before/after snapshots;
• 宿主凭据、网络和其他目录 / host credentials, network, and unrelated directories;
• Proposal、Approval 和 Validation Receipt 的内容完整性 / content integrity of proposals, approvals, and receipts;
• 外置 Reproduction 与 Hidden Tests / external reproduction and hidden tests.

• 宿主操作系统、Docker 守护进程和固定镜像本身可信。 The host OS, Docker daemon, and pinned image are trusted.
• Reproduction 与 Hidden Tests 由独立评测方维护。 Reproduction and hidden tests are maintained by an independent evaluator.
• approved_by 是声明字段，不代表认证身份。 approved_by is a declared field, not authenticated identity.
• SHA-256 内容寻址提供完整性检测，不提供签名者真实性或不可抵赖性。 SHA-256 content addressing detects integrity changes; it does not provide signer authenticity or non-repudiation.

• Unified Diff 大小、文件数、路径、重命名、二进制补丁和保留命名空间策略。 Unified-diff size, file-count, path, rename, binary-patch, and reserved-namespace policies.
• 真实仓库只读快照、一次性副本应用和验证后未变检查。 Read-only real-repository snapshots, disposable-copy application, and post-validation unchanged checks.
• Diff + Base Snapshot 的 Proposal Hash，以及精确完整哈希审批。 Proposal Hash over the diff and base snapshot plus exact full-hash approval.
• 固定镜像、断网、只读、非 root、移除 Capabilities、no-new-privileges 和资源限制。 Digest-pinned, network-disabled, read-only, non-root, capability-dropped, no-new-privileges, resource-bounded Docker execution.
• 四阶段验证、真实测试数量检查和 ImportError/超时/截断/基础设施失败的关闭失败。 Four-phase validation, actual-test-count checks, and fail-closed handling for ImportError, timeout, truncation, and infrastructure failures.
• 内容寻址、独占写、不覆盖和加载时重验的回执。 Content-addressed, exclusive, no-clobber receipts with load-time revalidation.

• v0.1 只运行固定的 Python unittest discover，不支持 pytest/tox/nox 或依赖安装。 v0.1 runs fixed Python unittest discover commands only; pytest/tox/nox and dependency installation are unsupported.
• Docker 测试输出中的测试数量来自 unittest 文本协议；独立 Hidden Tests 仍是防伪造的关键边界。 Test counts come from the unittest text protocol; independent hidden tests remain a critical anti-spoofing boundary.
• v0.1 不支持无结尾换行标记、重命名、二进制文件或非 UTF-8 文件。 v0.1 does not support no-final-newline markers, renames, binary files, or non-UTF-8 files.
• 审批和回执没有数字签名或可信时间戳。 Approvals and receipts have no digital signature or trusted timestamp.
• 文件系统检查降低符号链接风险，但不宣称消除所有并发 TOCTOU 攻击。 Filesystem checks reduce symlink risk but do not claim to eliminate every concurrent TOCTOU attack.

请不要在公开 Issue 中提交可直接利用的漏洞细节。通过 GitHub Security Advisory 私下报告，并包含受影响版本、可复现步骤、实际影响和建议修复方向。

Do not publish directly exploitable details in a public Issue. Use a private GitHub Security Advisory and include the affected version, reproduction steps, practical impact, and suggested remediation.