docs(security-evidence): append the independent Kimi L2 pre-release audit for v4.1.7

[axpnet]

Second, independent pre-release audit (Kimi L2), appended as §8 of docs/security-evidence/SECURITY-EVIDENCE-v4.1.7.md (the v4.1.7 audit doc merged in #533).

Method: 9 adversarial lanes over v4.1.6..669814f32 (164 non-merge commits), raw-code reading, plus live protocol testing on the axpbuntu lab (Nextcloud / MinIO S3 / FTPS) with a release-code CLI built from 669814f32.

Headlines:

• LIVE-1 BLOCKER (open): quick-xml trim_text(true) on name-bearing readers (S3 / WebDAV / Azure / Jottacloud) drops whitespace adjacent to XML entities — listings mangle names like a & b.txt, sync download 404s, and sync --direction download --delete plans delete_local on the user's real file. Live-verified on release code.
• Majors recommended before tag: MCP-1 (aeroftp_speed overwrite-then-delete arbitrary remote path), MCP-2 (remote_trash empty defaults to whole-bucket purge), SEC-K1 (crypt anchor-escape enforced on 1 of 3 save paths), I18N-K1 (aerocryptProfile.defaultSaltTierMeaning raw key in all 47 locales), PR-2 (RMW lost-update class merged with fix(commands): drain the rest of the main-thread commands out of lib.rs (82 to 23) #532).
• Pre-merge verification of fix(titlebar): stop the #511 drag fillers collapsing to zero height #527/fix(cli): stop find dropping --name and the default glob under --profile #531 (ready) and fix(commands): drain the rest of the main-thread commands out of lib.rs (82 to 23) #532 (merged-tree E0308 found via git merge-tree; verified fixed in 756d52293).
• 3/9 lanes (aerorsync, providers, frontend UI) not completed — recorded as audit debt.

Docs-only change. Agent: Kimi L2

Summary by CodeRabbit

• Documentation
  • Updated the v4.1.7 “Independent Audit (Kimi L2)” security evidence to correct the LIVE findings ledger entry text for I18N-K2.
  • Tightened v4.1.7 release acceptance criteria to require that items 2–7 in §8.4 are fixed or explicitly deferred before tagging, including item 7 (uncovered lanes), with no silent skipping.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

Warning

Review limit reached

@axpnet, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 44 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e22d420a-2cb0-4e05-8121-b768e7f9c28c

📥 Commits

Reviewing files that changed from the base of the PR and between 77e3025 and 6177b9e.

📒 Files selected for processing (1)

• docs/security-evidence/SECURITY-EVIDENCE-v4.1.7.md

📝 Walkthrough

Walkthrough

The v4.1.7 security evidence document escapes the I18N-K2 ledger token and expands the acceptance gate to require completion or formal deferment of items 2–7, including uncovered lanes.

Changes

Security audit evidence

Layer / File(s)	Summary
Audit findings and ledger docs/security-evidence/SECURITY-EVIDENCE-v4.1.7.md	Escapes the `
Recommendations and acceptance gate docs/security-evidence/SECURITY-EVIDENCE-v4.1.7.md	Expands required remediation or formal deferment coverage from items 2–6 to items 2–7, explicitly including uncovered lanes.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: appending the independent Kimi L2 pre-release audit for v4.1.7.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch audit/v4.1.7-prerelease

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/security-evidence/SECURITY-EVIDENCE-v4.1.7.md`:
- Line 162: Update the I18N-K2 findings-table row to escape the pipe characters
in the inline code expression as \|\|, preserving the displayed `|| 'fallback'`
text without creating extra Markdown table columns.
- Around line 188-190: The §8.5 updated acceptance gate must also cover
recommendation item 7 from §8.4, requiring the three uncovered audit lanes to be
fixed or explicitly deferred by the owner with a tracker row. Update the gate
wording to include item 7, unless the requirement is intentionally advisory, in
which case state that clearly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 51c81530-9f88-40df-8df6-64ebccce7902

📥 Commits

Reviewing files that changed from the base of the PR and between c4680ab and e439055.

📒 Files selected for processing (1)

• docs/security-evidence/SECURITY-EVIDENCE-v4.1.7.md