Add 2.0.2 pentest report

Author: eldryoth

security/pentest/v2.0.2.md

@@ -0,0 +1,56 @@
+Status: PASS
+Reviewed-Commit: 8755f990dac0bad1dc0bef56859059124a212c5a
+Tester: External follow-up pentest
+Scope: sanitization crate family release 2.0.2
+Date: 2026-07-21
+
+## Summary
+
+The 2.0.2 review covered the complete release delta from 2.0.1, with emphasis
+on the test-only Miri mapping model, mapped-memory initialization and teardown,
+page-sealed cleanup after partial protection failures, integrity-failure
+behavior, and release-configuration boundaries.
+
+Follow-up testing confirmed that the Miri simulator is confined to debug core
+unit-test artifacts and cannot be selected by ordinary downstream or release
+builds. The simulator verifies lifecycle state transitions and
+clear-before-release behavior without claiming to exercise native mapping,
+locking, page protection, dump/fork policy, or operating-system CSPRNG calls.
+
+Native cleanup now clears complete locked mappings before release. Page-sealed
+cleanup processes pages independently, immediately erases and reseals each
+page it can transition, continues after individual failures, and retains a
+poisoned mapping and established lock when erasure cannot be confirmed.
+Fault-injection review covered first-page normalization failure, later-page
+erasure, cleanup reseal failure, retained zeroed storage, and successful
+checked retry. The final test-only readable-page observer requires an explicit
+unsafe precondition, and successful test resealing invalidates its marker.
+
+## Confirmed Residual Limits
+
+- Miri models ownership and clearing only; native operating-system protection
+  remains covered by native tests and target evidence.
+- A cleanup failure may intentionally retain a poisoned mapping and its lock
+  until a checked retry succeeds or the process exits.
+- Destructors cannot guarantee cleanup after process abort, forced
+  termination, `mem::forget`, or equivalent lifecycle bypasses.
+- Native memory protections do not defend against a compromised kernel,
+  privileged debugger, DMA adversary, or physical access by themselves.
+- Data-oblivious and leakage claims remain target-, compiler-, feature-, and
+  release-profile specific; this release does not claim identical wall-clock
+  timing or universal microarchitectural resistance.
+
+## Evidence And Disposition
+
+- No critical, high, medium, or low findings remain open for 2.0.2.
+- Workspace tests, documentation tests, warning-denying Clippy, Kani, codegen,
+  API/evidence checks, dependency policy, migration fixtures, lifecycle and
+  concurrency probes, and all five package archives passed.
+- Existing accepted native timing evidence remains applicable because 2.0.2
+  does not modify the measured constant-time implementation paths.
+- All five publishable crates are versioned 2.0.2, and the runtime exact-pins
+  the matching derive crate.
+- The README, safety documentation, threat model, non-guarantees, evidence
+  guide, release notes, and publication script describe the reviewed behavior
+  and remaining deployment responsibilities.
+- The temporary root `PENTEST.md` is absent from the release candidate.