HumankindAssetFramework

Review backlog — deferred findings from the 2026-07-19 two-round audit

The two-round adversarial review (5 parallel reviewers per round over both repos; see the 07-19 Framework-Review row) fixed every HIGH-severity finding the same day. This file tracks what was found, verified real, and deliberately deferred — so the list survives outside the session that produced it. Ranked by when they’ll bite.

Needs a decision first

Worth fixing before the next model of the affected kind

Quality-of-life / lower risk

Queued for the package release (not review findings — branding/packaging debt)

Future feature seams (mapped, not built — the discovery is done, only the build remains)

Verified clean (don’t re-litigate without new evidence)

GUID nibble-swap encoding + keep-GUID re-bake; registry corrupt-guard/atomic-write/backup lifecycle; two-window ownership merge (both directions, post-fix); Harmony patch exception discipline; cross-thread sample locking + ConcurrentQueue handoff; deploy ramp math; join/decimate + albedo-extraction blocks; frame clamping; noise-filter re-entrancy; district bake+registry editor flow; Plugin.cs config wiring.


2026-07-31 audit — “silently disarmed” class

Ten open findings from the pass that followed the Abomination spike-geometry incident (root cause: a safety net that could never arm itself). Recorded separately with file:line, in-game symptom, trigger and suggested fix: Audit-2026-07-31.md.

Top item (now FIXED in c6154a6, pending in-game verification) — the wrong-skeleton rescue was gated on Hooked (animated-or-freeze), so eight shipped STATIC models have no rescue path at all: the same failure 0c0b12f fixed, still live for them.