severity: critical

evidence: validated

category: availability

status: open

verification: systemctl is-active aamos-ledger = inactive, curl localhost:3250/health = connection refused

retest: systemctl is-active aamos-ledger = active AND curl localhost:3250/health = 200

discovered_by: autonomous-audit


category: git

verification: git status --short | wc -l = 149

retest: git status --short | wc -l = 0 AND git log --oneline | wc -l > 2


category: infrastructure

verification: find /home/bernt/.openclaw/workspace -name '*.tf' -o -name '*.tfvars' = 0 results

retest: find *.tf returns files AND terraform plan succeeds AND new environment can be provisioned


category: cicd

verification: grep -r 'echo "Deploying' .github/workflows/ = found

retest: deploy-production job contains actual deployment commands, not echo placeholders


category: security

verification: grep -E 'JWT_SECRET|DATABASE_URL|REDIS_URL' /etc/systemd/system/aamos-ledger.service = found secrets in plaintext

retest: No secrets in systemd files AND AWS Secrets Manager integration verified AND old secrets revoked


severity: high

evidence: inferred

category: eos

verification: engineering-contract.mjs exists but no integration in agent flow

retest: Agent attempts to break rule -> EOS stops -> logged in contract-violations.jsonl


verification: git remote -v = empty, .git/config contains no remotes

retest: GitHub/GitLab shows active branch protection rules


verification: systemctl is-enabled aamos-ledger = disabled

retest: systemctl is-enabled aamos-ledger = enabled


verification: Terraform main.tf: 4 resources, AWS: 22+ resources

retest: Terraform coverage >= 80% of AWS resources


verification: Remote state commented out in main.tf, no S3 bucket for terraform state

retest: S3 bucket + DynamoDB table configured for remote state


verification: DynamoDB tables hypbit-terraform-locks and wavult-terraform-locks exist but belong to other projects

retest: DynamoDB table for aamos-ledger terraform locks exists and works


verification: No inventory, no import plan, no drift detection exists

retest: AWS resources inventoried, drift detected, import plan created and executed


verification: aws secretsmanager list-secrets shows RotationEnabled: None for all secrets

retest: All secrets have RotationEnabled: true and rotation configured


verification: No rollback strategy documented, no prevent_destroy on resources

retest: Rollback strategy documented and tested, critical resources have prevent_destroy


category: agent-runtime

verification: Agent Runtime exists as code but not integrated in agent flow

retest: Every task goes through Agent Runtime: Planner -> Context -> Memory -> Knowledge -> EOS -> Developer -> Reviewer -> Operator -> Commit


category: agent-roles

verification: Only one agent (main) exists, no specialized roles

retest: Four agents configured: planner, developer, reviewer, operator


severity: medium

category: memory

verification: memory_search requires OpenAI API key, no alternative embedding provider

retest: Memory search works with at least one embedding provider (configurable)


category: component-roles

verification: Hermes, EOS, SIL, Project Memory roles not clearly documented

retest: Each component has clear documented role, no overlap