update task documentation

[wangqianqianjun]

Background

• This PR packages the current branch changes for review.
• It focuses on task documentation.

Solution

• Documented the implementation background, current status, and follow-up work for this task.

Affected Files

• .gitignore
• CONTRIBUTING.md
• LICENSE
• NOTICE
• README.md
• SECURITY.md
• cmd/futrix-audit-verify/main.go
• cmd/futrix-evidence-verify/main.go
• docs/agent-protocol.md
• docs/assets/futrixdata-gateway.png
• docs/assurance-matrix.md
• docs/audit-chain.md

[wangqianqianjun]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

FutrixData/pkg/auditchain/auditchain.go

Lines 93 to 95 in e214d44

	if os.IsNotExist(err) {
	return result, nil
	}

Fail on missing audit files

VerifyFile returns a passing result when os.Open hits os.IsNotExist, so verifications can report success even if no audit log exists at all. This causes both futrix-audit-verify and VerifyBundle's audit_chain check to pass with zero records for a nonexistent path, which can produce false compliance/attestation results instead of a hard failure.

---

FutrixData/pkg/auditchain/auditchain.go

Lines 233 to 236 in e214d44

	if err := dec.Decode(&raw); err != nil {
	return nil, err
	}
	return raw, nil

Reject trailing bytes in JSONL audit rows

decodeLine accepts any trailing non-JSON content because it only calls dec.Decode(&raw) once and immediately returns success. A row like {"...valid chained object..."}junk is treated as valid and hashed using only the first object, so malformed or appended data can slip through verification without being detected.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[wangqianqianjun]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".