External Audit (July 2026)

Historical

An unmerged external proposal, not project truth; treat every docs/mixfix/ claim as a description of a different tree.

The 2026-07-23 audit under docs/mixfix/ produced a P0-ranked clean-to-perfection checklist (review-server containment, Hitvid provider authorization, security/deployment guardrails, release hygiene, production-output accuracy), a production-output assurance specification defining evidence tiers, gates and a release scorecard, a changelog asserting those repairs as done, and a local evidence record — but the run happened in a separate workspace named mixbox-audit-20260723 (PRODUCTION-OUTPUT-ASSURANCE-EVIDENCE-2026-07-23.md:10) whose code was never merged into this repository, so its “Added”/“Removed”/“Restricted” statements describe work that does not exist here and its checked boxes are proposals rather than facts about this tree.

Verified Contradictions

Audit claim	Truth in this repository
A versioned output-evaluator workspace package was added (CHANGELOG.md:13, CHECKLIST-mixbox.md:57) and the clean-wheel smoke covered “all six workspace packages” (PRODUCTION-OUTPUT-ASSURANCE-EVIDENCE-2026-07-23.md:27).	No such package exists, and none ever did: git log --all -- packages/output-evaluator returns zero commits. The workspace is members = ["packages/*"] (pyproject.toml:20) resolving to exactly five packages — audio-core, dj-engine, analyzer, video-gen, emotion.
The unsupported analyze and plugins CLI commands were removed (CHANGELOG.md:49).	Both are still registered Click commands and still placeholders: analyze at packages/dj-engine/src/mixbox/cli/commands.py:361-368 and plugins at :370-376, each echoing “placeholder and not fully implemented yet” before sys.exit(0).
Review was restricted to loopback by default and given authenticated authorization on every route and WebSocket (CHANGELOG.md:25-26, CHECKLIST-mixbox.md:12-14).	Code defaults are unchanged: host 0.0.0.0, port 55644, dist dir /home/dev/audio/mixbox/user/opendaw-test/dist (packages/dj-engine/src/mixbox/review_server.py:144-148), and the module contains no authentication or authorization dependency at all.
The rotation gate’s clipping and beat-phase thresholds were replaced by true-peak, zero-added-clips and rendered-overlap residual rules (PRODUCTION-OUTPUT-ASSURANCE.md:195-204, CHECKLIST-mixbox.md:59).	scripts/rotation_quality_gate.py:51-63 still carries the original THRESHOLDS table — clipped_ratio_max: 0.001 for both micro and afro, beat_phase_correction_p95_ms 10.0 / 260.0, energy_dip_db_max 3.0 / 6.0 — and the gate still fails on clipped_ratio against that limit (:244-247).
Review exposure is the audit’s P0 finding (CHECKLIST-mixbox.md:10-24).	Mitigated operationally rather than in code: the live mxbx.service binds loopback 127.0.0.1:51644 via MIXBOX_REVIEW_HOST/MIXBOX_REVIEW_PORT, and its public host https://mxbx.loca.zone sits behind an Authelia one_factor SSO gate. The application-level authentication the audit demanded is still absent.