AIIR verification and policy gates could report success without enforcing the control (fail-open)

Several verification and policy gates in AIIR prior to version 1.7.0 could return a success or "verified" result without actually enforcing the control they represent, resulting in fail-open behavior. Specifically, the `require_signing` gate could be bypassed by forgeable or empty fields, allowing unsigned or forged receipts to pass. A CI verification path could report success regardless of verification results. Release verification could claim enforcement of policy limits it did not enforce. Signature verification could be skipped silently for certain inputs. These flaws mean consumers relying on these gates might accept unverified or non-conforming inputs as verified. The issues were discovered during an internal adversarial review and fixed in version 1.7.0, which now fails closed on all affected paths and includes regression tests. No workarounds exist other than upgrading, though full cryptographic Sigstore verification provides defense in depth.

Consumers relying on AIIR's affected verification and policy gates before version 1.7.0 could receive false positive verification results, potentially accepting unsigned, forged, or non-conforming receipts as valid. This undermines trust in the verification process but does not compromise the underlying cryptographic signature validity or content-addressing mechanisms. Exploitation requires reliance on the affected gates; it does not enable forging valid signatures or bypassing cryptographic protections.

A fix is available in AIIR version 1.7.0, which enforces fail-closed behavior on all affected verification and policy paths with regression tests. Users should upgrade to version 1.7.0 or later. There are no effective workarounds for earlier versions. Using full cryptographic Sigstore verification with AIIR's signature verification options provides additional defense in depth.