Record Store protocol safety evidence

docs/release-testing-0.7.md

@@ -113,7 +113,7 @@ inputs and outputs is absent from the ZIP.
 | STQ-05 | Retry, expiry, bounce, listing, hold/release, and deletion | [PASS](test-evidence/0.7-r1.md#stq-05) |  |  |
 | STQ-06 | Concurrent delivery/read/move/delete/restart preserves integrity | [PASS](test-evidence/0.7-r1.md#stq-06) |  |  |
 | STQ-07 | Backup/export and restore reproduce mail, metadata, contacts, calendars | [PASS](test-evidence/0.7-r1.md#stq-07) |  |  |
-| STQ-08 | Invalid commands, oversized lines, and unauthorised access fail safely |  |  |  |
+| STQ-08 | Invalid commands, oversized lines, and unauthorised access fail safely | [PASS](test-evidence/0.7-r1.md#stq-08) |  |  |
 | STQ-09 | Per-user mail quota excludes contacts/calendars and atomically blocks concurrent growth |  |  |  |
 | STQ-10 | Queue/SMTP and external collection map Store 5220 to quota-exceeded delivery without data loss |  |  |  |
 | STQ-11 | Lowered/unlimited limits, large sizes, upgrade migration, backup and restore preserve quota state |  |  |  |

docs/test-evidence/0.7-r1.md

@@ -1724,3 +1724,59 @@ HTTP, loopback/private/link-local source addresses, oversized responses,
 redirect loops, non-calendar content, and invalid target names. The live
 request remained bounded by the configured redirect, response-size, and
 network timeouts. Bongo remained active after the test.
+
+## STQ-08
+
+Result: **PASS**
+
+The source audit found that four Store maintenance/debug commands did not
+enforce their intended privilege boundary. An authenticated user could select
+another account's Store (needed by the normal shared-resource ACL model) and
+then invoke `REPAIR` or the destructive `RESET` without an object-level ACL
+check. `SHUTDOWN` terminated the Store process without any authentication,
+and `REINDEX` was likewise unrestricted. Commit `dc288d9a` now requires a
+manager connection before `REINDEX`, `REPAIR`, `RESET`, or `SHUTDOWN`.
+
+The same audit found that an invalid non-path document GUID caused
+`ParseDocument()` to ignore `ParseGUID()`'s failure. The server consequently
+wrote both a `3011` syntax response and a second lookup response for one
+command, leaving the next client command out of sync. The parser now returns
+the first failure immediately.
+
+The complete rebuilt suite passed all 87 CTest tests in 11.65 seconds. The
+commit was pushed to `master`, installed as
+`mail-mta/bongo-9999::bongo` with GCC 15.3.0, and exercised on `tiulk` on
+2026-07-23 with the reusable test:
+
+```sh
+export BONGO_TEST_PASSWORD='<disposable-test-password>'
+./contrib/testing/store-protocol-safety-check.py
+```
+
+The live test proved all of the following:
+
+- an unknown command returned `3000`, pre-authentication Store selection
+  returned `3241`, and access without a selected Store returned `3243`;
+- missing, invalid-GUID, and excessive `READ` arguments returned exactly one
+  `3010` or `3011` response each, with a successful `NOOP` after the errors;
+- authenticated `test1` could select `test2` for the shared-store model but
+  `LIST /mail` returned `4240`, disclosing no foreign Store contents;
+- `REINDEX`, `REPAIR`, `RESET`, and `SHUTDOWN` each returned manager-only
+  code `3243` to the normal user, and the same connection remained usable
+  after every rejection;
+- a 4096-byte line closed only its offending client connection; a fresh
+  connection immediately received the normal Store greeting and accepted
+  `NOOP`.
+
+The final clean run reported:
+
+```text
+STQ-08 PASS checks=13 oversized-bytes=4096 manager-only=REINDEX,REPAIR,RESET,SHUTDOWN foreign-store=test2
+ActiveState=active
+MainPID=1419864
+NRestarts=0
+```
+
+The test is non-destructive, keeps credentials out of Git, and leaves both
+disposable user Stores intact. No mail, relay, collector, or external service
+was involved.