Repository navigation
docs(security): add CP #190 trust boundary audit - #1220
Draft
0xPlayerOne wants to merge 4 commits into
Draft
0xPlayerOne wants to merge 4 commits into
0xPlayerOne wants to merge 4 commits into
Conversation
added 4 commits
October 21, 2026 07:38
…credential-free probes Independent read-only audit of Control Plane issue #190 (security, trust boundary and adversarial audit) against head 27f17bd. Three new dedicated paths, no existing file modified: - docs/evidence/m11-security-trust-boundary-audit-2026-10-21.md: the independent review report. Threat/control to entrypoint to evidence matrix across workspace, project, runtime, session, tools, models, artifacts and admin; 28 confirmed findings with severity, release impact, routed owner and a reproducible regression description; the unresolved gates that keep whole-cloud and whole-runtime trust acceptance held. - docs/evidence/m11-security-trust-boundary-matrix-2026-10-21.v1.json: the machine-readable matrix and finding register. - scripts/security-trust-boundary-probes.mjs: 20 credential-free synthetic probes that reproduce the confirmed findings. The script exits 0 while every recorded finding still reproduces, 2 when an owner fix lands and 1 on a harness failure, so a fix that is not mirrored here is visible rather than silent. No secret was read, no deployed profile was contacted and no penetration traffic was sent. No existing test, source file, canonical ledger or architecture artifact was edited; tests/m11-security-probes.test.mjs is untouched because its custody is not established in this lane. The reviewer approves none of the routed fixes.
…very available head Every branch in the fleet's shared origin was compared against the audited head for the files each of the 28 findings depends on. No owner fix for any finding exists on an available head yet, so the required owner-fix verification has nothing to verify and stays open. Four files differ on unmerged branches; every difference is cosmetic or belongs to an unrelated change (the #612 byte-format wording, the #678 per-model harness map, a record-equivalence refactor and a scope-trigger move), so all 28 findings stand on the audited head and on every currently available unmerged branch.
…nd probes Root's counterevidence was checked against exact source before any wording changed. Six findings were re-examined; five were reduced in severity and restated with an explicit reachability class, and one citation was corrected. - F-01 Critical -> Medium: the relay-client authentication obligation is documented and the adapters are opt-in, and the only relay client in the repository is the test fake, so no deployed attacker-controlled ingress supports the claim. - F-02 High -> Medium: create_execution is idempotent through the CommandInbox, and the effect-before-receipt order is correct and must not be inverted. The defect is that the effect and its receipt are two non-atomic writes and only in-memory receipt repositories ship. - F-04 Medium-High -> Low: thrown errors are already sanitized to PROVIDER_OPERATION_FAILED and the composed profiles do not lease, so this is a bounded library callback-result contract gap. No deployed credential leakage is claimed or demonstrated. - F-05 Medium-High -> Medium: the Local profile binds loopback and uses an owner-only token, so the finding is an authorization-completeness gap. - F-09 Medium -> Low: the parent data directory is chmod 0700 before SQLite and its sidecars are created, so the sidecar mode is defense in depth and no cross-UID read is demonstrated. - F-03 citation corrected: the managed-Pi direct driver is packages/managed-pi-adapter/src/index.ts:322, not a module that does not exist. Every finding now carries a reachability class and a reachability note. Probes CP190-P09 and CP190-P10 named a nonexistent module and now fail loudly instead of reporting a missing check for a missing file; CP190-P05 asserts both halves of the vault boundary; CP190-P13 records the mitigating parent-directory control; CP190-P02, CP190-P03 and CP190-P04 carry their reachability bounds. Added eight targeted evidence questions and the exact-path custody result for the two proposed F-04 paths. No product source, test or fixture was changed, and the unresolved gates are unchanged, so the acceptance hold stands.
…ct path Second calibration round. Each finding was traced from its entrypoint through the authority check and the effect to the point where a control is applied, and each probe was re-read as a synthetic demonstration rather than as deployed behaviour. - F-01: the Control Plane ships no relay client, no host adapter and no metadata effect at all; the effect is an injected callback and the operation names are schema values, not shipped behaviour. No deployed unauthenticated approval path is claimed. - F-02: idempotency is not uniform across payload types. create_execution extends the context schema that carries idempotencyKey and is deduped in the CommandInbox; submit_input carries no idempotency key; the metadata effect is injected. - F-03: the direct-local working directory is bounded by operator configuration, not by a grant. The managed-Pi child runs in a per-attempt 0700 directory under the data directory and the composed spawn policy leaves the working-directory dimension unconstrained; the ACP child runs in an operator-configured absolute directory. - F-04: a positive control the earlier revision missed. The composed model-selection path normalizes the leased result and rejects a non-plain carrier before the vault screen can miss it; only the two uncomposed raw-result callers can reach it. - F-09 split: the provider creates and restricts its parent to 0700 before any file exists, so it has no traversal path. CP190-F29 added for the pi-durable adapter, which creates its own directory without a mode and inherits the guarantee from an ancestor. Five static reachability probes added (CP190-P21 to CP190-P25) and the regression packet is now owner-specific: every row names the owner, the existing file in that owner's package where the regression belongs, the credential-free failing condition and the assertion to add. Those files are proposals, not custody claims. Findings 28 -> 29, probes 20 -> 25. No severity changed in this round and no gate was released. No product source, test or fixture was changed.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft PR published from the verified owner commit; auto-merge is off. This description records the bounded contribution and remaining acceptance gates.
20261021-f2w4-cp190-security-full-outcome-02b3a36950-f867-49e4-a482-26c289aa74b9; terminal done, exit 0, cleanup confirmed.f2w4/cp190-trust-boundary//tmp/opencode-fleet-2-20261021/worktrees/F2W4.27f17bd55e0266439b5b3089163195c9e7a669be; head:40444c70a5d688628f4ddbc792c91ce957a2c2e9; tree:8e13b9366c59fe684b0a4f1db31d40a860097cdf; clean; base ancestor verified.881d4edd1d874416095c38f2cfca9df6bc12f9e886830461d532f223e4ff2dc7.docs/evidence/m11-security-trust-boundary-audit-2026-10-21.mddocs/evidence/m11-security-trust-boundary-matrix-2026-10-21.v1.jsonscripts/security-trust-boundary-probes.mjslibfile_44239b32cc748191adaa372e8cbcfc1b, SHA2566dafed9768f347293025bbe1a1dd23803daecc377c2497a178f079ac3cb5985d, 377 lines. Full-profile/human acceptance is not claimed.Follow-up: counterevidence calibration
Published checked owner commit
43295261c6a8a5ef112e1e319961f3601f6de71b(tree992713f6bdd4df9ca369ba6ceb236935fb8cd38a), three report/probe files. It recalibrates F01/F02/F04/F09, corrects the F03 citation, and records reachability classes and remaining evidence questions. The report currently classifies 0 critical, 2 high, 22 medium, 2 low, and 2 low-medium findings.Checks: synthetic probes 20 open / 0 harness failures; report-matrix consistency passed; focused tests 73/0; formatting, lint and secret scan passed. No build, integration, coverage, or live security evidence is claimed. Patch SHA-256:
ab40952fb10ab6b324482d343134637cca32221007d5a3c3845ed90ed9f0455c. Draft only; no security acceptance or issue closure.