v9.0 security push: AC-76..AC-82 closed — ship gate CLEAR

.env.example

@@ -25,6 +25,67 @@ OPEN_PINCERY_PORT=8080
 #   Windows PS:   -join ((48..57)+(97..102) | Get-Random -Count 64 | % {[char]$_})
 OPEN_PINCERY_BOOTSTRAP_TOKEN=change-me-to-a-random-secret
 
+# --- Credential vault master key (REQUIRED, v7) ----------------------------
+# Base64-encoded 32-byte key used by the AES-256-GCM credential vault. Every
+# workspace-scoped credential is sealed under this key. Generate once per
+# deployment and NEVER rotate in place (v7) — v8 adds a re-wrap path.
+#   Linux/macOS:  openssl rand -base64 32
+#   Windows PS:   [Convert]::ToBase64String((1..32 | % {Get-Random -Max 256}))
+# Losing this value makes all stored credentials unrecoverable.
+OPEN_PINCERY_VAULT_KEY=replace-with-openssl-rand-base64-32-output
+
+# --- Sandbox enforcement mode (optional, v9 / AC-73) -----------------------
+# Controls the Zerobox tool sandbox (AC-53). Default: enforce.
+#   enforce  — full sandbox; policy violations block the tool call (SAFE).
+#   audit    — policy engine runs but emits `sandbox_would_block` events
+#              instead of blocking. Use for one week during v9 upgrade to
+#              surface allowlist gaps, then flip back to `enforce`.
+#   disabled — sandbox is bypassed entirely. REQUIRES the paired
+#              OPEN_PINCERY_ALLOW_UNSAFE=true below. Never use in
+#              production; a stderr warning is emitted every 60s while
+#              disabled. The sandbox is the primary boundary between
+#              agent-emitted shell commands and your host.
+# OPEN_PINCERY_SANDBOX_MODE=enforce
+
+# --- Unsafe sandbox bypass opt-in (v9 / AC-73) -----------------------------
+# Required companion to OPEN_PINCERY_SANDBOX_MODE=disabled. Must be the
+# literal string `true`. Any other value (including unset, `false`, `1`,
+# `yes`) refuses the bypass and fails startup. Also required companion to
+# OPEN_PINCERY_SANDBOX_FLOOR=relaxed below.
+# OPEN_PINCERY_ALLOW_UNSAFE=true
+
+# --- Kernel ABI floor opt-out (optional, v9 / AC-84) -----------------------
+# Controls the startup preflight that asserts the host kernel meets the v9
+# sandbox floor (Landlock ABI >= 6 on Linux >= 6.7, seccomp-bpf, cgroup v2,
+# unprivileged userns or root, bubblewrap >= 0.8.0). Default: strict.
+#   strict   — enforce the full floor. Older kernels fail startup (SAFE).
+#   relaxed  — downgrade the Landlock requirement from ABI 6 to ABI 1
+#              (Linux >= 5.13). All other preflight checks stay mandatory.
+#              REQUIRES the paired OPEN_PINCERY_ALLOW_UNSAFE=true above.
+#              Emits a `sandbox_floor_relaxed` warning at startup.
+# OPEN_PINCERY_SANDBOX_FLOOR=strict
+
+# --- Audit-chain integrity floor (optional, v9 / AC-78) --------------------
+# Controls the startup preflight that walks every agent's per-agent SHA-256
+# event hash chain. Default: strict.
+#   strict   — refuse to boot (exit code 5) if any agent's chain is broken.
+#              Operators must investigate via `pcy audit verify --agent <id>`
+#              before restarting. SAFE.
+#   relaxed  — log the broken chain, emit one `audit_chain_floor_relaxed`
+#              event per affected agent, then continue boot. REQUIRES the
+#              paired OPEN_PINCERY_ALLOW_UNSAFE=true above. Use only during
+#              forensic recovery; switch back to strict after restoring
+#              integrity.
+# OPEN_PINCERY_AUDIT_CHAIN_FLOOR=strict
+
+# --- Sandbox process identity (optional, v9 / AC-86) -----------------------
+# Every bwrap sandbox process runs as nobody:nogroup by default and drops all
+# Linux capabilities. Override only when your deployment requires a different
+# non-root identity inside the sandbox. UID/GID 0 require
+# OPEN_PINCERY_ALLOW_UNSAFE=true and are refused by default.
+# OPEN_PINCERY_SANDBOX_UID=65534
+# OPEN_PINCERY_SANDBOX_GID=65534
+
 # ============================================================================
 # LLM provider (REQUIRED)
 # ============================================================================
@@ -58,6 +119,12 @@ LLM_MAINTENANCE_PRICE_OUTPUT_PER_MTOK=15.0
 # Prometheus /metrics endpoint on its own port. Unset = metrics disabled.
 # METRICS_ADDR=127.0.0.1:9090
 
+# Optional Landlock audit-log fallback path for AC-88. When unset, Open Pincery
+# checks /var/log/audit/audit.log after shell tool calls and emits a one-time
+# audit_log_unavailable warning if the source cannot be read. Set this when
+# auditd/journald writes Landlock denial records somewhere else.
+# OPEN_PINCERY_LANDLOCK_AUDIT_LOG=/var/log/audit/audit.log
+
 # Standard Rust log filter.
 RUST_LOG=open_pincery=info
 
@@ -66,6 +133,17 @@ RUST_LOG=open_pincery=info
 # ============================================================================
 # MAX_PROMPT_CHARS=100000
 # ITERATION_CAP=50
+# AC-79: per-wake cap on consecutive schema-invalid LLM tool-call
+# responses before the wake terminates with FailureAuditPending.
+# Operators may tighten but not silently disable; 0 is rejected.
+# OPEN_PINCERY_SCHEMA_INVALID_RETRY_CAP=3
+# AC-79: per-wake cap on the number of tool calls that may be
+# dispatched within a single wake. Independent of ITERATION_CAP
+# (different quantities). On exhaustion the wake emits
+# tool_call_rate_limit_exceeded once and terminates with
+# FailureAuditPending. Operators may tighten but not silently
+# disable; 0 is rejected.
+# OPEN_PINCERY_TOOL_CALL_RATE_LIMIT_PER_WAKE=32
 # STALE_WAKE_HOURS=2
 # WAKE_SUMMARY_LIMIT=20
 # EVENT_WINDOW_LIMIT=200

.github/hooks/commit-msg-spec-ref

@@ -0,0 +1,160 @@
+#!/usr/bin/env bash
+# AC-81 — commit-msg hook: spec-ref trailer enforcement.
+#
+# Rejects any commit whose staged diff touches src/runtime/** or
+# src/api/** unless the commit message body contains at least one
+#
+#     canonical_action=<Name>
+#
+# trailer where <Name> appears verbatim in the canonical_action column
+# of scaffolding/spec_coverage.md. Commits that touch neither path are
+# accepted with no trailer requirement.
+#
+# Argument: $1 — path to the commit message file (Git default).
+#
+# Exit codes:
+#   0 — accept commit
+#   1 — reject commit (path-gated and trailer missing or invalid)
+
+set -u
+
+MSG_FILE="${1:-}"
+if [[ -z "$MSG_FILE" || ! -f "$MSG_FILE" ]]; then
+    echo "commit-msg-spec-ref: missing message file argument" >&2
+    exit 1
+fi
+
+# Path-conditional gate: only enforce on runtime / api edits.
+GATED_REGEX='^src/(runtime|api)/'
+STAGED="$(git diff --cached --name-only 2>/dev/null || true)"
+
+needs_trailer=0
+if [[ -n "$STAGED" ]]; then
+    while IFS= read -r path; do
+        if [[ "$path" =~ $GATED_REGEX ]]; then
+            needs_trailer=1
+            break
+        fi
+    done <<< "$STAGED"
+fi
+
+if [[ "$needs_trailer" -eq 0 ]]; then
+    exit 0
+fi
+
+# Locate scaffolding/spec_coverage.md (relative to repo root).
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo .)"
+COVERAGE="$REPO_ROOT/scaffolding/spec_coverage.md"
+if [[ ! -f "$COVERAGE" ]]; then
+    echo "commit-msg-spec-ref: $COVERAGE not found; cannot validate canonical_action trailer" >&2
+    exit 1
+fi
+
+# Build the set of valid canonical action names from spec_coverage.md.
+# Each table row looks like:
+#     | AC-80 | AuthorizeExecution \| IssueToolCall | ... |
+# The escaped `\|` characters belong inside cell 2 (canonical_action).
+# We extract cell 2 as everything between the first and second
+# *unescaped* `|` after the `AC-` token, then split that cell on `\|`
+# (the escaped pipe) to recover individual action names.
+mapfile -t VALID_ACTIONS < <(
+    python_helper() {
+        # Pure-bash, no python — do it with sed + while.
+        :
+    }
+    while IFS= read -r line; do
+        case "$line" in
+            "| AC-"*) ;;
+            *) continue ;;
+        esac
+        # Replace every escaped pipe `\|` with NUL placeholder, then
+        # split on `|`, then restore.
+        protected="${line//\\|/$'\x1f'}"
+        IFS='|' read -r -a cells <<< "$protected"
+        # cells[0]="" (before leading |), cells[1]=" AC-NN ", cells[2]=" actions "
+        if [[ "${#cells[@]}" -lt 4 ]]; then
+            continue
+        fi
+        cell="${cells[2]}"
+        # Restore escaped pipes back to literal `|` separators.
+        cell="${cell//$'\x1f'/|}"
+        # Trim outer whitespace.
+        cell="${cell#"${cell%%[![:space:]]*}"}"
+        cell="${cell%"${cell##*[![:space:]]}"}"
+        if [[ "$cell" == "—" || -z "$cell" ]]; then
+            continue
+        fi
+        # Split on `|` (unescaped — these are now real separators).
+        IFS='|' read -r -a parts <<< "$cell"
+        for p in "${parts[@]}"; do
+            p="${p#"${p%%[![:space:]]*}"}"
+            p="${p%"${p##*[![:space:]]}"}"
+            if [[ -n "$p" && "$p" != "—" ]]; then
+                printf '%s\n' "$p"
+            fi
+        done
+    done < "$COVERAGE" | sort -u
+)
+
+if [[ "${#VALID_ACTIONS[@]}" -eq 0 ]]; then
+    echo "commit-msg-spec-ref: no canonical actions found in $COVERAGE" >&2
+    exit 1
+fi
+
+# Extract canonical_action=<Name> trailers from the message.
+mapfile -t CITED < <(
+    grep -E '^canonical_action=[A-Za-z][A-Za-z0-9]+$' "$MSG_FILE" \
+        | sed -E 's/^canonical_action=//' \
+        | sort -u
+)
+
+if [[ "${#CITED[@]}" -eq 0 ]]; then
+    cat >&2 <<EOF
+commit-msg-spec-ref: REJECTED.
+
+This commit modifies src/runtime/** or src/api/** but the message body
+contains no \`canonical_action=<Name>\` trailer.
+
+Add at least one trailer line referencing the canonical TLA+ action(s)
+this change implements, e.g.:
+
+    canonical_action=AuthorizeExecution
+
+Valid action names are listed in scaffolding/spec_coverage.md.
+EOF
+    exit 1
+fi
+
+# Validate every cited action against the canonical set.
+unknown=()
+for c in "${CITED[@]}"; do
+    found=0
+    for v in "${VALID_ACTIONS[@]}"; do
+        if [[ "$c" == "$v" ]]; then
+            found=1
+            break
+        fi
+    done
+    if [[ "$found" -eq 0 ]]; then
+        unknown+=("$c")
+    fi
+done
+
+if [[ "${#unknown[@]}" -gt 0 ]]; then
+    {
+        echo "commit-msg-spec-ref: REJECTED."
+        echo
+        echo "The following canonical_action trailers reference names that"
+        echo "are NOT in scaffolding/spec_coverage.md:"
+        for u in "${unknown[@]}"; do
+            echo "  - $u"
+        done
+        echo
+        echo "Either fix the typo or add the action to the coverage table"
+        echo "(and confirm it appears in docs/input/OpenPinceryCanonical.tla"
+        echo "Next disjunction)."
+    } >&2
+    exit 1
+fi
+
+exit 0

.github/workflows/ci.yml

@@ -54,7 +54,103 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
+      # The real-bwrap tests are skipped here via env gate (see below)
+      # and run in the sandbox-smoke job's privileged container instead.
+      # This job stays unprivileged so postgres/sqlx and socket tests
+      # match the real devshell posture.
       - run: cargo test --all -- --test-threads=1
+        env:
+          OPEN_PINCERY_SKIP_REAL_BWRAP: "1"
+
+  # Dedicated gate for AC-53 RealSandbox evidence.
+  #
+  # Runs inside a `--privileged` Docker container because hosted
+  # GitHub runners block bwrap's MS_SLAVE|MS_REC on the inherited
+  # root mount even for root callers (the mounts are locked with
+  # respect to the init user namespace's ability to change
+  # propagation on a shared-propagation systemd-managed /).
+  # Workarounds attempted and rejected:
+  #   - `mount --make-rprivate /` on host:  locked mounts unaffected.
+  #   - `setcap cap_sys_admin+ep bwrap`:   modern bwrap refuses.
+  #   - `sudo -E <test-binary>`:            still hits the locked-mount
+  #                                         check; userns-propagation
+  #                                         rules key on mount owner.
+  #
+  # A privileged container lifts AppArmor + seccomp restrictions and
+  # runs its own mount namespace from first principles, so bwrap's
+  # internal MS_SLAVE on / succeeds. This is the same posture the
+  # local devshell uses (`docker run --privileged --cgroupns=host`).
+  # The sandboxed child still unshares into an unprivileged userns
+  # for every tool invocation — isolation posture is unchanged.
+  sandbox-smoke:
+    name: sandbox real-bwrap smoke
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: run AC-53 sandbox tests in privileged container
+        run: |
+          set -euo pipefail
+          # Use a minimal Ubuntu 24.04 image and install the exact
+          # userland the devshell uses. This is the shortest path to
+          # a working bwrap on a hosted GitHub runner. If test timings
+          # become a concern we can pre-publish ghcr.io/open-pincery/devshell.
+          OUT=$(mktemp)
+          docker run --rm --privileged --cgroupns=host \
+            -v "$PWD:/work" -w /work \
+            -e CARGO_HOME=/tmp/cargo \
+            -e CARGO_TERM_COLOR=always \
+            -e RUSTFLAGS="-D warnings" \
+            ubuntu:24.04 \
+            bash -c '
+              set -euo pipefail
+              export DEBIAN_FRONTEND=noninteractive
+              apt-get update
+              apt-get install -y --no-install-recommends \
+                bubblewrap slirp4netns uidmap libseccomp-dev libseccomp2 \
+                pkg-config build-essential ca-certificates curl git libssl-dev libpq-dev socat \
+                iputils-ping
+              curl --proto "=https" --tlsv1.2 -sSf https://sh.rustup.rs \
+                | sh -s -- -y --default-toolchain 1.88.0 --profile minimal
+              export PATH=/tmp/cargo/bin:$PATH
+              export OPEN_PINCERY_RUN_AC84_POSITIVE=1
+              bwrap --version
+              # Sanity-check: bwrap actually creates a user+pid ns.
+              bwrap --unshare-user --unshare-pid --dev-bind / / /bin/true
+              # AC-77 verify-fix-2 diagnostic: clear the kernel ring
+              # buffer before tests so any seccomp KILL_PROCESS audit
+              # records the kernel emits during the run are easy to
+              # locate. SECCOMP_RET_KILL_PROCESS produces
+              #   audit: type=1326 ... syscall=NN compat=0 ip=0x... code=0x80000000
+              # in dmesg even without auditd; that NN is the missing
+              # entry the empirical capture script did not see.
+              dmesg -C 2>/dev/null || true
+              # Run every real-bwrap suite as a single cargo invocation
+              # so target/ is shared. --test-threads=1 matches production
+              # because tempdirs + procfs probes are not thread-safe.
+              set +e
+              cargo test --test sandbox_real_smoke --test sandbox_landlock_test \
+                         --test sandbox_uid_drop_test \
+                         --test landlock_scope_test \
+                         --test sandbox_seccomp_test --test sandbox_cgroup_test \
+                         --test sandbox_preflight_test \
+                         --test sandbox_escape_test \
+                         --test seccomp_allowlist_test \
+                         --no-fail-fast \
+                         -- --nocapture --test-threads=1
+              TEST_EXIT=$?
+              set -e
+              echo "=== AC-77 KERNEL SECCOMP/AUDIT LOG (post-test dmesg) ==="
+              dmesg 2>/dev/null | grep -iE "seccomp|audit:|type=1326|type=SECCOMP" \
+                || echo "(no kernel seccomp/audit lines captured)"
+              echo "=== END AC-77 KERNEL LOG ==="
+              exit $TEST_EXIT
+            ' | tee "$OUT"
+          # Fail if the suite ran zero tests -- would mean the
+          # bwrap probe or Linux gate silently skipped our evidence.
+          if grep -qE '^test result:.*0 passed' "$OUT" && ! grep -qE '^test result:.*[1-9][0-9]* passed' "$OUT"; then
+            echo "::error::sandbox smoke produced 0 passed tests -- evidence gate failed" >&2
+            exit 1
+          fi
 
   deny:
     name: cargo deny