docs(security): model Agent Artifact Admission threats - #404
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
7c97ec5
into
feat/agent-artifact-admission
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| | DNSBL abuse | Reputation damage | Loopback response-code validation | Authoritative DNS service, signing, publisher workflow | | ||
| | Secret disclosure | Admin compromise | Support bundle excludes admin token; secrets bootstrapped into credential registry (`WAF_IDS_CREDENTIALS_PATH` preferred over long-lived env); health exposes source label only | External secret manager / SSO, rotation, access review | | ||
| | Artifact identity substitution | A reviewed package coordinate is replaced by different bytes, registry/owner identity, workspace manifest, or installer interpretation while retaining apparent admission | Agent Artifact Admission binds exact structured coordinates, artifact digest, workspace-manifest digest, submitted argv, policy identity, and required evidence; mismatches deny | Released retrieval/executor evidence must cryptographically bind the retrieved bytes and effective execution input back to the same admission identity | | ||
| | Forged or stale foreign-owner evidence | A sandbox/egress/orchestration/guardrail claim is replayed, fabricated, or attached to a different artifact/policy decision | Wardnet consumes foreign evidence only through released/versioned contracts, validates required identity/freshness fields, and fails closed on absent, malformed, stale, unverifiable, or mutable-branch evidence | Cryptographic issuer identity, anti-replay/expiry semantics, immutable release provenance, and conformance tests per owner contract | |
There was a problem hiding this comment.
🔍 Foreign evidence control exceeds runtime
The current control claims foreign-evidence identity and freshness validation. InstallIntent and AdmissionPolicy expose no foreign receipt, issuer, or freshness fields.
Was this helpful? React with 👍 or 👎 to provide feedback.
| for marker in [ | ||
| "Agent Artifact Admission", | ||
| "artifact digest", | ||
| "admission receipt", | ||
| "quarantine-sandbox-runtime", | ||
| "EgressWeave", | ||
| "contextual-orchestrator", | ||
| "appguardrail", | ||
| "fail closed", | ||
| "mutable branch", | ||
| ] { | ||
| assert!( | ||
| threat_model.contains(marker), | ||
| "threat model must retain the code-current security marker {marker:?}" | ||
| ); | ||
| } | ||
|
|
||
| for threat in [ | ||
| "Artifact identity substitution", | ||
| "Forged or stale foreign-owner evidence", | ||
| "Admission-authority confusion", | ||
| ] { | ||
| assert!( | ||
| threat_model.contains(threat), | ||
| "threat model must retain the Agent Artifact Admission threat {threat:?}" |
There was a problem hiding this comment.
🔍 Substring contract misses structural regressions
Global contains checks survive removal of the modeled asset, boundary, or threat row when each phrase remains elsewhere.
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Child of #129 after ordinary integration of #403. This lane repairs
docs/security/threat-model.mdonly, plus a structural regression contract; it does not change admission runtime/policy or copy foreign-owner implementation logic.Fresh review of exact parent
#129@ad74b915ef2b41e8551a787ee38f6ccbddebee81found the code-current architecture now names Wardnet's Agent Artifact Admission boundary, butdocs/security/threat-model.mdstill models only the pre-admission gateway/control-plane assets and threats. It omits immutable artifact identity, admission receipts, foreign-owner evidence boundaries, and artifact/evidence confusion attacks.Exact test-only head
a1210e32bd0579b4028eb86fa3db54cbc1a2ffcfaddstests/agent_artifact_threat_model_contract.rs. The contract requires explicit Agent Artifact Admission assets/boundaries, digest/receipt semantics, fail-closed mutable-branch rejection, canonical foreign owners (quarantine-sandbox-runtime,EgressWeave,contextual-orchestrator,appguardrail), and three threat classes: artifact identity substitution, forged/stale foreign-owner evidence, and admission-authority confusion. Production/security documentation is byte-identical to the parent at this RED head.Minimum causal repair is the threat model and standards traceability only. NIST SP 800-218 v1.1 remains the current final SSDF while SP 800-218 Rev.1/v1.2 is still a draft; NIST SP 800-161 Rev.1 Update 1 is the current final C-SCRM publication. Do not edit #361 PRD/TRD/UML, #111 ADR, #130 gap baseline, CGC/EA, central workflows, or sibling-owner source.
Keep Draft until exact-head RED/GREEN, review/thread state, and candidate-base identity are fresh. No force push, destructive rebase, self/model approval, gate weakening, source churn, or bypass.