kiosk-redteam 0.5.20

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: f685eaaad2b4f5c00e9a30b853c7b955944b5ebfe3cc2232da9595a5deb5325b
+  data.tar.gz: 5e7361227cfe0ac60f95085a875af20451992d0ed0a0514ca1ef3d7f50101efa
+SHA512:
+  metadata.gz: c59a347eb3eb6261fd991cb85047c3698bac43d6d29d3dbbfcb1bbcc6cec4a86d1957dbc47a5853cd9be412b55219cfc45ac5821b8ac4d2b4ef659000adf7a54
+  data.tar.gz: 043e887db0d72927446207bf3e0c3dff8aee07d44f976890c74c40f72660ee0e4d2f74d6ff12d93f47809884a6c067db5e8b89b044b931b0a4e05fbe0d030625

data/CHANGELOG.md

@@ -0,0 +1,158 @@
+# Changelog
+
+All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Versioning](https://semver.org/).
+
+How to write an entry, and what a release section means: `CHANGELOG-RULE.md` at
+the root of this repository —
+<https://github.com/kiosk-hq/kiosk/blob/main/CHANGELOG-RULE.md>. In short: under
+200 characters, one or two sentences, the essence rather than the content; write it
+under `## [Unreleased]`; a cut renames that heading to
+`## [MAJOR.MINOR.PATCH] — <date>` and opens a fresh empty one above it; nothing
+already written is edited.
+
+## [Unreleased]
+
+## [0.5.20] — 2026-10-20
+
+- 2026-10-20: Version 0.5.20, the tree cut that matches skill 0.5.20.
+
+## [0.5.19] — 2026-10-20
+
+- 2026-10-20: Version 0.5.19, the tree cut that matches skill 0.5.19.
+
+## [0.5.18] — 2026-10-18
+
+- 2026-10-18: Version 0.5.18, the tree cut that matches skill 0.5.18.
+
+## [0.5.17] — 2026-10-18
+
+- 2026-10-18: A failed setup step, or a 402 the origin answers before it reads the attack, is UNTESTED: the battery fails, with no BREACH. The JSON line lists `untested`.
+- 2026-10-18: `Battery#record` takes `untested:` for a hand-written beat whose setup step failed. The skooti battery finishes without a stripe-mock.
+
+## [0.5.16] — 2026-10-18
+
+- 2026-10-18: `Kiosk::Redteam::Scenario.new` takes only `name:`; `category` and `description` are removed.
+- 2026-10-18: `Kiosk::Redteam::Runner#all_blocked?`, `#breaches` and `#blocked` are removed; `Battery#report!` is the exit status.
+- 2026-10-18: kiosk-redteam reads a query answer only as a bare array; ForgedUserId scores BREACH when the owner's query answers no rows array.
+## [0.5.15] — 2026-10-18
+
+- 2026-10-18: Version 0.5.15, the tree cut that matches skill 0.5.15.
+
+## [0.5.14] — 2026-10-18
+
+- 2026-10-18: Version 0.5.14, the tree cut that matches skill 0.5.14.
+
+- 2026-10-17: `Battery#skip`, `Battery#entries` and the `echo:` keyword of `Battery#absorb` are removed; nothing used them.
+
+## [0.5.13] — 2026-10-11
+
+- 2026-10-11: Version 0.5.13, the tree cut that matches skill 0.5.13.
+
+- 2026-10-09: **The assistant client, wire, event stream and stripe-mock front move to kiosk-test-support**, which this gem now attacks through.
+
+## [0.5.12] — 2026-10-08
+
+- 2026-10-08: Version 0.5.12, the tree cut that matches skill 0.5.12; this gem's surface is unchanged.
+
+## [0.5.11] — 2026-10-08
+
+- 2026-10-08: Version 0.5.11, the tree cut that matches skill 0.5.11; this gem's surface is unchanged.
+
+## [0.5.10] — 2026-10-08
+
+- 2026-10-08: Version 0.5.10, the tree cut that matches skill 0.5.10 and carries the entries below.
+
+- 2026-10-08: The `StripeMock` front relays a long stripe-mock answer intact, so a Checkout Session for card setup reaches the caller.
+- 2026-10-08: `StripeMock.start` fronts stripe-mock so a confirmed charge answers `succeeded` with its whole amount, as Stripe does for a test card.
+- 2026-10-08: `StripeMock.start` brings up a local stripe-mock for a demo suite that pays and refunds with no Stripe key.
+
+## [0.5.9] — 2026-10-08
+
+- 2026-10-08: Version 0.5.9, the tree cut that matches skill 0.5.9; this gem's surface is unchanged.
+
+## [0.5.8] — 2026-10-07
+
+- 2026-10-07: Version 0.5.8, the tree cut that matches skill 0.5.8; this gem's surface is unchanged.
+
+## [0.5.7] — 2026-10-07
+
+- 2026-10-07: Version 0.5.7, the tree cut that matches skill 0.5.7; this gem's surface is unchanged.
+
+## [0.5.6] — 2026-10-07
+
+- 2026-10-07: **`EventStream.payload_errors`** holds delivered events to the `payload_schema` an origin serves for their topic.
+
+## [0.5.5] — 2026-10-07
+
+- 2026-10-07: Version 0.5.5, the tree cut that matches skill 0.5.5; this gem's surface is unchanged.
+
+## [0.5.4] — 2026-10-07
+
+- 2026-10-07: Version 0.5.4, the tree cut that matches skill 0.5.4; this gem's surface is unchanged.
+
+## [0.5.3] — 2026-10-06
+
+- 2026-10-06: Version 0.5.3, the tree cut that matches skill 0.5.3; this gem's surface is unchanged.
+
+## [0.5.2] — 2026-10-06
+
+- 2026-10-05: **`EventStream`**: the assistant's side of `<endpoint>/events`, to subscribe and wait for an event or assert none arrived.
+
+## [0.5.0] — 2026-09-26
+
+### Added
+
+- **`Profile#gated_action_consumes` — whether the gated action SPENDS the resource.** A verb that only reads back the operator's own decision is right to answer twice, so C3 skips there.
+
+- **`Wire.http_for` — the one place http vs https is decided, read off the target's scheme.** `Client` could not dial a TLS origin at all, so `Runner` reached none.
+
+- **`Client#query` and `#run` take `headers:`.** A beat that attacks with a request header — a declared clock, or a source an operator must not read one from — could not send one.
+- **`Scenarios::TokenTampering` probes a verb the origin actually ROUTES.** It used to dial a made-up name, which an origin drawing one explicit route per verb answers with a routing 404 — decided before any credential is read — so the beat scored a refusal the auth check never made. It now dials the profile's `per_user_query`, and SKIPS with a sentence when a profile declares none rather than certifying a check that did not run.
+- **`Scenarios::WrongCurrencyCart` — the cashier check that was hand-copied into three demos.** `kiosk-server` verifies that intent, cart and payment agree with each other; it has no opinion about what those agreeing numbers MEAN, because the catalogue is the operator's. So a cart whose every link says the same foreign currency is internally perfect and still has to be refused at capture, or a caller sets the unit of account. The three commerce demos each carried a byte-identical local scenario asserting it, with the currencies written into the source; the gem's version reads the operator's own from the new `Profile#currency` and probes with a currency that is NOT it, so an origin that prices in dollars is not probed with dollars and cannot print BLOCKED for a cart that was never foreign.
+
+- **`Wire` and `Battery` — the half of a red-team suite that was not in the gem.** A provider's battery is never all library: the interesting attacks are on that provider's own verbs, and until now writing them meant hand-rolling an HTTP helper, a result ledger, a printed vocabulary and an exit block beside the gem rather than on top of it. `Wire` is the raw wire an attack on the REQUEST needs — arbitrary method, arbitrary path, arbitrary headers, response headers readable, a non-JSON body reading as `{}` and an unreachable origin as status `0` so a hostile answer is asserted on instead of crashing the run. `Battery` is one ledger for hand-written beats and library scenarios together, printing both in one vocabulary and answering one exit status: 0 only when at least one attack ran and every attack that ran was blocked, 1 on a breach or on a battery that proved nothing, 2 when the skips are not the ones the caller expected. `on_skip: :breach` files a skip as a finding for a scenario whose surface this origin definitely has.
+
+- **`LeakScan` — the leak oracle every hostile-input beat asks, made a function of what the APP said rather than of what the ATTACKER sent (T-121).** Each demo's battery asserts that a refusal carries no runtime vocabulary by substring-searching the serialized body for `PG::`, `NoMethodError` and their siblings, while every demo answers a bad argument by NAMING the value it got — so a probe whose value spelled a needle would have been reported as a BREACH on its own echoed bytes, under runners whose own prose tells the reader a BREACH means «fix the app, not the scenario». The scan is POSITIONAL rather than subtractive: it records where the probe's own value occurs in the body and discounts a needle only when those exact bytes lie wholly inside ONE such run. A `gsub` of the supplied value was rejected and the reason is executable in the spec — it deletes by value everywhere, so a probe supplying `input syntax` erases the needle out of a genuine `invalid input syntax` leak, which is a false NEGATIVE where the defect being fixed only ever produced false positives. Discounted needles are REPORTED rather than swallowed, because when a probe supplies a needle verbatim no content-only oracle can separate it from one the app produced; and `supplied:` defaults to nothing, so a beat that forgets to declare degrades to the old behaviour — a possible false BREACH, never a missed leak.
+
+- **`Scenarios::DeviceGrantRoleSelfSelection` — the account-binding claim ceremony's role beat, for every provider (K-1128).** `PrivilegeSelfSelection` covers `/auth/register`, where the role was never client-readable; the door that was actually open was the UNAUTHENTICATED `POST <endpoint>/oauth/device_authorization`, whose `role`/`scope` reached the minted JWT with membership of `config.roles` as the only filter (K-072). The new scenario asserts that request refuses both spellings — at a role the origin genuinely DECLARES, which is the probe with teeth, since an invented one was refused by the vulnerable code too and is why a battery could print BLOCKED over a live escalation for nineteen days — while the role-less request still opens the ceremony. It reads a declared role off the wire (the `role` claim of a token the origin itself mints at registration) as well as from the new `Profile#declared_roles`, so a stale profile weakens the probe rather than emptying it. `Client#device_authorization` is the form-encoded driver it needs; the OAuth half of the ceremony answers RFC 6749 `{error, error_description}` rather than a Kiosk problem document, so `Redteam.blocked?` cannot judge it and the scenario names the status and error value it demands.
+
+- `Kiosk::Redteam::Client` — HTTP client for the wire surface an attacker sees: agent register/login (solving the Equihash registration toll), KYC attestation, and the `query` / `run` / `pay` verbs with RS256 mandate signing.
+- `Kiosk::Redteam::Scenario` / `Verdict` / `Runner` — the harness. A scenario runs one hostile flow and returns a `Verdict` (blocked / skipped, status, detail); a scenario that finds a real breach fails loudly rather than reporting a pass.
+- `Kiosk::Redteam::Principal` / `Response` — the value types scenarios work with: a registered agent identity carrying its RSA key so mandates can be signed or forged, and a parsed HTTP response.
+- `Kiosk::Redteam::Profile` — per-provider parameterisation (PoW difficulty, KYC requirement, the queries and actions to attack, mandate builders), so one scenario library runs against any Kiosk provider.
+- Generic attack scenario library: cross-tenant read, forged user id, privilege self-selection, mandate principal swap, mandate replay, token tampering, missing / expired / forged KYC, unpaid gated action, pay-for-other-use-self, spent-resource reuse, and registration without PoW.
+- `base64` declared as a runtime dependency — `scenario.rb` and `scenarios/privilege_self_selection.rb` require it at load time, and until then it arrived only by accident, as a transitive dependency of `jwt` (it stopped being a default gem in Ruby 3.4).
+
+### Changed
+
+- **The verdict headers stop sending a reader to an INDETERMINATE state this gem never had.** There are three verdicts; an answer that proved nothing is told by its `detail`, not by a fourth.
+
+- **The rubygems blurb stops listing HTTP 402 among the statuses that constitute a block.** The predicate, the README and `verdict_from` dropped 402 long ago; the blurb is read first.
+
+- **`Scenarios::WrongCurrencyCart` names `403` instead of delegating to `blocked?`.** Delegating admitted a `401`, which says the credential was rejected rather than that the cashier refused the cart — a refusal scored for an attack that never reached the counter. Same reason the gem already declines to delegate a bare `402`.
+
+- README: every `gem` line in the install section now carries `github: "kiosk-hq/kiosk"`, so a copied line resolves before publication; the banner above them states what the block does rather than asking the reader to add it.
+- The `pow_required` explanation and the device-grant scenario's
+  control-registration refusal, both printed by a battery run, now say what the
+  condition is instead of naming an internal tracker row.
+- **A TOLLED VERB CAN NOW BE ATTACKED (K-760).** `#query`, `#run`, `#pay` and `#pay_raw` route their answer through one shared, bounded 402-PoW retry — the same `Client#with_pow_retry` registration uses — instead of leaving the solve branch inlined in `#register_raw` where only registration could reach it. A toll is a price, not a refusal (K-736), so an attacker pays it; a harness that could not pay it could not run the attack at all. Measured against getgrocery with its catalog toll ON (`KIOSK_POW_DEMO=1`): before, the battery ABORTED on its first scenario (`catalog returned empty`) and produced no verdicts; after, 17 BLOCKED / 3 SKIPPED / 0 BREACH, byte-identical to the untolled run. Exactly ONE solve-and-resend per call, never a loop: a re-demanded toll comes back flagged `pow_retried` and reads as a could-not-test verdict that says the toll was already paid, which is a statement about the provider rather than about this gem. The retry re-sends the IDENTICAL request — `#pay` signs its mandates once and reuses the body, because the challenge binds to a fingerprint of method + verb + body and a re-signed mandate would be a different request.
+
+- The client speaks protocol 0.4: `#query` is `GET <endpoint>/<query-name>` with its arguments in the query string, `#run` is `POST <endpoint>/<action-name>` with the arguments as the whole body, and there is no `name` field on the wire. Error codes are read off the top level of an RFC 9457 problem document rather than out of the retired `error` envelope.
+
+- **A BLOCKED verdict now names the gate it proved.** `verdict_from` takes `expect:` / `expect_code:`, so a scenario demands the status and denial code that constitute a refusal of ITS attack instead of accepting any of 401/402/403 interchangeably; the Runner prints the status on the BLOCKED line, and `all_blocked?` refuses to go green on a battery in which nothing was exercised. What a green battery means is stricter than it was: verdicts that used to pass on an unrelated gate's refusal, on a crash, or on a query that was never answered now fail.
+- The registration gate the client solves is Equihash, not the SHA256 hashcash the first version assumed — client, docstrings and gemspec now describe the shipped gate, and the dead hashcash helper is gone.
+- The proof travels in a `Kiosk-PoW` request header as raw JSON rather than as a body field.
+- `jwt` widened to `>= 2.0, < 4.0` so hosts on jwt 3.x can run the harness.
+
+### Fixed
+
+- `Scenario#rows_from` read only the paginated `{rows:, next:}` shape, so a non-paginating query's BARE ARRAY answer — the ordinary one on the 0.4 wire — decoded as no rows at all. `ForgedUserId`'s ownership check would then have read "not leaked" and scored a **vacuous BLOCKED** against an origin it never tested.
+- `ForgedUserId#extract_id` read the deleted 0.3 `value` wrapper, so on any real origin it found no resource id and every run ended "cannot confirm ownership was enforced".
+- `ForgedUserId` now scores the typed `400 bad_request` a 0.4 origin answers — the refusal that NAMES the injected `user_id`, because a verb whose principal comes from the token does not declare it — as BLOCKED. Without that branch the scenario reported a BREACH against a provider doing exactly the right thing. The check is in the scenario, not in `blocked?`: what makes this 400 evidence is that it names the property we injected, which a generic predicate cannot see.
+
+- Six ways a scenario could report a pass it had not earned: `CrossTenantRead` scored a 404/402/500 on B's query as isolation and had no control proving the query returns anything for its owner; the two registration scenarios passed against a server that 404s every path; the KYC scenarios discarded the payment they staged, so the payment gate answered in the KYC gate's name; `PayForOtherUseSelf` reported a card decline or an expired token as the ownership gate and never attempted the attack; and an all-skip battery exited 0. Each now asserts what it staged and names the gate it demands.
+- A crash can no longer masquerade as enforcement through the denial-code path: `Kiosk::Redteam.blocked?` applies its 5xx/connection-error rule to the `error.code` branch as well, which had none.
+- Neither can a toll: `blocked?` counted a bare HTTP 402 as "explicit auth/authz rejection" although kiosk-server shares that status between `pow_required`, `payment_setup_required` and `payment_failed` — so a tolled verb printed `BLOCKED ✓ … (HTTP 402)` for an attack the harness never ran, since it solves proof-of-work only during registration. A 402 (and a `pow_required` envelope on any status) now yields a could-not-test verdict that names which of the three answered and fails the battery instead of passing it; a scenario that genuinely means a payment gate names the code it accepts with `verdict_from(expect_code:)`.
+- A skipped scenario reports a real skipped state instead of a pass, an inapplicable scenario is asserted as such, and `bad_request` no longer counts as "blocked" — three ways the harness could previously report green without having proved anything.
+- The client locates the Equihash solver through `Kiosk::Pow::Equihash.solver_path`, with `kiosk-pow-equihash` now a declared runtime dependency — the previous monorepo-relative filesystem reach meant an installed `kiosk-redteam` raised `Errno::ENOENT` the first time a scenario had to solve a registration challenge.
+

data/LICENSE.txt

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

data/README.md

@@ -0,0 +1,247 @@
+# kiosk-redteam
+
+Adversarial regression harness for [Kiosk](https://kiosk.tech) providers — it
+drives hostile HTTP scenarios against a running Kiosk origin and asserts each
+attack is correctly blocked.
+
+## What it does
+
+A scenario registers its own principals over the wire, stages whatever state the
+attack needs, then performs the attack and returns a `Verdict`. A scenario that
+finds a real breach fails loudly: `Battery#report!` answers 1 and the
+caller exits non-zero. Fix the provider, keep the scenario as a permanent
+regression.
+
+**No Rails.** The harness speaks the wire and nothing else, so
+it can be pointed at any Kiosk origin — your own app in CI, or a third party's
+deployment. Everything provider-specific (which verbs exist, how to create an
+owned row, how to build a mandate) lives in a `Profile` you supply; no provider
+name is hard-coded in the gem.
+
+**`http` or `https` is decided by the base URL you pass and by nothing else.**
+There is no TLS flag and no environment variable: the scenarios attack through
+`Kiosk::TestHelpers::Assistant` and `Kiosk::TestHelpers::Wire` from
+`kiosk-test-support`, which read the scheme off the target. So `base_url:
+"http://127.0.0.1:3000"` is a local app and `base_url:
+"https://example.com"` is that deployment, with the same code and the same
+profile. Point it at a deployment you do not own and remember what a battery
+is: scenarios REGISTER principals and STAGE the state their attack needs, so
+run it against something you are willing to have written to.
+
+### Blocked, breached, untested, skipped — the four states
+
+| Verdict | Means | Printed |
+|---|---|---|
+| **blocked** | the provider refused this attack | `BLOCKED ✓ <name> (HTTP <status>)` |
+| **breach** | the attack was NOT refused — a real finding | `BREACH  ✗ <name> — <detail>` |
+| **untested** | a setup step or the environment failed, so the attack never reached its gate | `UNTESTED ! <name> — <detail>` |
+| **skipped** | the profile lacks the surface this scenario needs | `SKIP    — <name> (<reason>)` |
+
+An untested attack is **not** a pass and **not** a breach: `Battery#report!`
+answers 1, and the detail names the step that failed. A payment processor the
+origin cannot reach gives this state: the origin answers `payment_setup_required`
+before it reads the mandates. A skip does not count towards the blocked total,
+and `Battery#report!` refuses to go green on a battery that produced no proofs
+at all, so a profile that skips everything cannot exit 0.
+
+What counts as a refusal is deliberately narrow. HTTP 401/403 count, and so do
+the problem document `code`s `forbidden` / `unauthenticated` / `rls_denied`.
+**5xx never counts** — a crash must not masquerade as an enforcement gate. Nor
+does **402**: `kiosk-server` maps three codes onto that status
+(`pow_required`, `payment_setup_required`, `payment_failed`) and none of them is
+a refusal of the attack. The origin answers `pow_required` and
+`payment_setup_required` before it evaluates the request, so they give an
+untested verdict unless the scenario named the code it accepts. A
+`payment_failed` comes after every gate said yes, so it is a breach. A scenario that knows which gate must fire
+says so with `expect:` / `expect_code:` rather than leaning on the permissive
+default.
+
+## Install
+
+> **Not on RubyGems yet** — so every `gem` line below carries `github: "kiosk-hq/kiosk"`, which is what makes it copy-pasteable today. Publication status and the canonical install are stated once, in the monorepo README's [Install](https://github.com/kiosk-hq/kiosk#install) section.
+
+```ruby
+# Gemfile — a test/CI dependency, not a runtime one
+gem "kiosk-redteam", github: "kiosk-hq/kiosk", group: :development
+```
+
+The registration toll is real Equihash: the assistant client solves the server's
+402 challenges with the reference solver that ships inside `kiosk-pow-equihash`,
+so the machine running the battery needs **`python3` with `numpy`** on `PATH`. Point a battery at an
+origin whose PoW is off and nothing is solved and nothing is needed.
+
+## Usage
+
+Describe the provider once, hand the runner a list of scenarios, exit on the
+verdict:
+
+```ruby
+require "kiosk/redteam"
+
+SERVER = ENV.fetch("SERVER_URL", "http://127.0.0.1:3000")
+
+profile = Kiosk::Redteam::Profile.new(
+  # >0 means this origin is expected to gate /auth/register with a toll.
+  pow_difficulty: 1,
+  # The roles this origin declares (Kiosk.configuration.roles), as strings.
+  declared_roles: %w[customer],
+  # The named query that returns the caller's OWN rows.
+  per_user_query: "my_orders",
+  # Key in a returned row that holds the row id, and in an action's own
+  # response object (they often differ).
+  row_id_key:     "id",
+  result_id_key:  "order_id",
+  # Create a row owned by `principal`; must return a Hash with at least :id.
+  create_owned:   ->(client, principal) {
+    resp = client.run(principal, name: "create_order", items: [{ sku: "SKU-1", qty: 1 }])
+    raise "create_order failed (#{resp.status}): #{resp.body.inspect}" unless resp.status == 200
+    { id: resp.body.fetch("order_id") }
+  },
+  # An action that takes a `user_id` argument the server must NOT honour.
+  forge_action:   "create_order",
+  forge_args:     ->(_client, _a, _b) { { items: [{ sku: "SKU-1", qty: 1 }] } },
+)
+
+runner  = Kiosk::Redteam::Runner.new(base_url: SERVER, profile:)
+battery = Kiosk::Redteam::Battery.new
+battery.absorb(runner.run([
+  Kiosk::Redteam::Scenarios::CrossTenantRead.new,
+  Kiosk::Redteam::Scenarios::ForgedUserId.new,
+  Kiosk::Redteam::Scenarios::TokenTampering.new,
+  Kiosk::Redteam::Scenarios::RegistrationWithoutPow.new,
+  Kiosk::Redteam::Scenarios::DeviceGrantRoleSelfSelection.new,
+]))
+
+exit battery.report!
+```
+
+Every field of `Profile` is optional; a scenario whose field is `nil` skips
+itself rather than inventing a surface. That is what lets one battery cover a
+commerce provider and a non-commerce one. `suites/` holds one battery per
+operator demo in this repo, built on this API — read one of those for a worked,
+running profile against a real origin. Each runs in its demo's directory, with
+that demo's bundle. A demo that takes payments charges a stripe-mock: start the
+demo's server with `STRIPE_MOCK_URL` set to the URL of a running
+`Kiosk::TestHelpers::StripeMock` relay, as CI does. stripe-mock alone answers
+each charge as unpaid. When the server cannot reach the relay, the payment
+attacks are untested.
+
+## The scenario library
+
+The classes under `Kiosk::Redteam::Scenarios`, each parameterised entirely by
+the profile — this is the whole library. `lib/kiosk/redteam/scenarios/` has one
+file per row, plus `kyc_attack.rb`, the `KycAttack` module that the KYC
+scenarios share:
+
+| Scenario | Asserts |
+|---|---|
+| `CrossTenantRead` | B's per-user query must not return rows owned by A |
+| `ForgedUserId` | a caller-supplied `user_id` never decides ownership |
+| `PrivilegeSelfSelection` | a client-chosen registration role is ignored — the role is server-pinned |
+| `DeviceGrantRoleSelfSelection` | the claim ceremony's unauthenticated opening request refuses `role`/`scope`, at a DECLARED value as well as an invented one |
+| `SpentResourceReuse` | a consumed resource cannot be re-activated |
+| `PayForOtherUseSelf` | B paying for A's resource does not let B use it |
+| `TokenTampering` | a JWT with a flipped claim and the original signature is 401 |
+| `RegistrationWithoutPow` | a missing or bad proof is rejected when the origin charges a toll |
+| `MandatePrincipalSwap` | B signing a mandate that carries A's identity is rejected |
+| `MandateReplay` | A's signed mandate JWS re-submitted under B's token is rejected |
+| `UnpaidGatedAction` | the gated action without a prior settled payment is denied |
+| `WrongCurrencyCart` | a chain-consistent cart denominated in a currency the operator does not price in is refused at capture |
+| `MissingKyc` | the gated action after payment but without an attestation is denied |
+| `ExpiredKyc` | an attestation whose `exp` has passed is rejected |
+| `ForgedKyc` | an attestation with a wrong issuer or a bad signature is rejected |
+
+Beside them the gem ships `Profile`, `Scenario`, `Verdict`, `Runner`,
+`Battery` and `LeakScan`, which decides whether a refusal leaked the runtime's
+own vocabulary, discounting needles the attack itself supplied. A scenario
+receives a `Kiosk::TestHelpers::Assistant` — register, query, run, pay with
+signed mandates, kyc, and the device-authorization request — and its
+`events(principal)` is the assistant's side of `<endpoint>/events`.
+
+## Your own beats, in the same battery
+
+No provider's battery is all library. The scenarios above are the attacks every
+Kiosk origin has to survive; the interesting half is always the attacks on
+*your* verbs — your enum filters, your price arithmetic, your ownership joins.
+Two classes carry that half, and they are the reason a hand-written beat and a
+library scenario can sit in one run.
+
+`Kiosk::TestHelpers::Wire` is the raw wire: an arbitrary method at an arbitrary path with arbitrary
+headers, which is what an attack on the REQUEST rather than on the principal
+needs — a forged or absent `Authorization`, a verb nobody registered, the wrong
+method at a real verb's path, an assertion on `Allow:` rather than on a body. A
+body that is not JSON reads as `{}` and a connection error reads as status `0`,
+so a hostile answer is asserted on instead of crashing the run; the bytes stay
+available on `raw_body` for a `LeakScan`.
+
+`Battery` is one ledger, one printed vocabulary and one exit status for the
+whole run — hand-written beats and library scenarios together:
+
+```ruby
+wire    = Kiosk::TestHelpers::Wire.new(base_url: SERVER)
+client  = Kiosk::TestHelpers::Assistant.new(base_url: SERVER)
+battery = Kiosk::Redteam::Battery.new
+
+# your own beat, against your own verb
+status, rows = wire.get_json("/kiosk/my_listings", {}, wire.bearer(bob.token))
+battery.record("CrossTenantRead", status == 200 && !ids(rows).include?(alice_row),
+               "Bob's rows #{ids(rows).inspect} exclude Alice's #{alice_row}")
+
+# a library scenario, in the same ledger
+battery.scenario(Kiosk::Redteam::Scenarios::DeviceGrantRoleSelfSelection.new,
+                 client:, profile:, on_skip: :breach)
+
+# a whole Runner battery, in the same ledger
+battery.absorb(runner.run(scenarios))
+
+exit battery.report!(expected_skips: %w[MissingKyc ExpiredKyc])
+```
+
+`report!` prints the summary, returns the process exit status and never lets a
+run that proved nothing read as green: **0** when at least one attack ran and
+every attack that ran was blocked, **1** on a breach, on an untested attack or
+on a battery with no proofs at all, **2** when every attack that ran was
+blocked but the set of skips is not `expected_skips` — a profile key that silently went `nil` disables a gate
+scenario, and that must not pass as a clean run.
+
+Pass `on_skip: :breach` for a scenario whose surface this origin definitely
+has: there, a skip is a defect of the harness rather than a property of the
+provider, and a quiet skip is how a beat that stopped running goes unnoticed.
+
+Pass `untested: true` to `record` when a setup step of your beat failed. The
+attack did not reach its gate, so the beat is UNTESTED and the run fails with
+no BREACH.
+
+### Writing your own
+
+Subclass `Scenario`, name what you are attacking, and return a `Verdict` that
+says which gate you demanded:
+
+```ruby
+class UnknownVerbIs404 < Kiosk::Redteam::Scenario
+  def initialize
+    super(name: "UnknownVerbIs404")
+  end
+
+  def call(client, profile)
+    principal = client.register!
+    verdict_from(client.query(principal, name: "no_such_verb"), expect: 404)
+  end
+end
+```
+
+## Status
+
+Pre-v1.0 alpha. The `Scenario` / `Profile` / `Verdict` surface is stable across
+pre-v1.0 minor bumps; the scenario library grows as gates are added
+(`CHANGELOG.md` tracks).
+
+## License
+
+Apache-2.0 — see `LICENSE.txt`.
+
+## Links
+
+- [kiosk.tech](https://kiosk.tech) — landing + docs
+- [Specification](https://kiosk.tech/specification.html) — the normative spec
+- [Issue tracker](https://github.com/kiosk-hq/kiosk/issues)