@clear-capabilities/agentic-security-scanner 0.163.1 → 0.165.0

package/CHANGELOG.md

@@ -9,6 +9,30 @@
 > make the history less accurate, not more.
 
 
+## 0.165.0 - Linux process-count cap proved on a hosted runner; the execution suites run on Linux
+
+**The process-count cap works on Linux and is proved.** The cap was never applied before because the resource prelude ran under `dash`, which has no `ulimit -u`. The namespace backend now applies it with `prlimit --nproc` to the task's command only, after the confinement is built. On the hosted x86_64 `sandbox-linux` job, six concurrent children all start under a cap of 512 and only one starts under a cap of 3, in default mode and in capability mode. The probe is paired with fault injection: it fails against a runner that drops the cap and against one that caps everything. A requested cap is never silently dropped; a host without `prlimit` reports it unsupported. `process-cap` is verified for Linux only after that hosted result, and stays unverified on macOS.
+
+**The execution suites now run on Linux with Linux semantics, with no skips.** The capabilities, trust-boundary and attack-corpus suites assert ENOENT or EROFS evidence for out-of-root access instead of macOS-style denial, use heartbeats instead of host pids for liveness, and expect a declared network destination to block the task. No assertion was weakened. A skip in the trust-boundary suite is gone. The hosted `sandbox-linux` job now also runs the capabilities, verification, invariants, documentation, trust-boundary and evidence-issuer suites and fails on any skip: 737 tests ran and passed, 0 skipped, 0 failed.
+
+**A responsiveness defect found by the hosted run.** The supervisor's periodic synchronous `ps` sweep kept the controller's event loop 58 to 62 percent busy on Linux. It is off for the namespace backend, where the kernel already kills the namespace with its supervisor.
+
+**Still open.** The hosted release leg still runs only the static closure: running the full closure there has never been timed on a hosted runner and would duplicate the test shards. Mediated network remains unsupported on Linux. The process-count behaviour was checked on kernel 6.8 only; older kernels count the limit per real uid system-wide, so a small cap could behave differently. The real-code accuracy gates and the routing promotion gate still need independently adjudicated data that code cannot produce, so the PRD closure verification still reports not complete.
+
+## 0.164.0 - Linux isolation proved on a hosted runner, six controller limits enforced, closure evidence from CI
+
+Closing gaps from the Differentiation PRD that software can close. The gaps that remain are named at the end; none of them is hidden by this release.
+
+**Linux isolation controls, proved on a real hosted Linux runner.** The namespace backend now implements capability mode: a tmpfs root holding only the runtime baseline and the declared roots (read roots read-only, write roots read-write, protected paths absent or masked), entered with `pivot_root`, inside a PID namespace created with `--kill-child` so that when the supervisor or init dies every descendant dies, and an empty network namespace for tasks that declare no network. The hosted `sandbox-linux` job (x86_64 `ubuntu-latest`) now fails loudly if the namespace suites skip or any required control is not proved, and proved all of these with active probes, each paired with a positive control and a fault-injection counterpart that must fail against a deliberately wrong runner: write confinement, read denial, environment scrub, network blocking, file-size limit, filesystem read confinement (direct, through a symlink, through `..`, and from a descendant), multi-root write, PID-namespace isolation, tree termination across four process shapes including a double-forked `setsid` member (which the macOS backend cannot stop), reaping after a SIGKILL of the supervisor and of the init, masking of protected files, and network in capability mode. Linux is recorded as `partially-verified` on exactly that evidence. **Not proved and stated as such:** mediated network (unsupported on Linux: a task that declares a destination is blocked, never allowed), process-count caps, the full attack corpus, and the oracle adapters' Linux status; the capabilities execution suites still skip on Linux because they encode macOS semantics.
+
+**The process-cap mystery is explained.** The Linux resource prelude runs under `dash`, whose `ulimit` has no `-u` (`ulimit: Illegal option -u` is in the hosted log), so a process-count cap was never applied on Linux, which is why a cap of 1 did not refuse in 0.162.0. The cap stays unasserted until a replacement is proved.
+
+**Six controller limits that were listed as unenforced are enforced**, each removed from the profile's `unenforced` list only after a boundary test passed in both directions: subprocess wall time (a process-group runner with TERM, a grace period, KILL, then a sweep, so a hung child cannot outlive its bound), network request time and retries with a capped backoff, a separately metered provider and infrastructure spend envelope (off unless a person preauthorizes it), an upper-bound reserve for unknown billing (never zero), per-class suite ceilings, and per-child leases inside each suite wrapper (a hung test file is named and killed while later files still run). Two entries remain: Linux enforcement of the controller's own limits, and the documentation-only note that budgets are caps, not authorization.
+
+**Closure evidence from CI.** `scripts/release-closure.mjs --attest-from-ci` reads the hosted check runs for the exact commit and attests the two remote prerequisites (the Haskell toolchain job and both NixOS runtime legs) only when each job ran for that commit and succeeded, with no failed step beyond those the plan tolerates. Anything else (wrong commit, in progress, skipped, cancelled, partial matrix, `gh` unavailable) produces no attestation and a typed reason. Checked against real GitHub: attested for the 0.163.1 commit, refused for a commit that never ran CI and for a malformed sha. `ship.mjs` prints the result as information after a release; it never gates or undoes one.
+
+**Still open, and why.** The PRD's real-code accuracy gates (per-language F1 of at least 0.80 on sealed, independently adjudicated data with at least 100 positives per language) and the routing promotion gate (at least 200 paired adjudicated tasks) cannot be met because no such population exists and independent human adjudication cannot be produced by code; they read `unmeasured` and every figure this programme has produced on its own fixtures is synthetic and labelled so. The PRD's closure verification therefore still reports not complete.
+
 ## 0.163.1 - a regular expression's `.exec()` on request data is no longer reported as command injection
 
 The taint engine treated any call named `exec` as a command-execution sink regardless of its receiver, so `SEMVER.exec(req.query.v)` or `/^(\d+)/.exec(req.query.w)` produced a high-severity CWE-78 finding. Regular-expression matching on request data is everywhere in JavaScript, so this was a high-volume false positive (disclosed as a known issue in 0.163.0, present since at least 0.161.0).

package/dist/9560.index.js

@@ -373,8 +373,8 @@ const MANIFEST_REQUIRED = ['schema', 'schemaVersion', 'taskId', 'repository', 'p
 
 // Resource limits a manifest can carry. The first three come straight from the
 // assurance config (same ranges), the file-size cap is enforced by the sandbox
-// prelude, and the last two are CARRIED but never claimed enforced: see
-// `RESOURCE_ENFORCEMENT` in runner.js.
+// prelude, the process-count cap is enforced on the Linux namespace backend only (prlimit, proved by an
+// active probe), and the memory cap is CARRIED but never claimed enforced.
 const RESOURCE_RANGES = Object.freeze({
   timeoutMs: { min: config/* LIMITS */.b1.timeoutMs.min, max: config/* LIMITS */.b1.timeoutMs.max },
   maxOutputBytes: { min: config/* LIMITS */.b1.maxOutputBytes.min, max: config/* LIMITS */.b1.maxOutputBytes.max },
@@ -1372,15 +1372,18 @@ function mk(prefix) { return fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(
 function rm(p) { try { fs.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } }
 const token = (p) => `${p}-${crypto.randomBytes(8).toString('hex')}`;
 
-async function probeFsRead(backend) {
-  if (backend !== 'userspace') return unsupported(`read confinement to declared roots is not implemented on the ${backend} backend`);
+// `run` is a seam so a test can hand the probe a runner that is deliberately
+// wrong (a read root left too wide, a root left writable) and see the probe say
+// so: a probe that cannot fail proves nothing.
+async function probeFsRead(backend, runner = runConfinedSupervised) {
+  if (backend !== 'userspace' && backend !== 'namespace') return unsupported(`read confinement to declared roots is not implemented on the ${backend} backend`);
   const root = mk('agsec-cap-r-'); const ro = mk('agsec-cap-ro-'); const outside = mk('agsec-cap-out-');
   try {
     const okTok = token('READABLE'); const secTok = token('SEALED');
     fs.writeFileSync(path.join(ro, 'r.txt'), okTok);
     fs.writeFileSync(path.join(outside, 's.txt'), secTok);
     fs.symlinkSync(path.join(outside, 's.txt'), path.join(ro, 'link'));
-    const run = (script, readRoots) => runConfinedSupervised(['/bin/sh', '-c', script], { root, readRoots, timeoutMs: 8000, graceMs: 300 });
+    const run = (script, readRoots) => runner(['/bin/sh', '-c', script], { root, readRoots, timeoutMs: 8000, graceMs: 300 });
     const pos = await run(`cat '${ro}/r.txt'`, [ro]);
     if (!pos.stdout.includes(okTok)) return notProved(`positive control failed: a file inside a declared root was not readable (${pos.status})`);
     const open = await run(`cat '${outside}/s.txt'`, [ro, outside]);
@@ -1399,13 +1402,13 @@ async function probeFsRead(backend) {
   } finally { rm(root); rm(ro); rm(outside); }
 }
 
-async function probeMultiWrite(backend) {
-  if (backend !== 'userspace') return unsupported(`several declared write roots are not implemented on the ${backend} backend`);
+async function probeMultiWrite(backend, runner = runConfinedSupervised) {
+  if (backend !== 'userspace' && backend !== 'namespace') return unsupported(`several declared write roots are not implemented on the ${backend} backend`);
   const root = mk('agsec-cap-w-'); const w1 = mk('agsec-cap-w1-'); const w2 = mk('agsec-cap-w2-');
   const ro = mk('agsec-cap-wro-'); const outside = mk('agsec-cap-wout-');
   try {
     const script = [`echo a > '${w1}/f'`, `echo b > '${w2}/f'`, `echo c > '${ro}/f'`, `echo d > '${outside}/f'`, 'true'].join('; ');
-    await runConfinedSupervised(['/bin/sh', '-c', script], { root, readRoots: [ro], writeRoots: [w1, w2], timeoutMs: 8000, graceMs: 300 });
+    await runner(['/bin/sh', '-c', script], { root, readRoots: [ro], writeRoots: [w1, w2], timeoutMs: 8000, graceMs: 300 });
     if (!fs.existsSync(path.join(w1, 'f')) || !fs.existsSync(path.join(w2, 'f'))) return notProved('positive control failed: a declared write root was not writable');
     if (fs.existsSync(path.join(ro, 'f'))) return notProved('a root declared read-only was writable');
     if (fs.existsSync(path.join(outside, 'f'))) return notProved('an undeclared directory was writable');
@@ -1521,8 +1524,19 @@ function isAdvertisedBackend(backend, platform = process.platform) {
 function platformStatements() {
   return Object.freeze({
     linux: {
-      backend: 'namespace', status: 'unverified',
-      note: 'advertised for enforced mode, but the control probes in this module have not run on a Linux host from this workspace. Several controls are not implemented on the namespace backend (read confinement to declared roots, several write roots, mediated network, supervised tree termination), so enforced mode is blocked there until they are implemented and the sandbox-linux job shows them proved. Process-count caps are never claimed.',
+      backend: 'namespace', status: 'partially-verified',
+      // Evidence is the hosted sandbox-linux CI job (ubuntu-latest, x86_64), whose active probes
+      // (attack plus positive control, with fault-injection counterparts) proved these controls.
+      // Anything not listed here is not claimed: a verified control is verified on that runner image
+      // and kernel, not on every Linux host, which is why the job runs on every push.
+      evidence: 'sandbox-linux CI job (hosted ubuntu-latest, x86_64); scripts/sandbox-linux-verify.mjs',
+      verifiedControls: Object.freeze([
+        'write-confinement', 'read-denial', 'env-scrub', 'network', 'tree-termination', 'file-size-limit',
+        'fs-read-confinement', 'fs-multi-root-write', 'process-cap',
+      ]),
+      unsupportedControls: Object.freeze(['network-mediation']),
+      unassertedControls: Object.freeze([]),
+      note: 'advertised for enforced mode. Proved by active probes on the hosted Linux runner (not on every Linux host): write-confinement, read-denial, env-scrub, network, tree-termination, file-size-limit, fs-read-confinement, fs-multi-root-write, process-cap (a per-user-namespace process-count cap applied with prlimit after the confinement is built; the shell ulimit it replaces does not exist in dash). Mediated network is NOT implemented on the namespace backend (an empty network namespace has no path to a proxy), so a task that declares a network destination is blocked on Linux, never allowed. Process-count caps are claimed on Linux only, and only as that probe shows them; memory caps are not enforced. The attack corpus is not run in the sandbox-linux job, so corpus coverage stays unverified on Linux.',
     },
     darwin: {
       backend: 'userspace', status: 'host-proved-not-advertised',