gemstack-ai 1.4.0 → 2.0.0

package/specs/011-gemstack-2.0-hardening/plan.md

@@ -0,0 +1,210 @@
+# Plan Técnico de Implementación: Gemstack 2.0 Hardening (Sprint A)
+
+**Feature Branch**: `011-gemstack-2.0-hardening`  
+**Feature Directory**: `specs/011-gemstack-2.0-hardening/`  
+**Lifecycle Status**: `PLAN_COMPLETE`  
+**Stop Reason**: `PLAN_COMPLETE_AWAITING_TASKS`
+
+---
+
+## 1. Arquitectura Técnica y Módulos Afectados
+
+Sprint A implementa el endurecimiento de fronteras de confianza sobre los siguientes subsistemas:
+
+1. **`src/lib/filesystem-safe.js`**:
+   - Incorpora función `resolveSafeStrict(rootDir, targetPath, options = { allowCreate: false })`.
+   - Resuelve el camino físico real de `rootDir` y de los componentes existentes de `targetPath` usando `fs.realpathSync`.
+   - Si cualquier componente intermedio existente o el destino resuelve fuera del límite canónico de `rootDir`, lanza un error con código `SYMLINK_ESCAPE_DETECTED`.
+   - Incorpora `withConfinedAtomicWrite(rootDir, targetPath, writeFn)`:
+     - Asegura que el archivo temporal se aloje dentro de `path.join(rootDir, '.gemstack', 'tmp')`.
+     - Ejecuta la escritura y renombra atómicamente al destino verificado (`fs.renameSync`).
+
+2. **`src/commands/install.js`**:
+   - Valida el esquema URL: rechaza todo lo que no sea `https:` (`INSECURE_HTTP_BLOCKED`).
+   - Resuelve hostname e IP antes de conectar o rechaza hostnames literales/IPs privadas (`127.0.0.1`, `localhost`, `::1`, `10.0.0.0/8`, `192.168.0.0/16`, `172.16.0.0/12`, `169.254.0.0/16`) con `PRIVATE_IP_BLOCKED`.
+   - Aplica timeout estricto de 8000ms mediante `AbortController`.
+   - Controla el tamaño en streaming: acumula hasta 262,144 bytes; si se excede, aborta inmediatamente con `SKILL_PAYLOAD_TOO_LARGE`.
+   - Valida el slug del skill mediante regex `^[a-z0-9][a-z0-9-_]{1,63}$` (`INVALID_SKILL_SLUG`).
+   - Extrae frontmatter y calcula digest SHA-256 en memoria antes de persistir.
+
+3. **`src/commands/hooks.js`**:
+   - Inspecciona `.git/hooks/pre-commit`.
+   - Si ya existe y no tiene la firma de Gemstack, renombra el hook existente a `.git/hooks/pre-commit.gemstack-wrapped` y crea un dispatcher que ejecuta secuencialmente el hook del usuario y la validación de Gemstack.
+   - Si falla el hook del usuario, el commit se detiene; si pasa, se ejecuta el escáner de Gemstack.
+   - Expande los patrones de detección de secretos a:
+     - Google Gemini: `AIza[0-9A-Za-z-_]{35}`
+     - OpenAI: `sk-[a-zA-Z0-9]{20,}` y `sk-proj-[a-zA-Z0-9_-]{20,}`
+     - Anthropic: `sk-ant-[a-zA-Z0-9_-]{20,}`
+     - GitHub PAT: `ghp_[0-9a-zA-Z]{36}`, `github_pat_[0-9a-zA-Z_]{22,}`
+     - Slack: `xox[baprs]-[0-9a-zA-Z-]{10,}`
+     - Claves privadas: `-----BEGIN [A-Z ]*PRIVATE KEY-----`
+
+4. **`scripts/ci/check-secrets.js`**:
+   - Nuevo script CLI de CI que escanea archivos rastreados por git (o recursivo si no es git) omitiendo `node_modules`, `.git`, fixtures de prueba controlados (`tests/fixtures/secrets/`), y reporta con código de salida 1 si encuentra secretos activos.
+   - Añadido a `npm run ci:all` en `package.json`.
+
+---
+
+## 2. Contratos Heredados de Arquitectura
+
+```gemstack-contracts
+[
+  {
+    "id": "zero-dependency-core",
+    "type": "BOOLEAN_INVARIANT",
+    "value": true
+  },
+  {
+    "id": "https-only-skills",
+    "type": "BOOLEAN_INVARIANT",
+    "value": true
+  },
+  {
+    "id": "allowed-skill-schemes",
+    "type": "ENUM_SET",
+    "values": [
+      "https"
+    ]
+  },
+  {
+    "id": "skill-max-payload-bytes",
+    "type": "ROADMAP_LIMIT",
+    "value": 262144
+  },
+  {
+    "id": "skill-slug-identity",
+    "type": "IDENTITY_TUPLE",
+    "values": [
+      "namespace",
+      "slug"
+    ]
+  },
+  {
+    "id": "symlink-out-of-bounds",
+    "type": "BOUNDARY",
+    "value": "FORBIDDEN"
+  },
+  {
+    "id": "existing-hook-destruction",
+    "type": "BOUNDARY",
+    "value": "FORBIDDEN"
+  },
+  {
+    "id": "secret-scanning-ci",
+    "type": "BOOLEAN_INVARIANT",
+    "value": true
+  },
+  {
+    "id": "atomic-writes-confined",
+    "type": "BOOLEAN_INVARIANT",
+    "value": true
+  }
+]
+```
+
+---
+
+## 3. Mapeo Canónico de Pruebas (Test Bindings)
+
+```gemstack-test-bindings
+[
+  {
+    "id": "TEST-HARDEN-A01",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-A01"
+  },
+  {
+    "id": "TEST-HARDEN-A02",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-A02"
+  },
+  {
+    "id": "TEST-HARDEN-A03",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-A03"
+  },
+  {
+    "id": "TEST-HARDEN-A04",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-A04"
+  },
+  {
+    "id": "TEST-HARDEN-A05",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-A05"
+  },
+  {
+    "id": "TEST-HARDEN-B01",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-B01"
+  },
+  {
+    "id": "TEST-HARDEN-B02",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-B02"
+  },
+  {
+    "id": "TEST-HARDEN-B03",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-B03"
+  },
+  {
+    "id": "TEST-HARDEN-B04",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-B04"
+  },
+  {
+    "id": "TEST-HARDEN-C01",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-C01"
+  },
+  {
+    "id": "TEST-HARDEN-C02",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-C02"
+  },
+  {
+    "id": "TEST-HARDEN-C03",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-C03"
+  },
+  {
+    "id": "TEST-HARDEN-C04",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-C04"
+  },
+  {
+    "id": "TEST-HARDEN-C05",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-C05"
+  },
+  {
+    "id": "TEST-HARDEN-C06",
+    "file": "tests/security-p0-hardening.test.js",
+    "symbol": "TEST-HARDEN-C06"
+  }
+]
+```
+
+---
+
+## 4. Portones de Cierre (Closure Gates)
+
+```gemstack-closure-gates
+[
+  {
+    "id": "gate-test",
+    "type": "PACKAGE_SCRIPT",
+    "script": "test",
+    "requirement": "REQUIRED",
+    "waivable": false
+  },
+  {
+    "id": "gate-ci-all",
+    "type": "PACKAGE_SCRIPT",
+    "script": "ci:all",
+    "requirement": "REQUIRED",
+    "waivable": false
+  }
+]
+```

package/specs/011-gemstack-2.0-hardening/spec.md

@@ -0,0 +1,277 @@
+# Especificación de Funcionalidad: Gemstack 2.0 Hardening (Sprint A)
+
+**Feature Branch**: `011-gemstack-2.0-hardening`  
+**Feature Directory**: `specs/011-gemstack-2.0-hardening/`  
+**Lifecycle Status**: `SPEC_COMPLETE`  
+**Stop Reason**: `SPEC_COMPLETE_AWAITING_PLAN`
+
+---
+
+## 1. Problem Statement
+
+Gemstack v1.4.0 establishes declarative Spec-Driven Development, phase contracts, closure evidence, provider safety gates, context capsules, and visual QA manifests. However, a security and reliability audit of the v1.4.0 codebase reveals three critical trust boundary vulnerabilities:
+
+1. **Unbounded Remote Skill Fetching (`src/commands/install.js`)**:
+   - `fetch(url)` accepts arbitrary origins including cleartext HTTP, localhost, and private intranet IPs (SSRF).
+   - No network timeouts or byte limits exist, creating vulnerability to unbounded streaming or memory exhaustion.
+   - Skill names are not strictly validated as canonical slugs, creating path traversal risks.
+   - Remote code is downloaded and written without content pre-inspection or cryptographic fingerprint display.
+
+2. **Filesystem Traversal via Symlink Resolution (`src/lib/filesystem-safe.js`)**:
+   - Current path safety checks rely solely on lexical path containment (`path.relative`).
+   - If an existing or intermediate directory component is a symbolic link pointing outside the repository tree, writes or reads escape project boundaries.
+   - Atomic writes using OS temporary directories can cross filesystem mount points and risk symlink attacks.
+
+3. **Destructive Git Hook Replacement & Narrow Secret Detection (`src/commands/hooks.js`)**:
+   - `gemstack hooks` unconditionally overwrites `.git/hooks/pre-commit`, silently destroying existing user hooks (Husky, linters, formatters).
+   - Secret scanning covers only 3 basic patterns, completely ignoring modern AI API keys (Google Gemini, OpenAI, Anthropic), GitHub PATs, Slack tokens, and private SSH/RSA keys.
+   - CI does not enforce zero-secrets validation on the codebase.
+
+Gemstack 2.0 Sprint A implements mechanical, fail-closed trust boundaries for remote skill installation, filesystem containment with realpath resolution, safe git hook chaining, and comprehensive multi-provider secret detection.
+
+---
+
+## 2. Goals & Non-Goals
+
+### Goals
+- **Strict HTTPS & SSRF Defense**: Enforce HTTPS for remote skill installation. Block all loopback, link-local, and RFC 1918 private IP addresses.
+- **Bounded Remote Downloads**: Enforce maximum payload size (256 KB) and strict network timeout (8000ms).
+- **Canonical Skill Slugs**: Enforce strict alphanumeric regex on skill names (`^[a-z0-9][a-z0-9-_]{1,63}$`).
+- **Cryptographic Preview**: Compute SHA-256 fingerprint and validate frontmatter before disk persistence.
+- **Physical Filesystem Containment**: Implement `resolveSafeStrict` using canonical `realpathSync` to reject symlinks escaping repository root.
+- **Confined Atomic Writes**: Stage temporary writes within `.gemstack/tmp/` inside project boundaries.
+- **Git Hook Preservation & Chaining**: Detect existing `.git/hooks/pre-commit` scripts and chain execution without clobbering.
+- **Comprehensive Secret Detection**: Detect Google Gemini, OpenAI, Anthropic, GitHub PAT, Slack tokens, and private keys in both git hooks and CI.
+- **Zero Runtime Dependencies**: Implement all hardening using pure Node.js standard library.
+
+### Non-Goals
+- Gemstack does NOT implement an arbitrary remote package manager or NPM registry substitute.
+- Gemstack does NOT resolve external symlinks outside the repository root.
+- Gemstack does NOT replace dedicated enterprise SAST scanning tools; it enforces local-first pre-commit and CI hygiene.
+
+---
+
+## 3. Core Architectural Principles & Invariants
+
+```text
+remote input ≠ trusted code
+lexical containment ≠ physical containment
+symlink escape = security violation
+install skill ≠ execute code
+preserve user hooks > overwrite user hooks
+credentials in repo = immediate blocker
+zero runtime dependencies = permanent invariant
+```
+
+---
+
+## 4. Base Architectural Contracts
+
+```gemstack-contracts
+[
+  {
+    "id": "zero-dependency-core",
+    "type": "BOOLEAN_INVARIANT",
+    "value": true
+  },
+  {
+    "id": "https-only-skills",
+    "type": "BOOLEAN_INVARIANT",
+    "value": true
+  },
+  {
+    "id": "allowed-skill-schemes",
+    "type": "ENUM_SET",
+    "values": [
+      "https"
+    ]
+  },
+  {
+    "id": "skill-max-payload-bytes",
+    "type": "ROADMAP_LIMIT",
+    "value": 262144
+  },
+  {
+    "id": "skill-slug-identity",
+    "type": "IDENTITY_TUPLE",
+    "values": [
+      "namespace",
+      "slug"
+    ]
+  },
+  {
+    "id": "symlink-out-of-bounds",
+    "type": "BOUNDARY",
+    "value": "FORBIDDEN"
+  },
+  {
+    "id": "existing-hook-destruction",
+    "type": "BOUNDARY",
+    "value": "FORBIDDEN"
+  },
+  {
+    "id": "secret-scanning-ci",
+    "type": "BOOLEAN_INVARIANT",
+    "value": true
+  },
+  {
+    "id": "atomic-writes-confined",
+    "type": "BOOLEAN_INVARIANT",
+    "value": true
+  }
+]
+```
+
+---
+
+## 5. Canonical Acceptance Requirements
+
+### Group A: Remote Skills Installation Hardening
+- **TEST-HARDEN-A01**: Rejects non-HTTPS remote URLs by default with `INSECURE_HTTP_BLOCKED`.
+- **TEST-HARDEN-A02**: Rejects private and loopback IP addresses (127.0.0.1, localhost, 10.x, 192.168.x, 172.16-31.x, 169.254.x) with `PRIVATE_IP_BLOCKED`.
+- **TEST-HARDEN-A03**: Rejects payload exceeding 256 KB with `SKILL_PAYLOAD_TOO_LARGE`.
+- **TEST-HARDEN-A04**: Rejects invalid skill names (path traversal, separators, symbols) with `INVALID_SKILL_SLUG`.
+- **TEST-HARDEN-A05**: Computes SHA-256 fingerprint before writing and validates frontmatter integrity.
+
+### Group B: Filesystem Containment & Realpath Hardening
+- **TEST-HARDEN-B01**: `resolveSafeStrict` detects and blocks symlinks pointing outside the repository root (`SYMLINK_ESCAPE_DETECTED`).
+- **TEST-HARDEN-B02**: `resolveSafeStrict` detects and blocks intermediate symlink path traversal escaping repository root.
+- **TEST-HARDEN-B03**: Confines atomic file staging writes within `.gemstack/tmp/` inside project boundaries.
+- **TEST-HARDEN-B04**: Verifies all critical CLI call sites (init, update, install, backup, vqa) enforce containment with zero out-of-boundary mutations.
+
+### Group C: Git Hooks Preservation & Secret Detection
+- **TEST-HARDEN-C01**: `gemstack hooks` detects pre-existing user hooks and preserves them via executable delegation/chaining without data loss.
+- **TEST-HARDEN-C02**: Detects Google AI / Gemini API keys (`AIza[0-9A-Za-z-_]{35}`).
+- **TEST-HARDEN-C03**: Detects OpenAI and Anthropic API keys (`sk-[a-zA-Z0-9]{20,}`, `sk-ant-`).
+- **TEST-HARDEN-C04**: Detects GitHub PATs and Slack tokens (`ghp_`, `github_pat_`, `xox[baprs]-`).
+- **TEST-HARDEN-C05**: Detects private RSA/EC/OPENSSH keys (`-----BEGIN [A-Z ]*PRIVATE KEY-----`).
+- **TEST-HARDEN-C06**: Integrates zero-dependency secret scanner script `scripts/ci/check-secrets.js` into `ci:all` to verify repository cleanliness.
+
+---
+
+## 6. Canonical Test Matrix
+
+```gemstack-test-matrix
+[
+  {
+    "id": "TEST-HARDEN-A01",
+    "category": "REMOTE_SKILLS",
+    "layer": "UNIT",
+    "description": "Rejects non-HTTPS remote URLs by default with INSECURE_HTTP_BLOCKED",
+    "pass_criteria": "Throws or returns error with code INSECURE_HTTP_BLOCKED when URL protocol is http:",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-A02",
+    "category": "REMOTE_SKILLS",
+    "layer": "UNIT",
+    "description": "Rejects private and loopback IP addresses (SSRF defense) with PRIVATE_IP_BLOCKED",
+    "pass_criteria": "Blocks connections to loopback (127.0.0.1, ::1, localhost), link-local (169.254.x), and private RFC1918 subnets",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-A03",
+    "category": "REMOTE_SKILLS",
+    "layer": "UNIT",
+    "description": "Rejects payload exceeding 256 KB with SKILL_PAYLOAD_TOO_LARGE",
+    "pass_criteria": "Aborts stream download and throws SKILL_PAYLOAD_TOO_LARGE when response body exceeds 262144 bytes",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-A04",
+    "category": "REMOTE_SKILLS",
+    "layer": "UNIT",
+    "description": "Rejects invalid skill names with INVALID_SKILL_SLUG",
+    "pass_criteria": "Fails when skill name contains directory separators, path traversal (..), or forbidden characters",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-A05",
+    "category": "REMOTE_SKILLS",
+    "layer": "INTEGRATION",
+    "description": "Computes SHA-256 fingerprint before writing and validates frontmatter integrity",
+    "pass_criteria": "Calculates content digest in memory and verifies valid SKILL.md frontmatter prior to filesystem persistence",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-B01",
+    "category": "FILESYSTEM",
+    "layer": "UNIT",
+    "description": "Detects and blocks symlinks pointing outside repository root with SYMLINK_ESCAPE_DETECTED",
+    "pass_criteria": "Resolves real physical path and throws SYMLINK_ESCAPE_DETECTED when symlink destination escapes root",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-B02",
+    "category": "FILESYSTEM",
+    "layer": "UNIT",
+    "description": "Detects and blocks intermediate symlink path traversal escaping repository root",
+    "pass_criteria": "Throws SYMLINK_ESCAPE_DETECTED when any intermediate path component resolves outside repository root",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-B03",
+    "category": "FILESYSTEM",
+    "layer": "UNIT",
+    "description": "Confines atomic staging writes within .gemstack/tmp/ inside project boundaries",
+    "pass_criteria": "Staging file is written inside repository .gemstack/tmp/ and atomically renamed to final target",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-B04",
+    "category": "FILESYSTEM",
+    "layer": "INTEGRATION",
+    "description": "Verifies all CLI call sites enforce containment with zero out-of-boundary mutations",
+    "pass_criteria": "Audits init, update, install, backup, and vqa call sites verifying no file is read or written outside target root",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-C01",
+    "category": "GIT_HOOKS",
+    "layer": "INTEGRATION",
+    "description": "Preserves pre-existing user hooks via executable delegation without data loss",
+    "pass_criteria": "Detects non-Gemstack pre-commit hook and preserves execution of both user hook and Gemstack validator",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-C02",
+    "category": "SECRET_SCAN",
+    "layer": "UNIT",
+    "description": "Detects Google AI / Gemini API keys",
+    "pass_criteria": "Regex pattern matches AIza[0-9A-Za-z-_]{35} and blocks commit or CI execution",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-C03",
+    "category": "SECRET_SCAN",
+    "layer": "UNIT",
+    "description": "Detects OpenAI and Anthropic API keys",
+    "pass_criteria": "Regex patterns match sk-[a-zA-Z0-9]{20,} and sk-ant- and block commit or CI execution",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-C04",
+    "category": "SECRET_SCAN",
+    "layer": "UNIT",
+    "description": "Detects GitHub PATs and Slack tokens",
+    "pass_criteria": "Regex patterns match ghp_, github_pat_, and xox[baprs]- and block commit or CI execution",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-C05",
+    "category": "SECRET_SCAN",
+    "layer": "UNIT",
+    "description": "Detects private RSA/EC/OPENSSH keys",
+    "pass_criteria": "Regex pattern matches -----BEGIN [A-Z ]*PRIVATE KEY----- and blocks commit or CI execution",
+    "gate": "REQUIRED"
+  },
+  {
+    "id": "TEST-HARDEN-C06",
+    "category": "CI_INTEGRATION",
+    "layer": "CLI",
+    "description": "Integrates zero-dependency secret scanner script into ci:all",
+    "pass_criteria": "scripts/ci/check-secrets.js executes in ci:all and returns exit code 1 on detected secrets",
+    "gate": "REQUIRED"
+  }
+]
+```

package/specs/011-gemstack-2.0-hardening/tasks.md

@@ -0,0 +1,59 @@
+# Tareas de Implementación: Gemstack 2.0 Hardening (Sprint A)
+
+**Feature Branch**: `011-gemstack-2.0-hardening`  
+**Feature Directory**: `specs/011-gemstack-2.0-hardening/`  
+**Lifecycle Status**: `TASKS_COMPLETE`  
+**Stop Reason**: `TASKS_COMPLETE_AWAITING_IMPLEMENTATION`
+
+---
+
+## Inventario de Tareas
+
+- [ ] **TASK-001: Implementar suite adversarial P0 reproduciendo vulnerabilidades de base 1.4.0**
+  <!-- gemstack:validation_required=true -->
+  <!-- gemstack:tests=TEST-HARDEN-A01, TEST-HARDEN-A02, TEST-HARDEN-A03, TEST-HARDEN-A04, TEST-HARDEN-A05, TEST-HARDEN-B01, TEST-HARDEN-B02, TEST-HARDEN-B03, TEST-HARDEN-B04, TEST-HARDEN-C01, TEST-HARDEN-C02, TEST-HARDEN-C03, TEST-HARDEN-C04, TEST-HARDEN-C05, TEST-HARDEN-C06 -->
+  <!-- gemstack:files=tests/security-p0-hardening.test.js -->
+  <!-- gemstack:depends= -->
+  Crear la suite de pruebas `tests/security-p0-hardening.test.js` que ejercita ataques adversariales contra skills remotos (HTTP, SSRF, payload gigante, slugs maliciosos), symlinks saliendo de raíz, destrucción de pre-commit existente y evasión de escaneo de secretos.
+
+- [ ] **TASK-002: Contención estricta de filesystem y resolución realpath en filesystem-safe.js**
+  <!-- gemstack:validation_required=true -->
+  <!-- gemstack:tests=TEST-HARDEN-B01, TEST-HARDEN-B02, TEST-HARDEN-B03, TEST-HARDEN-B04 -->
+  <!-- gemstack:files=src/lib/filesystem-safe.js -->
+  <!-- gemstack:depends=TASK-001 -->
+  Implementar `resolveSafeStrict` usando `fs.realpathSync` para verificar que ningún enlace simbólico existente ni componente intermedio escape de la raíz del proyecto. Confinar escrituras temporales atómicas a `.gemstack/tmp/`.
+
+- [ ] **TASK-003: Blindar descarga e instalación de skills remotos en install.js**
+  <!-- gemstack:validation_required=true -->
+  <!-- gemstack:tests=TEST-HARDEN-A01, TEST-HARDEN-A02, TEST-HARDEN-A03, TEST-HARDEN-A04, TEST-HARDEN-A05 -->
+  <!-- gemstack:files=src/commands/install.js -->
+  <!-- gemstack:depends=TASK-001, TASK-002 -->
+  Implementar política HTTPS obligatoria, bloqueo de IPs privadas/loopback (SSRF), timeout de 8000ms, límite de 256 KB en streaming, validación estricta de slug (`^[a-z0-9][a-z0-9-_]{1,63}$`) y pre-inspección de fingerprint SHA-256 antes de persistir en disco.
+
+- [ ] **TASK-004: Preservación de git hooks existentes y escaneo ampliado de secretos en hooks.js**
+  <!-- gemstack:validation_required=true -->
+  <!-- gemstack:tests=TEST-HARDEN-C01, TEST-HARDEN-C02, TEST-HARDEN-C03, TEST-HARDEN-C04, TEST-HARDEN-C05 -->
+  <!-- gemstack:files=src/commands/hooks.js -->
+  <!-- gemstack:depends=TASK-001 -->
+  Modificar el instalador de hooks para preservar y encadenar hooks preexistentes del usuario. Ampliar el escáner a Google Gemini, OpenAI, Anthropic, GitHub PAT, Slack y claves privadas RSA/SSH.
+
+- [ ] **TASK-005: Script de verificación de secretos en CI e integración con ci:all**
+  <!-- gemstack:validation_required=true -->
+  <!-- gemstack:tests=TEST-HARDEN-C06 -->
+  <!-- gemstack:files=scripts/ci/check-secrets.js, package.json -->
+  <!-- gemstack:depends=TASK-004 -->
+  Crear `scripts/ci/check-secrets.js` con cero dependencias externas y conectarlo en el script `ci:all` de `package.json`.
+
+- [ ] **TASK-006: Auditoría de contención en call sites CLI (init, update, install, backup, vqa)**
+  <!-- gemstack:validation_required=true -->
+  <!-- gemstack:tests=TEST-HARDEN-B04 -->
+  <!-- gemstack:files=src/commands/init.js, src/commands/update.js, src/commands/install.js, src/lib/backup.js, src/commands/visual.js -->
+  <!-- gemstack:depends=TASK-002, TASK-003 -->
+  Auditar y conectar `resolveSafeStrict` en todos los comandos para garantizar que ninguna operación pueda crear, modificar o leer archivos fuera de los límites del repositorio.
+
+- [ ] **TASK-007: Cierre mecánico, ejecución de matriz completa y generación de closure.json**
+  <!-- gemstack:validation_required=true -->
+  <!-- gemstack:tests=TEST-HARDEN-A01, TEST-HARDEN-A02, TEST-HARDEN-A03, TEST-HARDEN-A04, TEST-HARDEN-A05, TEST-HARDEN-B01, TEST-HARDEN-B02, TEST-HARDEN-B03, TEST-HARDEN-B04, TEST-HARDEN-C01, TEST-HARDEN-C02, TEST-HARDEN-C03, TEST-HARDEN-C04, TEST-HARDEN-C05, TEST-HARDEN-C06 -->
+  <!-- gemstack:files=specs/011-gemstack-2.0-hardening/closure.json -->
+  <!-- gemstack:depends=TASK-001, TASK-002, TASK-003, TASK-004, TASK-005, TASK-006 -->
+  Ejecutar `gemstack collect` para correr toda la matriz de pruebas unitarias, de integración y CI, verificar status VERIFIED y dejar la evidencia de cierre lista.

package/specs/012-gemstack-2.0-honest-evidence/.gemstack.json

@@ -0,0 +1,5 @@
+{
+  "phase_hashes": {},
+  "historical_findings": [],
+  "accepted_exceptions": []
+}

package/specs/012-gemstack-2.0-honest-evidence/closure.json

@@ -0,0 +1,58 @@
+{
+  "schema": "gemstack-closure",
+  "version": 1,
+  "feature": "specs/012-gemstack-2.0-honest-evidence",
+  "generated_at": "2026-09-23T01:58:35.740Z",
+  "status": "VERIFIED",
+  "closure_context": {
+    "closure_context_hash": "a05e1759c3818e35cf9dee0edaa676bbfbe33ecdc39e08d265fc0c4b37476fb3",
+    "repository_type": "git",
+    "git_commit": "ba58055ea00a8a8cd6ee4b9b7f96deccbbf46dea",
+    "working_tree_clean": false,
+    "relevant_files_digest": "9adf80e140cd87942d5ff8db9b52a9c63c5fdadeb8a4c6f197e9319a90db4bb4"
+  },
+  "acceptance_signature": "3fe0b2f8d7083da811ecd33402dd5dbc627c64759a2532ee8eaf65e281e49af2",
+  "canonical_summary": {
+    "required_total": 14,
+    "required_passed": 14,
+    "supplemental_total": 0,
+    "supplemental_passed": 0
+  },
+  "physical_summary": {
+    "supporting_total": 0,
+    "supporting_passed": 0,
+    "total_executed": 14,
+    "total_passed": 14,
+    "total_failed": 0,
+    "total_skipped": 0
+  },
+  "reconciliation": {
+    "math_valid": true,
+    "phantoms_detected": 0,
+    "orphans_detected": 0,
+    "missing_canonical_ids": []
+  },
+  "task_traceability_summary": {
+    "tasks_total": 6,
+    "tasks_with_validation": 6,
+    "tasks_documentation_only": 0,
+    "unmapped_canonical_tests": []
+  },
+  "required_gates": {
+    "gate-test": "PASS",
+    "gate-ci-all": "PASS"
+  },
+  "supplemental_gates": {},
+  "exceptions": [],
+  "evidence_sources": [
+    {
+      "type": "PACKAGE_SCRIPT",
+      "script": "test",
+      "runner": "node:test",
+      "exit_code": 0,
+      "duration_ms": 406
+    }
+  ],
+  "blockers": [],
+  "warnings": []
+}