watchmyagents 1.1.4 → 1.1.6

package/SECURITY.md

@@ -11,13 +11,30 @@ WMA needs your Anthropic API key to call the Managed Agents REST API on your beh
 | Property | Behavior |
 |---|---|
 | **Source** | Environment variable `ANTHROPIC_API_KEY` or `--api-key` CLI flag |
-| **Storage** | Held in process memory for the duration of a `wma-fetch` run. Never persisted to disk by WMA. |
+| **Storage (CLI mode)** | Held in process memory for the duration of a `wma-fetch` run. Not persisted to disk. |
+| **Storage (service mode)** | Persisted to `~/.watchmyagents/env` with mode `0600` (user-only read/write) so the launchd / systemd unit can restart the daemon without prompting. See [Service-mode credentials](#service-mode-credentials) below for the exact layout. |
 | **Network** | Sent only to `api.anthropic.com` over HTTPS with strict certificate verification (`rejectUnauthorized: true`) |
 | **Logging** | The key is never written to NDJSON logs, never printed in error messages, never included in any export |
 | **Telemetry** | WMA performs zero telemetry today. No phone-home, no usage reporting. |
 
 **Recommendation:** generate a workspace-scoped API key with read-only permissions on the agents you want to monitor. See [Anthropic Console → API Keys](https://console.anthropic.com/settings/keys).
 
+#### Service-mode credentials
+
+When you run `wma-service install`, WMA registers a launchd (macOS) or systemd (Linux) unit that needs to restart the watch daemon across reboots without human intervention. The daemon's environment is therefore loaded from a small file owned by your user account:
+
+| Path | Mode | Owner | Contents |
+|---|---|---|---|
+| `~/.watchmyagents/` | `0700` | your user | Holds the env file and the launcher shell script |
+| `~/.watchmyagents/env` | `0600` | your user | `KEY=value` lines for `ANTHROPIC_API_KEY`, `WMA_API_KEY`, `WMA_SIGNALS_SALT`, `WMA_FORTRESS_BASE_URL` |
+| `~/.watchmyagents/<label>.launcher.sh` | `0600` | your user | Reads the env file with a literal `read -r` loop (no shell interpolation), then `exec`s `wma-fetch`. |
+
+Hardening notes:
+- The launcher loads secrets with `while IFS='=' read -r k v` instead of `. file` / `source file`. Sourcing would shell-evaluate every value, so a value containing `$(cmd)` would execute at every restart. The literal read assigns the bytes verbatim.
+- Values are validated before write: a newline anywhere in a credential aborts the install (would corrupt the env file or inject extra lines).
+- To wipe the credential without uninstalling the service: `chmod 600 ~/.watchmyagents/env && : > ~/.watchmyagents/env` (the daemon will exit on the next missing-env check).
+- Full removal: `wma-service uninstall` deletes the unit, the launcher, the env file, and the `~/.watchmyagents` directory.
+
 ### Local log files
 
 `wma-fetch` writes NDJSON files to `./watchmyagents-logs/<agent_id>/<date>.ndjson` with the following protections:
@@ -73,8 +90,7 @@ WMA combines **two complementary layers**:
 ## Supply chain
 
 - All code is open source on [GitHub](https://github.com/minedorfbm/watchmyagents)
-- Zero runtime dependencies (uses Node.js 18+ built-ins only)
-- One dev dependency (`@anthropic-ai/sdk`) for the optional adapter examples
+- Zero runtime AND dev dependencies (uses Node.js 18+ built-ins only). Run `npm ls --omit=dev` or check `package.json#dependencies` / `devDependencies` — both are empty.
 - Future releases will use `npm publish --provenance` for SLSA build attestation
 
 ## Reporting a vulnerability

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "watchmyagents",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "Security observability + real-time policy enforcement for AI agents. Local-first NDJSON capture with a continuous Watch daemon that auto-uploads anonymized signals, Shield CLI that blocks policy violations live (with policies pulled from Fortress cloud), anonymizer producing signals-only payloads, bidirectional sync with WatchMyAgents Fortress, and one-command install as an always-on launchd/systemd service — closing the recursive Watch→Guardian→Shield security loop.",
   "type": "module",
   "files": [

package/scripts/fetch-anthropic.js

@@ -91,6 +91,11 @@ function resolveModel(agent) {
 // is misconfigured or compromised; abort.
 const MAX_FORTRESS_RESPONSE_BYTES = 1 * 1024 * 1024;
 
+// v1.1.6 F-22 (P2 Codex audit): hard ceiling on a Fortress POST round
+// trip. Same rationale as in scripts/upload-fortress.js — without this,
+// a slow/unresponsive endpoint hangs the daemon's session loop.
+const FORTRESS_REQUEST_TIMEOUT_MS = 30_000;
+
 function postJson(url, headers, body) {
   return new Promise((resolveReq, rejectReq) => {
     const u = new URL(url);
@@ -125,6 +130,11 @@ function postJson(url, headers, body) {
       });
     });
     req.on('error', rejectReq);
+    // v1.1.6 F-22: bound the round trip so a non-responding endpoint
+    // can't hang the watch daemon's upload loop.
+    req.setTimeout(FORTRESS_REQUEST_TIMEOUT_MS, () => {
+      req.destroy(new Error(`Fortress request timed out after ${FORTRESS_REQUEST_TIMEOUT_MS}ms`));
+    });
     req.write(data); req.end();
   });
 }

package/scripts/upload-fortress.js

@@ -68,6 +68,16 @@ async function collectFiles(p) {
 // against a compromised or misconfigured response.
 const MAX_FORTRESS_RESPONSE_BYTES = 1 * 1024 * 1024;
 
+// v1.1.6 F-22 (P2 Codex audit): hard ceiling on a Fortress POST round
+// trip. Mirrors the timeout already enforced in src/shield/sources/
+// fortress.js. Without this, a Fortress endpoint that accepts the TCP
+// connection but stops responding mid-stream would hang the upload
+// daemon indefinitely — same SLOWLORIS class of bug F-21 fixes for
+// SSE reads. 30 s is plenty for a small JSON POST (signals payloads
+// are kilobytes); legitimate Fortress nodes reply in <1 s in steady
+// state.
+const FORTRESS_REQUEST_TIMEOUT_MS = 30_000;
+
 function postJson(url, headers, body) {
   return new Promise((resolveReq, rejectReq) => {
     const u = new URL(url);
@@ -114,6 +124,10 @@ function postJson(url, headers, body) {
       }
     );
     req.on('error', rejectReq);
+    // v1.1.6 F-22: ensure a non-responding endpoint can't hang the upload.
+    req.setTimeout(FORTRESS_REQUEST_TIMEOUT_MS, () => {
+      req.destroy(new Error(`Fortress request timed out after ${FORTRESS_REQUEST_TIMEOUT_MS}ms`));
+    });
     req.write(data);
     req.end();
   });

package/src/logger.js

@@ -1,8 +1,21 @@
-import { mkdir, appendFile } from 'node:fs/promises';
+import { mkdir, appendFile, chmod } from 'node:fs/promises';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { assertSafePathSegment } from './validate.js';
 
+// v1.1.6 F-24 (P3 Codex audit): the `mode` option on mkdir() and
+// appendFile() is only honored when the directory or file is CREATED.
+// If a previous wma-fetch run, a different user, or a hand-rolled mkdir
+// already left those paths around with the system umask (typically
+// 0755 / 0644), the original constructor would silently keep the loose
+// perms even though SECURITY.md promises 0700 / 0600. tightenMode runs
+// after every mkdir / append to bring the existing inode in line with
+// the docs. Errors are swallowed (best-effort): the chmod is a hardening
+// pass, not a precondition — failing it shouldn't break logging.
+async function tightenMode(path, mode) {
+  try { await chmod(path, mode); } catch { /* not fatal */ }
+}
+
 // PR-B: `framework` → `provider` (canonical name per src/sources/contract.js).
 // PR-C: adds `parent_agent_id` + `composition_pattern` so any future
 // adapter that knows the hierarchy (OpenAI Agents handoffs, CrewAI
@@ -89,8 +102,12 @@ export class Logger {
       output: e.output ?? null,
     };
     try {
-      await mkdir(join(this.logDir, this.agentId), { recursive: true, mode: 0o700 });
+      const dir = join(this.logDir, this.agentId);
+      await mkdir(dir, { recursive: true, mode: 0o700 });
+      // v1.1.6 F-24: tighten existing perms — `mode` is creation-only.
+      await tightenMode(dir, 0o700);
       await appendFile(path, JSON.stringify(full) + '\n', { encoding: 'utf8', mode: 0o600 });
+      await tightenMode(path, 0o600);
       this.count++;
     } catch (err) {
       if (!this.silent) process.stderr.write(`[wma] log write error: ${err.message}\n`);

package/src/shield/policy.js

@@ -50,6 +50,13 @@ export async function loadPolicies(path) {
     if (!VALID_MODES.includes(p.mode)) {
       throw new Error(`policy ${p.id || p.name}: unsupported mode "${p.mode}" (must be one of: ${VALID_MODES.join(', ')})`);
     }
+    // v1.1.5 Phase 1.5 — mark every local-file policy so the signature
+    // verifier (src/shield/signature.js) bypasses the Ed25519 chain on
+    // these rows. Today the local path and the Fortress path are entirely
+    // separate (loadPolicies → local ruleset; FortressPolicySource →
+    // cloud ruleset) so this marker is a safety net for future refactors
+    // that might mix them. It also documents intent at read time.
+    p.__local = true;
   }
   // v1.1.2 F-14 (P2 Codex audit): validate the ruleset's default.action
   // against the SAME canonical set as per-policy actions. Before this fix

package/src/shield/root-key.js

@@ -0,0 +1,49 @@
+// ─────────────────────────────────────────────────────────────────────────
+// Fortress root public key — v1.1.5 Phase 1.5 (Guardian Core Axis 2)
+// ─────────────────────────────────────────────────────────────────────────
+//
+// The Ed25519 root public key of the WMA Fortress signing hierarchy.
+// All cloud-supplied policies are signed by a signing key, which is itself
+// signed by this root. The verifier in src/shield/signature.js chains
+// from policy → signing_key → ROOT to decide whether to trust a policy.
+//
+// The root PRIVATE key NEVER touches this file (nor any customer machine,
+// nor any release artifact). It lives in the Fortress operator's offline
+// vault. Only the public counterpart is shipped, and only its public
+// counterpart is needed to verify.
+//
+// ROTATION POLICY:
+//   - Compromised root → ship a new SDK version with both the old AND new
+//     root keys in an array, give customers a grace window to upgrade,
+//     then ship another SDK version with only the new key. This is the
+//     same "double-signing" model used by Sigstore + Let's Encrypt.
+//   - Routine rotation: every 2 years. Signing keys (one tier down) are
+//     rotated every quarter and don't require an SDK release.
+//
+// ─────────────────────────────────────────────────────────────────────────
+// Real root pubkey — generated by offline ceremony on 2026-06-02
+// ─────────────────────────────────────────────────────────────────────────
+//
+// The private counterpart NEVER touched this repository, npm, GitHub, or
+// any connected machine. It was generated on the operator's machine in
+// an air-gapped session and immediately stored in 1Password Vault under
+// "WMA Fortress Root Private Key v1". It will be used 4× per year to
+// sign new signing keys for the Fortress signing pipeline.
+//
+// Fortress operator: Minedor (arma@talkytranslate.com)
+//
+// To rotate this key (every 2 years routine, or on suspected compromise):
+//   1. Generate a NEW keypair offline (same node:crypto snippet)
+//   2. Ship an SDK version with BOTH old + new pubkeys in an array,
+//      give customers 6-12 months overlap
+//   3. Ship a follow-up SDK version with only the new pubkey
+//
+// 32-byte Ed25519 public key as base64 (44 chars).
+export const WMA_FORTRESS_ROOT_PUBKEY_B64 = 'w4qKFACBbawZW1kx2wWxnITlOfvLDe+SXaPyZvp+mV4=';
+
+// Flipped to false at release time (v1.1.5). The FortressPolicySource
+// reads this to decide whether to skip verification entirely (placeholder
+// era) or strictly enforce the chain (production). Keep this field —
+// future rotations may temporarily re-enable placeholder mode in
+// release-candidate builds where the new root isn't yet provisioned.
+export const WMA_FORTRESS_ROOT_IS_PLACEHOLDER = false;

package/src/shield/signature.js

@@ -0,0 +1,259 @@
+// ─────────────────────────────────────────────────────────────────────────
+// Ed25519 policy signature verification — v1.1.5 Phase 1.5 (Guardian Core Axis 2)
+// ─────────────────────────────────────────────────────────────────────────
+//
+// Two-level chain of trust:
+//
+//   ROOT KEY (offline-generated, public key embedded in the SDK)
+//     │ signs
+//     ▼
+//   SIGNING KEY (rotated quarterly by Fortress, distributed in get-policies)
+//     │ signs
+//     ▼
+//   POLICY (each policy.signature is verified against its signing_key)
+//
+// The root private key NEVER leaves Fortress's secure vault. Signing keys
+// rotate without requiring an SDK release because their public keys travel
+// in the get-policies response, signed by the root. The SDK only needs to
+// know the embedded root public key to validate the whole chain.
+//
+// Why per-policy signatures (not bundle signatures):
+//   - A single corrupted/malicious policy doesn't invalidate the whole
+//     ruleset — we drop the invalid one and keep the rest.
+//   - Lets us mix "Fortress-signed cloud policies" with "local JSON
+//     policies for dev/test" without forcing the local path through the
+//     signing pipeline. The local-file adapter sets `__local: true` on
+//     its policies to opt out of signature requirements.
+//   - Compatible with first-match-wins evaluation: order is preserved,
+//     gaps from dropped policies are silently filled by lower-priority
+//     rules or the ruleset default.
+//
+// Zero runtime deps preserved — uses node:crypto's native Ed25519 support
+// (Node 16+). No tweetnacl, no @noble/curves.
+
+import { createPublicKey, verify as cryptoVerify } from 'node:crypto';
+
+// ─────────────────────────────────────────────────────────────────────────
+// Canonical serialization for signing
+// ─────────────────────────────────────────────────────────────────────────
+//
+// Both ends (signer + verifier) must agree on EXACTLY what bytes are signed.
+// We use a deterministic JSON encoding: keys sorted lexicographically at
+// every nesting depth, arrays preserved in order, no whitespace, no escape
+// variations (JSON.stringify's default escaping is deterministic).
+//
+// The signed payload for a POLICY excludes the signature field itself plus
+// any signer-side bookkeeping (signed_at, signing_key_id are NOT signed —
+// they're metadata that travels alongside the signature for verifier
+// lookup). The fields we DO sign are the ones whose modification would
+// change Shield's decision: rule_id, match, action, message, priority, mode.
+
+const POLICY_SIGNED_FIELDS = ['rule_id', 'match', 'action', 'message', 'priority', 'mode'];
+
+// Recursive deterministic JSON: sorted keys at every depth, arrays kept in order.
+export function canonicalize(value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return '[' + value.map(canonicalize).join(',') + ']';
+  }
+  const keys = Object.keys(value).sort();
+  const pairs = keys.map((k) => JSON.stringify(k) + ':' + canonicalize(value[k]));
+  return '{' + pairs.join(',') + '}';
+}
+
+// Build the byte string the policy signer hashed-and-signed.
+// Order: only the fields in POLICY_SIGNED_FIELDS, in their canonical order.
+// Missing fields are encoded as `null` so a policy that loses a field on
+// the wire (truncation, MITM) fails the signature check rather than
+// silently passing under a different shape.
+export function policySigningPayload(policy) {
+  const obj = {};
+  for (const f of POLICY_SIGNED_FIELDS) {
+    obj[f] = policy[f] !== undefined ? policy[f] : null;
+  }
+  return canonicalize(obj);
+}
+
+// Build the byte string the ROOT signs when issuing a signing key.
+// Order: only kid + pubkey + valid_from + valid_until — all four required.
+// `pubkey` is the raw 32-byte Ed25519 public key, base64-encoded.
+const SIGNING_KEY_SIGNED_FIELDS = ['kid', 'pubkey', 'valid_from', 'valid_until'];
+
+export function signingKeyPayload(signingKey) {
+  const obj = {};
+  for (const f of SIGNING_KEY_SIGNED_FIELDS) {
+    obj[f] = signingKey[f] !== undefined ? signingKey[f] : null;
+  }
+  return canonicalize(obj);
+}
+
+// ─────────────────────────────────────────────────────────────────────────
+// Key parsing
+// ─────────────────────────────────────────────────────────────────────────
+
+// Accept either:
+//   - a raw 32-byte Ed25519 public key, base64-encoded
+//   - a SubjectPublicKeyInfo (SPKI) DER-encoded blob, base64-encoded
+//   - a PEM-armored public key
+// Returns a node:crypto KeyObject ready for verify().
+//
+// Errors are surfaced verbatim so the operator sees WHY the key didn't
+// load (corrupted base64, wrong curve, etc.) instead of a silent "no
+// policies loaded".
+export function importEd25519PublicKey(input) {
+  if (input == null) throw new Error('importEd25519PublicKey: input is null/undefined');
+  if (typeof input === 'string') {
+    const trimmed = input.trim();
+    if (trimmed.startsWith('-----BEGIN ')) {
+      return createPublicKey({ key: trimmed, format: 'pem' });
+    }
+    // Try raw 32-byte → wrap in SPKI prefix for Ed25519.
+    const buf = Buffer.from(trimmed, 'base64');
+    if (buf.length === 32) {
+      // Ed25519 SPKI prefix (RFC 8410 §4): 0x302a300506032b6570032100
+      const SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+      return createPublicKey({
+        key: Buffer.concat([SPKI_PREFIX, buf]),
+        format: 'der',
+        type: 'spki',
+      });
+    }
+    // Otherwise assume DER-encoded SPKI.
+    return createPublicKey({ key: buf, format: 'der', type: 'spki' });
+  }
+  if (Buffer.isBuffer(input)) {
+    return createPublicKey({ key: input, format: 'der', type: 'spki' });
+  }
+  throw new Error(`importEd25519PublicKey: unsupported input type ${typeof input}`);
+}
+
+// ─────────────────────────────────────────────────────────────────────────
+// Low-level verify
+// ─────────────────────────────────────────────────────────────────────────
+
+// Verify a base64-encoded Ed25519 signature over a string payload.
+// Returns true/false — never throws on a bad signature (operational
+// callers want a boolean, not exception flow). Throws only on programmer
+// errors (missing key, wrong types).
+export function verifyEd25519(publicKey, payloadString, signatureBase64) {
+  if (publicKey == null) throw new Error('verifyEd25519: publicKey required');
+  if (typeof payloadString !== 'string') throw new Error('verifyEd25519: payload must be a string');
+  if (typeof signatureBase64 !== 'string') return false;
+  let sigBuf;
+  try {
+    sigBuf = Buffer.from(signatureBase64, 'base64');
+  } catch {
+    return false;
+  }
+  // Ed25519 signatures are exactly 64 bytes — anything else is invalid.
+  if (sigBuf.length !== 64) return false;
+  try {
+    return cryptoVerify(null, Buffer.from(payloadString, 'utf8'), publicKey, sigBuf);
+  } catch {
+    return false;
+  }
+}
+
+// ─────────────────────────────────────────────────────────────────────────
+// High-level chain verification
+// ─────────────────────────────────────────────────────────────────────────
+
+/**
+ * Verify a signing key's root signature and parse its public key.
+ *
+ * @param {object} signingKey
+ *   { kid, pubkey, valid_from, valid_until, signed_by_root }
+ * @param {KeyObject} rootPublicKey - the embedded SDK root public key
+ * @param {Date} [now] - clock for valid_from/valid_until checks (default: real now)
+ * @returns {{ ok: true, kid: string, pubkey: KeyObject } | { ok: false, reason: string }}
+ */
+export function verifySigningKey(signingKey, rootPublicKey, now = new Date()) {
+  if (!signingKey || typeof signingKey !== 'object') {
+    return { ok: false, reason: 'signing key is not an object' };
+  }
+  for (const f of SIGNING_KEY_SIGNED_FIELDS) {
+    if (signingKey[f] == null) return { ok: false, reason: `signing key missing required field "${f}"` };
+  }
+  if (typeof signingKey.signed_by_root !== 'string') {
+    return { ok: false, reason: 'signing_key.signed_by_root missing or not a string' };
+  }
+  // Validity window — both ends inclusive per ISO 8601 convention.
+  const from = new Date(signingKey.valid_from);
+  const until = new Date(signingKey.valid_until);
+  if (isNaN(from.getTime()) || isNaN(until.getTime())) {
+    return { ok: false, reason: 'invalid valid_from or valid_until ISO date' };
+  }
+  if (now < from) return { ok: false, reason: `signing key ${signingKey.kid} not yet valid (valid_from ${signingKey.valid_from})` };
+  if (now > until) return { ok: false, reason: `signing key ${signingKey.kid} expired (valid_until ${signingKey.valid_until})` };
+  // Root signature over canonical {kid, pubkey, valid_from, valid_until}.
+  const payload = signingKeyPayload(signingKey);
+  if (!verifyEd25519(rootPublicKey, payload, signingKey.signed_by_root)) {
+    return { ok: false, reason: `signing key ${signingKey.kid} not signed by trusted root` };
+  }
+  // Parse the signing key's pubkey itself (must be a valid Ed25519 key).
+  let pubkey;
+  try {
+    pubkey = importEd25519PublicKey(signingKey.pubkey);
+  } catch (e) {
+    return { ok: false, reason: `signing key ${signingKey.kid} pubkey invalid: ${e.message}` };
+  }
+  return { ok: true, kid: signingKey.kid, pubkey };
+}
+
+/**
+ * Verify one policy's signature against its signing key.
+ *
+ * @param {object} policy   - must include signature + signing_key_id
+ * @param {Map<string, KeyObject>} signingKeysByKid - verified signing keys
+ * @returns {{ ok: true } | { ok: false, reason: string }}
+ */
+export function verifyPolicy(policy, signingKeysByKid) {
+  if (!policy || typeof policy !== 'object') return { ok: false, reason: 'policy is not an object' };
+  // Local-policy escape hatch: the local JSON adapter sets __local: true
+  // on its rows so dev/test/CI workflows don't have to involve the
+  // signing pipeline. The FortressPolicySource path NEVER sets this.
+  if (policy.__local === true) return { ok: true };
+  if (typeof policy.signature !== 'string') return { ok: false, reason: `policy ${policy.rule_id || '?'} missing signature` };
+  if (typeof policy.signing_key_id !== 'string') return { ok: false, reason: `policy ${policy.rule_id || '?'} missing signing_key_id` };
+  const pubkey = signingKeysByKid.get(policy.signing_key_id);
+  if (!pubkey) {
+    return { ok: false, reason: `policy ${policy.rule_id || '?'} references unknown signing_key_id "${policy.signing_key_id}"` };
+  }
+  const payload = policySigningPayload(policy);
+  if (!verifyEd25519(pubkey, payload, policy.signature)) {
+    return { ok: false, reason: `policy ${policy.rule_id || '?'} signature does not verify against signing key ${policy.signing_key_id}` };
+  }
+  return { ok: true };
+}
+
+/**
+ * High-level: given a Fortress `get-policies` response and the embedded
+ * root pubkey, return { validPolicies, droppedPolicies, validSigningKeys }.
+ *
+ * Caller is expected to ignore droppedPolicies (with logging) and load
+ * validPolicies into the ruleset. Never throws — failure modes are
+ * returned in `droppedPolicies[].reason` for the caller to surface.
+ *
+ * @param {object} opts
+ * @param {Array} opts.policies   - raw policies from get-policies response
+ * @param {Array} opts.signingKeys - raw signing_keys from response
+ * @param {KeyObject} opts.rootPublicKey - SDK-embedded root pubkey
+ * @param {Date} [opts.now]
+ */
+export function verifyPolicyBundle({ policies, signingKeys, rootPublicKey, now = new Date() }) {
+  const validSigningKeys = new Map();
+  const signingKeyErrors = [];
+  for (const sk of signingKeys || []) {
+    const r = verifySigningKey(sk, rootPublicKey, now);
+    if (r.ok) validSigningKeys.set(r.kid, r.pubkey);
+    else signingKeyErrors.push({ kid: sk?.kid || '?', reason: r.reason });
+  }
+  const validPolicies = [];
+  const droppedPolicies = [];
+  for (const p of policies || []) {
+    const r = verifyPolicy(p, validSigningKeys);
+    if (r.ok) validPolicies.push(p);
+    else droppedPolicies.push({ rule_id: p?.rule_id || '?', reason: r.reason });
+  }
+  return { validPolicies, droppedPolicies, validSigningKeys, signingKeyErrors };
+}

package/src/shield/sources/fortress.js

@@ -84,7 +84,7 @@ function httpsJson(method, url, headers, body, timeoutMs = DEFAULT_TIMEOUT_MS) {
  * @param {string} opts.apiKey - wma_xxx
  * @param {string} opts.base - Fortress base URL (https://x.supabase.co/functions/v1)
  * @param {string} [opts.anthropicAgentId] - optional filter
- * @returns {Promise<{ ok: true, policies: array, fetched_at: string }>}
+ * @returns {Promise<{ ok: true, policies: array, signing_keys: array, fetched_at: string }>}
  */
 export async function fetchPolicies({ apiKey, base, anthropicAgentId }) {
   let url = fortressEndpoint(base, 'get-policies');
@@ -97,7 +97,18 @@ export async function fetchPolicies({ apiKey, base, anthropicAgentId }) {
     accept: 'application/json',
   });
   if (status === 200 && body && body.ok) {
-    return { ok: true, policies: body.policies || [], fetched_at: body.fetched_at };
+    return {
+      ok: true,
+      policies: body.policies || [],
+      // v1.1.5 Phase 1.5 — the chain-of-trust: signing keys travel
+      // with the response, each signed by the embedded root pubkey.
+      // Older Fortress deployments that haven't shipped the signing
+      // pipeline yet just won't include this field — the verifier
+      // then drops every policy as "unknown signing_key_id" and
+      // operators see the gap immediately.
+      signing_keys: body.signing_keys || [],
+      fetched_at: body.fetched_at,
+    };
   }
   const err = body?.error || (typeof body === 'string' ? body.slice(0, 200) : 'unknown');
   throw new Error(`get-policies failed (HTTP ${status}): ${err}`);
@@ -136,11 +147,43 @@ export async function postDecision({ apiKey, base, decision }) {
 // ────────────────────────────────────────────────────────────────────────
 
 import { matchesPolicy, compileMatchRegexes } from '../policy.js';
+// v1.1.5 Phase 1.5 — signature verification on the cloud path.
+import { verifyPolicyBundle, importEd25519PublicKey } from '../signature.js';
+import { WMA_FORTRESS_ROOT_PUBKEY_B64, WMA_FORTRESS_ROOT_IS_PLACEHOLDER } from '../root-key.js';
 
 const VALID_ACTIONS = new Set(['allow', 'deny', 'interrupt']);
 
+// v1.1.5 Phase 1.5 — strict-by-default signature verification.
+// Set WMA_REQUIRE_SIGNED_POLICIES=false to accept unsigned policies
+// from Fortress with a loud warning at each refresh. This is an escape
+// hatch for ops emergencies (e.g. Fortress signing pipeline temporarily
+// down) and dev/CI workflows where a staging Fortress hasn't been
+// upgraded yet. Default is strict to honour the security stance chosen
+// for v1.1.5.
+function strictModeFromEnv() {
+  const v = process.env.WMA_REQUIRE_SIGNED_POLICIES;
+  if (v == null) return true;        // unset → strict by default
+  if (v === 'false' || v === '0') return false;
+  return true;
+}
+
+// Parse the embedded root pubkey ONCE at module load. If the file still
+// carries the placeholder, we DO NOT throw — but every refresh logs a
+// loud reminder so an unattended deploy can't silently trust a key whose
+// private counterpart is in the git history.
+const ROOT_PUBLIC_KEY = (() => {
+  try {
+    return importEd25519PublicKey(WMA_FORTRESS_ROOT_PUBKEY_B64);
+  } catch (e) {
+    // The placeholder string isn't valid base64 of 32 bytes, so import
+    // will throw. That's the desired behaviour during development —
+    // verification will fail-closed until the real key is embedded.
+    return null;
+  }
+})();
+
 export class FortressPolicySource {
-  constructor({ apiKey, base, anthropicAgentId, refreshIntervalMs = 5 * 60_000, onError, onRefresh }) {
+  constructor({ apiKey, base, anthropicAgentId, refreshIntervalMs = 5 * 60_000, onError, onRefresh, requireSignedPolicies }) {
     if (!apiKey) throw new Error('FortressPolicySource: apiKey required');
     if (!base) throw new Error('FortressPolicySource: base URL required');
     this.apiKey = apiKey;
@@ -153,6 +196,12 @@ export class FortressPolicySource {
     this.lastFetchedAt = null;
     this._timer = null;
     this._aborted = false;
+    // v1.1.5: per-instance override of the env var. Tests use this to
+    // exercise both modes without touching process.env. If neither the
+    // constructor option nor the env var is set, strict mode wins.
+    this.requireSignedPolicies = requireSignedPolicies != null
+      ? !!requireSignedPolicies
+      : strictModeFromEnv();
   }
 
   /** Initial fetch — fails loud if it can't reach Fortress at startup. */
@@ -186,17 +235,26 @@ export class FortressPolicySource {
   async _refresh({ initial = false } = {}) {
     if (this._aborted) return;
     try {
-      const { policies, fetched_at } = await fetchPolicies({
+      const { policies, signing_keys, fetched_at } = await fetchPolicies({
         apiKey: this.apiKey,
         base: this.base,
         anthropicAgentId: this.anthropicAgentId,
       });
-      // Compile + validate each policy. A single malformed/dangerous policy
-      // (bad action, ReDoS-prone regex) must NOT take down the whole ruleset:
-      // skip it, report it, keep the rest. This matters because policies come
-      // from the cloud (Guardian-generated) — they're not fully trusted input.
+
+      // v1.1.5 Phase 1.5 — verify the chain-of-trust BEFORE any other
+      // processing. We must verify on the raw JSON shape sent by Fortress,
+      // not on the post-compile form, because compileMatchRegexes mutates
+      // `match` in place (adds _regex / _not_regex KeyObjects) and the
+      // signed canonical payload would no longer match.
+      const verifiedPolicies = this._verifyAndFilter(policies, signing_keys);
+
+      // Compile + validate each VERIFIED policy. A single malformed/dangerous
+      // policy (bad action, ReDoS-prone regex) must NOT take down the whole
+      // ruleset: skip it, report it, keep the rest. This matters because
+      // even after signature verification the rule shape can be wrong
+      // (server-side signing happened on a payload the SDK doesn't accept).
       const compiled = [];
-      for (const p of policies) {
+      for (const p of verifiedPolicies) {
         try {
           compiled.push(compilePolicyFromFortress(p));
         } catch (e) {
@@ -228,6 +286,49 @@ export class FortressPolicySource {
       this.onError(e);
     }
   }
+
+  // v1.1.5 Phase 1.5 — verify the Fortress chain of trust on a refresh
+  // response. Returns the array of policies that pass the gate (verified
+  // signatures in strict mode, OR all policies in lax mode with a warning
+  // per unsigned one).
+  //
+  // FAIL MODES:
+  //   - ROOT key is the placeholder (release wasn't ceremony-completed):
+  //     emit a one-line WARNING at each refresh and skip verification
+  //     entirely — better than silently trusting a known-compromised key.
+  //   - Strict (default): drop every policy that doesn't verify; log each
+  //     drop reason via onError so the operator sees the gap.
+  //   - Lax (WMA_REQUIRE_SIGNED_POLICIES=false): keep every policy but
+  //     emit a WARNING per unsigned one — gives migration slack while
+  //     making the audit trail visible.
+  _verifyAndFilter(rawPolicies, rawSigningKeys) {
+    if (WMA_FORTRESS_ROOT_IS_PLACEHOLDER || ROOT_PUBLIC_KEY == null) {
+      this.onError(new Error(
+        'FortressPolicySource: ROOT_PUBLIC_KEY is the placeholder (not a real Fortress root). ' +
+        'Signature verification SKIPPED. This is the expected state during development; ' +
+        'NEVER ship this configuration to production.'
+      ));
+      return rawPolicies || [];
+    }
+    const bundle = verifyPolicyBundle({
+      policies: rawPolicies || [],
+      signingKeys: rawSigningKeys || [],
+      rootPublicKey: ROOT_PUBLIC_KEY,
+    });
+    for (const ke of bundle.signingKeyErrors) {
+      this.onError(new Error(`FortressPolicySource: rejected signing key "${ke.kid}": ${ke.reason}`));
+    }
+    for (const dp of bundle.droppedPolicies) {
+      const verb = this.requireSignedPolicies ? 'DROPPING' : 'WARNING (lax mode)';
+      this.onError(new Error(`FortressPolicySource: ${verb} policy "${dp.rule_id}": ${dp.reason}`));
+    }
+    if (this.requireSignedPolicies) {
+      return bundle.validPolicies;
+    }
+    // Lax mode: keep every raw policy but the loud warnings above let
+    // ops see what would be dropped in strict mode.
+    return rawPolicies || [];
+  }
 }
 
 // Convert a Fortress DB policy row to the local Shield format.

package/src/shield/stream.js

@@ -21,6 +21,20 @@ const VERSION = '2023-06-01';
 // reconnect logic — same outcome as a network error.
 const MAX_SSE_FRAME_BYTES = 1 * 1024 * 1024;
 
+// v1.1.6 F-21 (P1 Codex audit): inactivity watchdog on the SSE reader.
+// `reader.read()` blocks until the upstream sends bytes — there is no
+// built-in heartbeat check. A misbehaving proxy or compromised upstream
+// can keep the TCP connection open without ever emitting another event,
+// which freezes Shield indefinitely without triggering the reconnect
+// path in streamWithReconnect. 45 s is well above Anthropic's normal
+// inter-event latency (typically sub-second when an agent is active,
+// and the API sends SSE comment heartbeats `: ping` every ~15-30 s
+// when it's idle), so 45 s without any byte at all is a strong signal
+// the stream is dead but TCP-alive. On timeout we throw, the existing
+// try/finally releases the reader, and the caller reconnects with
+// exponential backoff.
+const SSE_INACTIVITY_TIMEOUT_MS = 45_000;
+
 function authHeaders(apiKey) {
   return {
     'x-api-key': apiKey,
@@ -50,7 +64,16 @@ export async function* openEventStream({ apiKey, sessionId, signal }) {
 
   try {
     while (true) {
-      const { done, value } = await reader.read();
+      // v1.1.6 F-21: race the reader against the inactivity watchdog so
+      // a stalled-but-open stream cannot freeze us indefinitely. We
+      // cancel the reader on timeout to release the underlying TCP
+      // resources before throwing — otherwise the pending read() would
+      // leak. The thrown error propagates to streamWithReconnect which
+      // initiates a fresh open with backoff.
+      const { done, value } = await readWithInactivityTimeout(
+        reader,
+        SSE_INACTIVITY_TIMEOUT_MS,
+      );
       if (done) break;
       buffer += decoder.decode(value, { stream: true });
       // v1.1.4 F-18 (P1 Codex audit): normalize all SSE line terminators
@@ -89,6 +112,59 @@ export async function* openEventStream({ apiKey, sessionId, signal }) {
   }
 }
 
+/**
+ * Race a ReadableStreamDefaultReader's `.read()` against an inactivity
+ * timeout. v1.1.6 F-21 (P1 Codex audit).
+ *
+ * Why this exists: a TCP-alive but byte-silent upstream (proxy with
+ * keepalive but no SSE heartbeat, compromised endpoint, slowloris-style
+ * stall) can leave `reader.read()` pending forever, freezing Shield's
+ * event loop. Bounding the wait surfaces the stall as an error so
+ * `streamWithReconnect` initiates a fresh connection.
+ *
+ * Exported so the unit tests can hit it directly with a mock reader
+ * that never resolves.
+ *
+ * @param {ReadableStreamDefaultReader} reader
+ * @param {number} timeoutMs
+ * @returns {Promise<{ done: boolean, value?: Uint8Array }>}
+ */
+export async function readWithInactivityTimeout(reader, timeoutMs) {
+  // We deliberately avoid Promise.race here: racing two pending promises
+  // leaves the loser in a perpetual pending state, which Node's test
+  // runner (rightly) flags as a resource leak. Instead we use the
+  // Web Streams contract — `reader.cancel()` settles a pending read()
+  // to `{ done: true }` — and a simple flag to distinguish the cancel
+  // we issued from a legitimate end-of-stream.
+  let timedOut = false;
+  const timeoutId = setTimeout(() => {
+    timedOut = true;
+    // Cancel resolves the pending read() promise. We swallow any
+    // rejection from cancel (some readers throw on already-cancelled
+    // state) because the relevant error is the timeout itself.
+    Promise.resolve(reader.cancel(new Error('SSE inactivity timeout')))
+      .catch(() => undefined);
+  }, timeoutMs);
+  // NOTE: we deliberately do NOT call timeoutId.unref() here. The
+  // unref() would make the timer non-blocking for the event loop, but
+  // for a Web Stream backed by no actual I/O (e.g. unit tests, in-memory
+  // sources) Node may then consider the loop empty and never fire the
+  // timer at all — the call hangs forever. Since the timer is short-
+  // lived (single-shot, cleared on the success path), keeping it ref'd
+  // is harmless even in long-running daemons.
+  try {
+    const result = await reader.read();
+    if (timedOut) {
+      throw new Error(
+        `SSE stream stalled — no data received for ${timeoutMs}ms (caller should reconnect)`,
+      );
+    }
+    return result;
+  } finally {
+    clearTimeout(timeoutId);
+  }
+}
+
 function parseFrame(frame) {
   // Concatenate all `data:` lines per the SSE spec (multi-line payload).
   const parts = [];