controlzero 1.13.13__tar.gz → 1.13.14__tar.gz

{controlzero-1.13.13 → controlzero-1.13.14}/CHANGELOG.md

@@ -2,6 +2,45 @@
 
 ## Unreleased
 
+## 1.13.14 (2026-08-17): a tampered policy file silently flipped deny to allow
+
+**Security fix. If you sign your policy and rely on `tamper_behavior`, read this.**
+
+Reproduced against the published 1.13.13 wheel:
+
+```
+signed policy    -> some_tool: deny    (correct)
+TAMPERED policy  -> some_tool: allow   (tamper_behavior: deny was set)
+```
+
+Anyone with write access to the policy file could turn a `deny` into an
+`allow`, and `guard()` obeyed. The `.sig` sidecar sat alongside it, no longer
+matching, and nothing read it.
+
+`Client(policy=...).guard()` never verified the file's HMAC. Every piece of the
+tamper machinery existed and worked -- `load_signed_file` correctly rejects a
+mutated envelope, and `guard()` correctly fails closed when told tampering
+occurred -- but nothing connected the two. The tests for each half passed the
+entire time, because each tested its own half.
+
+Fixed: `guard()` now discovers tampering from the signed file itself on every
+evaluation and merges the result into a private copy of the context, so a
+caller cannot assert its own tamper state and enforcement and audit consume the
+same fact.
+
+**Who is affected:** callers who signed their policy with `controlzero
+sign-policy` and set `tamper_behavior`. An unsigned policy has no signature to
+verify and is unaffected -- that configuration never had the control.
+
+**Node has the same gap** and is tracked separately; this release fixes Python
+only.
+
+Upgrade:
+
+```bash
+pip install --upgrade controlzero
+```
+
 ## 1.13.13 (2026-08-16): a read-class METHOD could satisfy an allow the SQL would deny
 
 **Security fix. If you use a `database:read` allow rule, read this.**

{controlzero-1.13.13 → controlzero-1.13.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: controlzero
-Version: 1.13.13
+Version: 1.13.14
 Summary: AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup.
 Project-URL: Homepage, https://controlzero.ai
 Project-URL: Documentation, https://docs.controlzero.ai

{controlzero-1.13.13 → controlzero-1.13.14}/controlzero/__init__.py

@@ -41,7 +41,7 @@ from controlzero.hitl.grant_protocol import (
 from controlzero.policy_loader import load_policy
 from controlzero.secrets import SecretRef, SecretStr, secret_ref
 
-__version__ = "1.13.13"
+__version__ = "1.13.14"
 
 __all__ = [
     "Client",

{controlzero-1.13.13 → controlzero-1.13.14}/controlzero/client.py

@@ -698,6 +698,19 @@ class Client:
         )
         self._local_override_source_hint = str(local_source) if self._local_override_active else ""
 
+        # Keep the actual file-backed source so guard() can verify its HMAC on
+        # every evaluation. Dict policies and hosted bundles have no local HMAC
+        # sidecars; hosted signatures are verified by load_hosted_policy().
+        #
+        # Accept str as well as Path. `Client(policy="policy.yaml")` is the form
+        # every doc example uses, and an isinstance(local_source, Path) test
+        # silently skipped tamper verification for it -- the control would have
+        # been present, tested, and unreachable for almost every real caller.
+        # A dict policy has no file to verify and correctly yields None here.
+        self._local_policy_path = (
+            Path(local_source) if isinstance(local_source, (str, Path)) else None
+        )
+
         # Load local policy if present
         self._evaluator: Optional[PolicyEvaluator] = None
         self._policy_settings = PolicySettings()
@@ -1465,6 +1478,17 @@ class Client:
         # error is swallowed: the old bundle keeps working.
         self._maybe_refresh_policy()
 
+        # A caller cannot be trusted to report policy tampering in its own
+        # context. Discover it from the signed file and merge the result into a
+        # private copy so both enforcement and audit consume the same fact.
+        if self._local_policy_path is not None:
+            from controlzero.tamper import policy_file_tampered
+
+            if policy_file_tampered(self._local_policy_path):
+                context = dict(context or {})
+                context["tamper_detected"] = True
+                context.setdefault("tamper_source", "policy_hmac")
+
         # gh#175 P1.1 audit trail: resolve the client_name +
         # project_id once up front so the quarantine / tamper
         # fast-paths below stamp the audit row consistently with the

{controlzero-1.13.13 → controlzero-1.13.14}/controlzero/tamper.py

@@ -326,6 +326,31 @@ def load_or_create_secret(path: Path) -> bytes:
     return secret
 
 
+def policy_file_tampered(path: Path) -> bool:
+    """Return whether a signed local policy no longer matches its HMAC.
+
+    Unsigned policies remain supported: when either sidecar is absent there is
+    no integrity assertion to verify, so this returns False. Once both
+    ``<policy>.sig`` and ``tamper.key`` exist, a malformed or mismatched
+    signature is tampering.
+    """
+    policy_path = Path(path)
+    signature_path = policy_path.with_suffix(policy_path.suffix + ".sig")
+    key_path = policy_path.parent / "tamper.key"
+    if not signature_path.exists() or not key_path.exists():
+        return False
+
+    try:
+        secret = load_or_create_secret(key_path)
+        payload = policy_path.read_bytes()
+        signature = signature_path.read_text(encoding="utf-8").strip()
+    except (OSError, UnicodeError):
+        # Both sidecars assert that verification is required. If they cannot be
+        # read, the integrity claim cannot be established, so fail closed.
+        return True
+    return not verify_bundle(payload, signature, secret)
+
+
 # Imports below sit mid-module by design: the quarantine block is a
 # self-contained subsystem that came in later than the original file
 # (#383 quarantine support) and was kept locally scoped to make the
@@ -463,6 +488,7 @@ __all__ = [
     "write_signed_file",
     "HashChain",
     "load_or_create_secret",
+    "policy_file_tampered",
     "TamperState",
     "report_tamper_alert",
 ]

{controlzero-1.13.13 → controlzero-1.13.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "controlzero"
-version = "1.13.13"
+version = "1.13.14"
 description = "AI agent governance: policies, audit, and observability for tool calls. Works locally with no signup."
 readme = "README.md"
 license = {text = "Apache-2.0"}