7f9b703a90Pi-facing wallet status adapter: private, disabled by default, status-only projection with strict redaction — no wallet secrets, no mutation actions, no capability advertisement, unregistered on the MCP surface. Includes the wallet_pi_status_adapter unit suite and the argument-order repair for the managed-session invocation. Layer 5 (final) of the reviewed Glove wallet-status stack. Validation: dev CTest, ASan/UBSan, TSan, and libFuzzer 10,000 units per target on this exact stacked tree (see workflow184 layer records).
14 KiB
14 KiB
Glove threat model
Security objective
Glove limits the authority of an untrusted agent process to explicitly selected files, environment variables, network destinations, and MCP tools. It also records policy decisions and, for managed Linux sessions, produces authenticated resource-enforcement receipts.
Glove is a containment boundary, not a prompt-injection detector or a complete host security boundary.
Trust boundaries
| Component | Trust assumption |
|---|---|
| Agent process and model output | Untrusted |
| Agent-supplied JSON-RPC and terminal input | Untrusted |
| Glove control, policy, and sandbox code | Trusted |
| Local policy, launch templates, and approval records | Trusted operator input |
| Project files, repository configuration, and agent instructions | Untrusted; never machine-setup authority |
| MCP upstream servers | Trusted host processes; not sandboxed by Glove |
| Sage controller | Authenticated peer, but not authority for raw paths, exposure administration, or host mutation |
| Operating-system kernel and platform sandbox | Trusted and patched |
| Other processes under the same host user | Outside the strong integrity boundary |
Enforced properties
| Area | Enforcement |
|---|---|
| Filesystem | Deny-default sandbox; explicit read/write grants; descriptor-based path resolution; link, ownership, identity, and overlap checks |
| Network | Linux private network namespace with no external route; offline agents cannot create Internet sockets, while online agents reach only an authenticated audited host proxy through a private-loopback listener and inherited Unix descriptor channel; exact macOS egress rules |
| Process surface | Linux PID/user/IPC/UTS namespaces; macOS deny-default SBPL |
| Environment | Minimal environment plus named grants |
| Tool access | Qualified allow-list and configured argument rules before upstream dispatch |
| Protocol | Bounded JSON-RPC frames, strict decoding, recursive duplicate-key rejection, initialization checks, and timeouts |
| Resources | Linux cgroup CPU/memory/PID limits, watchdog wall time, filesystem quotas, and aggregate terminal-output accounting |
| Audit | Agent-inaccessible JSONL destination; HMAC-chained managed-session terminal receipts |
| Remote plans | Identifier-only canonical plan matched against owner-local policy and dual digests; exact untagged container name@sha256 identity; isolated Ed25519-only SSH artifacts; receive-inclusive monotonic TTLs; a configured remote backend remains construction-only and grants no launch authority |
| Daemon lifecycle | Fixed local user-service name, protected config and executable paths, shell-free service-manager invocation, and authenticated readiness checks |
| Recovery | Append-only state, exact replay, process identity beyond PID, and fail-closed reconciliation |
Security-relevant append, policy, setup, and receipt failures terminate or reject the operation rather than silently reducing enforcement.
Residual risks
| Risk | Consequence | Required mitigation |
|---|---|---|
| Allowed-tool abuse or prompt injection | An agent can perform malicious operations that remain within an allowed tool's semantics. | Narrow tool and argument policy; upstream semantic authorization. |
| Unsandboxed upstream compromise | A vulnerable MCP server can act with its host-user authority. | Run upstreams in separate sandboxes or move them behind a hardened service boundary. |
| Same-user host tampering | A peer process can rewrite the general JSONL log or unkeyed session state and may read shared local secrets. | Isolate the service identity; use asymmetric signing or protected key storage; authenticate general logs. |
| Linux kernel escape | A kernel vulnerability can cross namespace or seccomp boundaries. | Patch hosts and add an outer VM/container boundary where required. |
| Hostile active content | Documents, archives, installers, and malware can exploit a process that parses or executes them. | Use the hostile-content analysis profile for offline data inspection; require a disposable VM-grade boundary for active-content execution. |
| macOS resource exhaustion | The Sage six-limit resource contract is not implemented on macOS. | Add enforceable CPU, memory, PID, wall-time, disk, and output controls with receipts. |
| Host egress broker compromise | A defect in the host relay or authenticated proxy could mishandle an approved connection. | Keep the relay target fixed to the per-run proxy, use exact host/port grants, cap concurrent relays, and retain proxy audit evidence. |
| Retained-change apply disabled | The local atomic/recovery primitive is not a production authorization boundary by itself. | Keep capability 0 until the independent Ed25519 helper/verifier, local RPC/audit path, startup sweep, host-space policy, and Sage-to-parent isolation are configured and tested. |
| Bundle expansion absent | A verified bundle file is not yet converted into harness-native prompt context. | Add bounded, format-aware extraction and receipt-bound launch inputs. |
| Refinement evidence scope | Glove does not currently own harness token accounting or a session-indexed durable tool/security/egress event stream suitable for fixture assertions. | V1 omits token and audited-event assertions. Never accept model-reported counts or event identifiers; add them only after those observations have a Glove-owned exact-session source. |
| Remote backend is non-operational | Validated SSH artifacts and executor health can be mistaken for an enforceable remote sandbox. | Keep lifecycle, adapter, resource, and receipt capabilities absent; require executor self-measurement and independent enforcement verification before enabling launch. |
| Wallet status bridge is construction-only | Offline authority and socketpair fakes could be mistaken for live wallet mediation, or independently changing authority sources could produce a mixed snapshot. | Keep production construction and global capability advertisement absent until protected authorities and separately reviewed child-FD mapping are composed. Require verified owner-only Unix-stream endpoints, CLOEXEC-by-default transfer, one deadline and plan generation across snapshots, exact teardown on partial/error/cancel paths, status-only output, and no fallback to generic Sage, MCP, shell, or wallet routes. |
| Synthetic Pi status projection is mistaken for activation | A test-only Pi-shaped descriptor could be treated as proof that the contained process can safely discover or invoke wallet status. | Keep the adapter private, disabled, fake-channel-only, and absent from kernel/native/Pi registries. Re-attest every list and call, disappear on any untrusted state, expose no host identifiers or errors, and require separate child mapping, lifetime, and activation review. |
| Dependency or compiler compromise | Build-time code or toolchain compromise can alter enforcement. | Pin dependencies by immutable digest, verify releases, and use reproducible builds. |
| Protocol parser defects | Malformed input may expose parser behavior not represented in deterministic cases. | Maintain bounded fuzz targets and adversarial corpora; fail closed before typed decoding on malformed, deeply nested, or duplicate-key JSON. |
Assumptions
The security claims require:
- the operator controls policy, runtime templates, protected directories, and the Glove executable;
- the host kernel and platform sandbox behave as documented;
- no agent-visible path contains control secrets, journals, or audit output;
- machine setup and project enrollment are performed by the local operator, outside any remote request or project-provided configuration;
- allowed tools and upstream servers are appropriate for the deployment;
- Linux cgroup v2, namespace, mount, seccomp, and quota prerequisites are available when managed-session capabilities are advertised;
- callers use capability discovery and do not infer support from source code, platform, generated SSH artifacts, executor health, or a non-null runtime object alone.
Deployment review
Before enabling an agent, record:
- Which host paths and environment variables are visible?
- Which MCP tools and argument forms are allowed?
- Which upstream processes run outside the sandbox?
- Is network access denied or restricted to exact destinations?
- Are audit and control files inaccessible to the agent and other principals?
- Are all advertised resource controls enforced on the selected backend?
- Are live host writes absent, and is any future change apply independently authorized?
- Is the host patched and, where needed, enclosed by a stronger VM boundary?
Remote Sage launch should remain gated whenever any mandatory capability or approval class is unavailable.