WIP: Blocker #3 Stage A - Physical Command Security Containment #6

2026-10-15T19:50:55-05:00

lussierj commented

2026-10-15 19:50:55 -05:00

Stage A application containment: Independent security audit PASS.
Blocker #3 overall: NOT PASS.
Production deployment: NOT APPROVED.

This is the sixth draft in the stacked review chain, based on codex/review-05-credential-recovery. It contains exactly one independently validated security commit and its complete 28-file Stage A boundary. Physical miner control remains disabled.

Containment

Retire legacy physical-command HTTP endpoints and command producers. Preserve M30 authorization checks: unprivileged callers receive 403, authorized callers receive 410; M30 cannot create executable work.
Restrict Hub and Windows diagnostic transports to exact, fixed read-only operations. Reject write commands, parameter overrides, malformed inputs, Unicode variants and unsupported identifiers before transport creation.
Reject legacy and unsupported queued commands during polling/result handling and through upgraded Windows dispatch/execution. Dormant Windows physical entry points remain disabled.
Disable current typed physical-control admission pending verified physical-device identity binding and the later Blocker #3 authorization work.
Retire unsupported pending/claimed work atomically with idempotent security audits. Preserve prior request/result/error, timestamps and audit history; audit insertion failure rolls back the command/schedule transition.
Use retained delivery evidence to classify previously claimed commands as execution_outcome=unknown, including commands whose current status was repaired back to pending. Ambiguous history fails conservatively. Pending status alone never proves non-delivery.
Use explicit ordinal PowerShell comparisons and canonical allowlist serialization before socket construction. Physical write commands remain disabled.

Approved implementation identity

Commit: e898f283ab0fc21bac77b63db1c4a9ad35e21562
Sole parent / comparison base: 2d89e80410c1bab015cf74323f86b39db757eea6
Tree: 97806e658f12475c9f7ab933d983396a5a05cf85
Scope: 28 files (11 added, 17 modified), +2,380 / -2,382 lines.
Canonical review patch SHA256: f07f4f0573b2f8773ff15957f86bb67979abdb08cee68beb5a87f1d2c068b9f6.

The commit was constructed from the approved baseline and patch with a temporary Git index. Its patch and message match the approved artifacts byte-for-byte; all 391 committed file blobs and executable modes matched the independently tested reconstruction. No migration, unrelated discovery-isolation, schema-compatibility, Docker build-context, credential/enrollment change, secret material, or physical-control enablement is included. git show --check passes with Windows CRLF handling.

Independent security validation

The final independent revalidation found no remaining material application containment bypass or execution-outcome audit-integrity defect. Tests used disposable PostgreSQL services, simulated miners and instrumented transports; no physical miners or production cutover were used.

11 standalone independent tests passed, including the five retirement paths, claimed-then-requeued history, conservative ambiguity handling, idempotence, real audit INSERT denial, transaction rollback, locking/concurrent claims and Agent/Zone scope checks.
3 additional registered HTTP/Hub-reader containment tests passed. Retired M30/physical producers returned 403/410, and typed physical admission returned 409 without repository/transport activity.
Six invisible-Unicode command examples reached the baseline transport boundary. The candidate rejected 9,336 independently generated malformed PowerShell cases across four cultures with zero socket attempts. Fourteen approved read selections reached the instrumented boundary; the loopback diagnostic compatibility suite passed 2,444 assertions.
The real upgraded Windows dispatcher rejected 24 legacy/physical/malformed queued payloads with zero transport attempts, child processes or reinterpretation as reads.
Fresh credential transition/enrollment integration: 14 tests passed. Cross-Zone transport isolation/registry integration: 5 tests passed.
The checked-in regression tests cover command containment, ordinal validation, claimed/requeued delivery evidence, polling/results, schedule cancellation/deletion, administrative reconciliation, audit rollback, idempotence and concurrency.

PowerShell validation above used PowerShell 7.4 on Linux. It is not native Windows PowerShell 5.1/SYSTEM certification. The final audit reran targeted independent/security integration tests and the two exceptions below; it did not rerun the entire prior broader suite or claim that all broader tests pass.

Two unchanged baseline test exceptions

Both source assertions fail on unchanged 2d89e80 and on the reconstructed candidate. Their method bodies are unchanged; neither was removed or weakened:

backend/tests/test_agent_commands.py — AgentEnrichmentIsolationSourceTests.test_legacy_config_remains_explicitly_legacy_only: expects the obsolete minerops_require_agent_secret(request) source string. Follow up separately by asserting the current authorization/legacy-retirement contract.
backend/tests/test_agent_commands.py — AgentSourceContractTests.test_deployment_preserves_local_state_and_registers_established_tasks: blanket-forbids installer references to agent-config.json, including established protected recovery/preservation behavior. Follow up separately with behavior-oriented preservation and secure-recovery assertions.

Independent baseline and candidate reproductions are retained in baseline-assertion-failures.log and candidate-assertion-failures.log under the final audit evidence directory. These are pre-existing source-test defects, not newly introduced containment/authentication failures, and are not reported as passing.

Old-Agent cutover and deployment gates

The committed old-Agent cutover runbook is part of this review boundary.

Server cancellation cannot revoke a command already downloaded by an old Agent. The independent simulation genuinely delivered a command using baseline, cancelled it using the candidate, then supplied its cached payload to the old executor against an isolated fake miner. Fenced initial/restarted processes made zero writes; premature reconnection made one simulated physical write; restoring the fence prevented further writes. No production device was involved.

Verified network fencing must precede stopping or upgrading old Agents. Stop all old Hub/Agent processes and prevent automatic restarts; drain/reconcile queued work without executing it; preserve unknown outcomes and historical evidence. Offline, unreachable, unverified and returning Agents remain fenced and quarantined. Do not restart or reconnect until upgraded installed hashes, scheduled tasks and fresh process provenance are verified. Cancellation, credential revocation, successful check-in or matching version strings alone do not prove revocation or upgrade. Rollback to old binaries must remain stopped and fenced; it cannot restore unsafe execution/connectivity.

Native Windows PowerShell 5.1/SYSTEM validation, verified old-Agent network fencing, fleet stop/drain/upgrade procedures, and physical-device identity binding remain outstanding. Deployment gates also include task/child-process cleanup, restart/reboot holds, package provenance, ACL/trust state, credential interruption/recovery, safe rollback, real network paths including IPv6/same-L2/established sessions/offline returns, global drain verification and deployed DB-role permissions. These are not satisfied by the synthetic test environment or this draft review.

No production deployment, cutover, VM 250/251 modification, physical-miner access, merge, or Blocker #3 Stages B–E implementation is authorized by this PR.

Retained review evidence

Final independent audit: /tmp/minerops-stage-a-final-revalidation.bekharya/security-final-revalidation-report.txt.
Commit-boundary report: /tmp/minerops-stage-a-commit-boundary.i9lqdfjn/commit-boundary-report.txt.
Local commit verification: /tmp/minerops-stage-a-authorized-commit.ernca_6f/commit-verification-report.txt.

These are retained local evidence paths, not repository-hosted attachments. The implementation, regression tests and cutover runbook are included in the commit.

Stage A application containment: **Independent security audit PASS**. Blocker #3 overall: **NOT PASS**. Production deployment: **NOT APPROVED**. This is the sixth draft in the stacked review chain, based on `codex/review-05-credential-recovery`. It contains exactly one independently validated security commit and its complete 28-file Stage A boundary. Physical miner control remains disabled. ### Containment - Retire legacy physical-command HTTP endpoints and command producers. Preserve M30 authorization checks: unprivileged callers receive 403, authorized callers receive 410; M30 cannot create executable work. - Restrict Hub and Windows diagnostic transports to exact, fixed read-only operations. Reject write commands, parameter overrides, malformed inputs, Unicode variants and unsupported identifiers before transport creation. - Reject legacy and unsupported queued commands during polling/result handling and through upgraded Windows dispatch/execution. Dormant Windows physical entry points remain disabled. - Disable current typed physical-control admission pending verified physical-device identity binding and the later Blocker #3 authorization work. - Retire unsupported pending/claimed work atomically with idempotent security audits. Preserve prior request/result/error, timestamps and audit history; audit insertion failure rolls back the command/schedule transition. - Use retained delivery evidence to classify previously claimed commands as `execution_outcome=unknown`, including commands whose current status was repaired back to `pending`. Ambiguous history fails conservatively. Pending status alone never proves non-delivery. - Use explicit ordinal PowerShell comparisons and canonical allowlist serialization before socket construction. Physical write commands remain disabled. ### Approved implementation identity - Commit: `e898f283ab0fc21bac77b63db1c4a9ad35e21562` - Sole parent / comparison base: `2d89e80410c1bab015cf74323f86b39db757eea6` - Tree: `97806e658f12475c9f7ab933d983396a5a05cf85` - Scope: 28 files (11 added, 17 modified), +2,380 / -2,382 lines. - Canonical review patch SHA256: `f07f4f0573b2f8773ff15957f86bb67979abdb08cee68beb5a87f1d2c068b9f6`. The commit was constructed from the approved baseline and patch with a temporary Git index. Its patch and message match the approved artifacts byte-for-byte; all 391 committed file blobs and executable modes matched the independently tested reconstruction. No migration, unrelated discovery-isolation, schema-compatibility, Docker build-context, credential/enrollment change, secret material, or physical-control enablement is included. `git show --check` passes with Windows CRLF handling. ### Independent security validation The final independent revalidation found no remaining material application containment bypass or execution-outcome audit-integrity defect. Tests used disposable PostgreSQL services, simulated miners and instrumented transports; no physical miners or production cutover were used. - 11 standalone independent tests passed, including the five retirement paths, claimed-then-requeued history, conservative ambiguity handling, idempotence, real audit INSERT denial, transaction rollback, locking/concurrent claims and Agent/Zone scope checks. - 3 additional registered HTTP/Hub-reader containment tests passed. Retired M30/physical producers returned 403/410, and typed physical admission returned 409 without repository/transport activity. - Six invisible-Unicode command examples reached the baseline transport boundary. The candidate rejected 9,336 independently generated malformed PowerShell cases across four cultures with zero socket attempts. Fourteen approved read selections reached the instrumented boundary; the loopback diagnostic compatibility suite passed 2,444 assertions. - The real upgraded Windows dispatcher rejected 24 legacy/physical/malformed queued payloads with zero transport attempts, child processes or reinterpretation as reads. - Fresh credential transition/enrollment integration: 14 tests passed. Cross-Zone transport isolation/registry integration: 5 tests passed. - The checked-in regression tests cover command containment, ordinal validation, claimed/requeued delivery evidence, polling/results, schedule cancellation/deletion, administrative reconciliation, audit rollback, idempotence and concurrency. PowerShell validation above used PowerShell 7.4 on Linux. It is not native Windows PowerShell 5.1/SYSTEM certification. The final audit reran targeted independent/security integration tests and the two exceptions below; it did not rerun the entire prior broader suite or claim that all broader tests pass. ### Two unchanged baseline test exceptions Both source assertions fail on unchanged `2d89e80` and on the reconstructed candidate. Their method bodies are unchanged; neither was removed or weakened: 1. `backend/tests/test_agent_commands.py` — `AgentEnrichmentIsolationSourceTests.test_legacy_config_remains_explicitly_legacy_only`: expects the obsolete `minerops_require_agent_secret(request)` source string. Follow up separately by asserting the current authorization/legacy-retirement contract. 2. `backend/tests/test_agent_commands.py` — `AgentSourceContractTests.test_deployment_preserves_local_state_and_registers_established_tasks`: blanket-forbids installer references to `agent-config.json`, including established protected recovery/preservation behavior. Follow up separately with behavior-oriented preservation and secure-recovery assertions. Independent baseline and candidate reproductions are retained in `baseline-assertion-failures.log` and `candidate-assertion-failures.log` under the final audit evidence directory. These are pre-existing source-test defects, not newly introduced containment/authentication failures, and are not reported as passing. ### Old-Agent cutover and deployment gates The committed [old-Agent cutover runbook](http://192.168.0.158:3000/lussierj/minerops/src/commit/e898f283ab0fc21bac77b63db1c4a9ad35e21562/docs/operations/STAGE_A_OLD_AGENT_CUTOVER.txt) is part of this review boundary. **Server cancellation cannot revoke a command already downloaded by an old Agent.** The independent simulation genuinely delivered a command using baseline, cancelled it using the candidate, then supplied its cached payload to the old executor against an isolated fake miner. Fenced initial/restarted processes made zero writes; premature reconnection made one simulated physical write; restoring the fence prevented further writes. No production device was involved. Verified network fencing must precede stopping or upgrading old Agents. Stop all old Hub/Agent processes and prevent automatic restarts; drain/reconcile queued work without executing it; preserve unknown outcomes and historical evidence. Offline, unreachable, unverified and returning Agents remain fenced and quarantined. Do not restart or reconnect until upgraded installed hashes, scheduled tasks and fresh process provenance are verified. Cancellation, credential revocation, successful check-in or matching version strings alone do not prove revocation or upgrade. Rollback to old binaries must remain stopped and fenced; it cannot restore unsafe execution/connectivity. **Native Windows PowerShell 5.1/SYSTEM validation, verified old-Agent network fencing, fleet stop/drain/upgrade procedures, and physical-device identity binding remain outstanding.** Deployment gates also include task/child-process cleanup, restart/reboot holds, package provenance, ACL/trust state, credential interruption/recovery, safe rollback, real network paths including IPv6/same-L2/established sessions/offline returns, global drain verification and deployed DB-role permissions. These are not satisfied by the synthetic test environment or this draft review. No production deployment, cutover, VM 250/251 modification, physical-miner access, merge, or Blocker #3 Stages B–E implementation is authorized by this PR. ### Retained review evidence - Final independent audit: `/tmp/minerops-stage-a-final-revalidation.bekharya/security-final-revalidation-report.txt`. - Commit-boundary report: `/tmp/minerops-stage-a-commit-boundary.i9lqdfjn/commit-boundary-report.txt`. - Local commit verification: `/tmp/minerops-stage-a-authorized-commit.ernca_6f/commit-verification-report.txt`. These are retained local evidence paths, not repository-hosted attachments. The implementation, regression tests and cutover runbook are included in the commit.

lussierj added 1 commit 2026-10-15 19:50:56 -05:00

security: contain physical miner commands in Stage A e898f283ab

Disable physical control through legacy HTTP/M30 producers, typed admission,
queue dispatch and upgraded Windows executors. Restrict diagnostic transports
to exact read-only operations, with ordinal PowerShell validation before sockets.

Retire unsupported pending/claimed work with atomic, idempotent security audits.
Preserve prior delivery evidence and report unknown outcomes after a prior claim,
including explicitly repaired pending rows. Include containment, cancellation,
concurrency and malformed-payload regressions and the old-Agent cutover runbook.

Validation: independent final application-security revalidation PASS. Two unchanged
baseline source-assertion failures are documented as exceptions. Production release
still requires native Windows validation and verified fencing/stop/drain/upgrade;
server cancellation alone cannot revoke a cached command held by an old Agent.

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This pull request is marked as a work in progress.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin codex/review-06-stage-a-containment:codex/review-06-stage-a-containment

git checkout codex/review-06-stage-a-containment

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: lussierj/minerops#6