Skip to content

Tracker: consolidate security, policy, approvals and sandboxing into the tinysecurity bus module (+ tinybox audit) #7328

Open
Open
Tracker: consolidate security, policy, approvals and sandboxing into the tinysecurity bus module (+ tinybox audit)#7328
Assignees
senamakel
Labels
rust-coreCore Rust runtime in src/: CLI, core_server, shared infrastructure.security-workSecurity hardening, vulnerabilities, or policy work.

Description

@senamakel
senamakel
opened on Oct 10, 2026

Tracker

Phase order: 0 characterization tests → 1 module wiring → 2 config + policy → 3 redaction/SSRF/egress → 4 approvals + auto-approve → 5 sandbox (needs tinybox work) → 6 middleware consolidation → 7 audit + dead-code cleanup → 8 crypto → 9 docs. The tinysecurity and tinybox PRs for a phase merge and release first; only then is OpenHuman repinned (digests copied verbatim from the release checksum.toml, never from a local build).

Why

OpenHuman's security code is duplicated, partially unwired and confusing:

  • 8+ redactors with independent secret-pattern lists: security/core.rs, util/redact.rs, approval/redact.rs, security/scrub.rs, security/pii, core/log_redaction.rs, tools/registry/denials.rs, integrations/composio/tools/redact.rs, agent/tinyagents/middleware/credential_scrub.rs; plus five URL-redaction helpers.
  • 4 SSRF/private-host checks. util/url.rs::host_is_local misses 169.254.x (cloud metadata), CGNAT and IPv6 private/link-local; tinytools_std::url_guard is the complete one; two more loopback checks exist; no resolved-IP/DNS-rebinding check.
  • 3–4 tool-policy layers: tools/agent_policy/, tools/rules/, agent/tool_policy.rs, and the middleware pair approval.rs / tool_policy.rs; ToolPolicyPosture and policy_info_payload copy AutonomyConfig; disallowed_tools is checked in three places.
  • 3 crypto stacks: encryption/ (AES-GCM + Argon2), keyring/crypto.rs, devices/crypto.rs.
  • Unenforced config: max_cost_per_day_cents; Firejail/Bubblewrap + firejail_args + empty ResourceLimitsConfig; SecurityConfig/DaemonConfig.security/AuditConfig unreachable from Config (audit not configurable, covers only shell); PrivacyMode::Sensitive == Standard; from_config hard-codes PrivacyMode::Standard.
  • Dead/confusing: pii::scan has no non-test caller; security/secrets.rs is a one-line alias; security.policy_info exposes 6 of 13+ fields; #[allow(unused_imports)] re-exports hide dead items; overloaded names (core, rpc, policy).
  • tinybox barely used: only tinybox-jail, one Docker one-shot and shell scanners. Cron shell jobs, tinymcp stdio, tinyruntime pools, command hooks, the tinyflows script runner, agent/host_runtime.rs and helper processes run with policy only. agent/host_runtime.rs:181 hand-builds docker run. With no jail, commands run unconfined and report Inactive.

Target architecture

  • Bus-only. OpenHuman depends on exactly one tinysecurity crate, tinysecurity-bus. The module is a compiled native module loaded at boot (LoadPolicy::Boot), reached through attested_proxy (tinybus attestation + registry digest). No tinysecurity library is linked into the host; no dependency is shared. A new CI check (beside scripts/ci/check-crate-chain.mjs) fails if any OpenHuman manifest depends on another tinysecurity-* crate.
  • Host-served callbacks (the modules/memory_host.rs pattern): approval persistence on the storage backend, approval prompt/await, audit forwarding, keyring consent. Init config carries policy and the Jev judge endpoint/credential (resolved through resolve_backend_credential, never in call args).
  • OpenHuman keeps: config schema and one translator to the module's PolicyConfig; RPC namespaces (approval.*, security.*, sandbox.*, encryption.*, which are wire contracts and unchanged); one TinySecurityMiddleware; credentials/auth; SaaS gateway/profiles; pairing UX; executing sandbox plans through tinybox.
  • Fail closed. Module missing/faulted/timed out ⇒ external-effect calls denied; no in-process retry of a faulted module. A tiny host-side deny-list of the credential-store floor remains only until the module is a mandatory boot dependency.
  • Hot path. Every tool call and in-tool path/command check now crosses the bus. Mitigate with coarse Evaluate, batched Check, and a host decision cache keyed by (policy generation, call fingerprint) invalidated on PolicyChanged. A latency benchmark gate (p50/p99, calls per turn) lands before any caller is migrated; if too slow the fix is batching/caching, not linking the library.

Step-by-step plan

Phase 0: Characterization tests (precondition for every move)

Add Rust tests that pin current behavior so migrations are provably neutral:

  1. tests/json_rpc_e2e.rs-style coverage for approval.* (list_pending, decide, preauthorize_flow, get_gate_state), security.policy_info, sandbox.*, encryption.*. Add [[test]] entries in crates/openhuman-cli/Cargo.toml (path = "../../tests/<name>.rs"), pnpm rust:layout clean.
  2. Gate behavior: allowlist short-circuit, park/decide/TTL (10 min; copilot/sub-agent 3 min) fail-closed, restart survival, cron origin denies external effects, auto_approve_all bypass (document that it writes no audit row today), flow-trust grants.
  3. Policy: command classes, forbidden/trusted roots, always-forbidden floor with autonomy disabled, rate limiter.
  4. Sandbox resolution: SaaS ⇒ sandboxed, env override, agent mode precedence, Noop ⇒ Inactive.
  5. Redaction corpus: one shared fixture of secrets/PII/paths run against every existing redactor, recording what each catches (this becomes the acceptance corpus for the unified redactor and exposes the gaps).
  6. Bus latency baseline for the existing in-process path.

Phase 1: Module wiring (follows migrate-to-submodule)

  1. git submodule add https://github.com/tinyhumansai/tinysecurity vendor/tinysecurity pinned to the released tag; .gitmodules entry.
  2. Registry record in crates/openhuman-core/src/modules/registry/ (copy records_docs_wallet.rs shape): bus_name = ai.tinyhumans.tinysecurity.Policy, object_path, version, release_url, 11 PlatformAssets (sha256 verbatim from checksum.toml), load: LoadPolicy::Boot; wire into registry.rs ALL; case in registry_tests.rs.
  3. scripts/ci/check-module-pins.mjs: add tinysecurity: { submodule: "vendor/tinysecurity" } to PIN_MAP; run check-submodule-monotonic.mjs.
  4. crates/openhuman-core/Cargo.toml: tinysecurity-bus = { path = "../../vendor/tinysecurity/crates/tinysecurity-bus", optional = true }; feature security-module = ["modules", "dep:tinysecurity-bus"]; forward through openhuman-embed, openhuman-tinyhumans, openhuman-rpc, openhuman-cli, openhuman-tui and the app's forwarded set; add to scripts/ci/product-features.txt (it ships; consider default-on); check-feature-forwarding.mjs green; test gate on and off.
  5. Host adapter crates/openhuman-core/src/modules/security.rs (+ security_tests.rs): ensure_loaded, attested_proxy, typed client over tinysecurity-bus constants (no string literals), init/reinit with PolicyConfig, host-callback server for store/prompt/audit/consent.
  6. CI: build the native test module in ci-full.yml and test-reusable.yml (as tinysearch does), export a TINYSECURITY_TEST_MODULE override; release-staging/production workflows list the bundled module version.
  7. New CI check enforcing the bus-only dependency rule.

Phase 2: Config consolidation + policy

  1. One [security] table (autonomy, sandbox, privacy, audit, approval TTLs, auto-approve/judge) with a single translator to PolicyConfig in the host; remove the unreachable SecurityConfig/DaemonConfig.security; expose AuditConfig in Config. Keep migrations in config/migrations/ for renamed fields.
  2. Fix from_config (no hard-coded PrivacyMode::Standard); make security.policy_info return the complete effective policy from the module.
  3. Replace SecurityPolicy / ToolPolicyPosture / policy copies with bus Evaluate/Check; tools (shell, filesystem, network gates) call Check through a small host client with the decision cache. tinybox_core::shell::{classify,scan} calls in security/policy/command_checks.rs go away (moved into the module).
  4. Decide max_cost_per_day_cents: enforce in the module (needs a cost callback) or delete the field with a migration.
  5. live_policy.rs becomes the init/reinit driver + generation counter for the cache.

Phase 3: Redaction, SSRF, egress/privacy

  1. Delete the 8+ redactors and URL-redaction helpers; route to bus Redact with a mode enum. Local helpers needed in hot logging paths (Sentry scrub_secrets, rpc_log) call the module through a cached, batched client or keep a minimal documented floor (decision recorded in an ADR).
  2. Delete util/url.rs::host_is_local and the extra loopback helpers; use bus UrlGuard incl. resolved-IP check; tools/impl/network/host.rs, modules/browser.rs, composio loopback checks migrate.
  3. PrivacyMode::Sensitive: implement per the module spec or remove; egress descriptors/enforcement via bus EgressCheck; web_chat/egress_surface.rs and inference/provider/factory use it.
  4. Prompt-injection (agent/bus.rs, session_host/runtime/run_loop.rs, mcp/registry) via bus ScanPrompt/ScanToolDefinition; reconcile with tinymcp sanitize and tinyskills scan (call them from the module or document the split).

Phase 4: Approvals + auto-approve

  1. Migrate ApprovalGate (security/approval/*, ~4.8k LOC): parking future stays host-side, state machine/TTL/log in the module; ApprovalStore served from the host storage backend (approval/store*.rs become the host callback impl); keep approval.* RPC and ApprovalRequested/ApprovalDecided events (bump EVENTS_VERSION only if the event shape changes).
  2. ApprovalSecurityMiddleware → calls Evaluate, parks on RequireApproval(request_id), resumes on Decide.
  3. Auto-approve: move autonomy.auto_approve, auto_approve_all, flow trust, approve_always_for_tool persistence (config save + live reload) behind the module. auto_approve_all must write audit rows. Add the Jev judge setting ([security.auto_approve.judge]: enabled, per-origin opt-in, thresholds, endpoint via backend credential); off by default; fail-to-human on any error; UI shows auto:jev decisions in the log.
  4. SaaS: today SaaS bypasses approval parking ("no per-user approval surface yet"). Decide and implement the SaaS approval path (per-user prompt channel or Jev-only with strict thresholds), documented.
  5. Frontend: approval log view shows judge verdicts; i18n for all locales (useT(), pnpm i18n:check).

Phase 5: Sandbox (depends on tinyhumansai/tinybox#27)

  1. Module returns SandboxPlan; host adapter SandboxPlan → tinybox BoxSpec/Placement (Resources, NetworkPolicy, grants incl. the credential-store floor). sandbox/ops.rs resolve_* logic moves to the module; execution (execute_in_sandbox, spawn_with) stays host-side.
  2. Fail closed: untrusted tiers refuse Noop using SandboxCapabilities::is_suitable_for_untrusted_code(); surface in sandbox.* RPC and UI.
  3. Replace agent/host_runtime.rs DockerRuntime hand-built docker run with tinybox_docker::OneShot.
  4. Wire tinybox-linux so Firejail/Bubblewrap config values work (map to namespace) or remove them and firejail_args/ResourceLimitsConfig with migration.
  5. Route unsandboxed spawners through the jail at minimum: cron shell_job.rs, tinymcp stdio, tinyruntime pools/pyserver, command hooks, tinyflows script runner, install_tool; route untrusted sources (MCP-installed servers, downloaded skills) to microvm where KVM exists. Browser/tinycomputer processes: assess and document.
  6. OPENHUMAN_SANDBOX=off: never applies under SaaS (test pins sandbox/ops.rs:59 ordering); boot_guard keeps protecting it.

Phase 6: Middleware consolidation

One TinySecurityMiddleware (beside agent/tinyagents/middleware/approval.rs, registered before the other tinyagents middleware) maps module Decision → tinyagents PolicyDecision. Remove tools/agent_policy/, the duplicate parts of agent/tool_policy.rs, ToolPolicyMiddleware wrapper duplicates and the three disallowed_tools checks; keep ToolRules as the declarative input (built on tinytools, single copy). Upstream-first for anything generic (tinytools/tinyagents), per CLAUDE.md ownership.

Phase 7: Audit + dead-code cleanup

  1. One audit log (approvals, shell, sandbox decisions, judge verdicts, policy changes) through the module; mcp/audit becomes a facade or stays tinymcp-owned (decision recorded).
  2. Delete: pii::scan (unless adopted), security/secrets.rs alias, security/core.rs, #[allow(unused_imports)] re-exports, dead config from the list above; rename overloaded modules; remove each old test file with its code.
  3. Wire tinycomputer consequence/payment gates and tinyskills scan verdicts into the approval/policy path (or document why not).

Phase 8: Crypto/keyring/pairing

Move encryption/core, keyring backends/crypto, devices/crypto, pairing behavior into the module (tinysecurity T11); keep keychain consent UX, credentials/auth and device sockets host-side. web3 (web3/seams.rs, x402/seams.rs) calls encryption.* RPC unchanged.

Phase 9: Docs

CLAUDE.md submodule-ownership row for tinysecurity and the module/bus-contract table; gitbooks/developing/loadable-modules.md (record count, 11 builds), gitbooks/features/approval-gate.md, gitbooks/features/privacy-and-security.md; crates/openhuman-core/src/security/README.md and approval/README.md reduced to host adapters; platform/about_app/ for user-visible capability changes (Jev auto-approve); pnpm docs:generate + docs:check.

Cross-OS end-to-end tests (required)

Each phase's PR includes e2e on Linux, macOS and Windows using the real released module artifact (no mocking of the module or of OS isolation); mock backend only for network services. Matrix runs in CI Full (ubuntu-24.04, macos-15/macos-26, windows-2025; arm64 where the release matrix has it).

Flow Linux macOS Windows
Module load at boot .so digest admission; tampered digest ⇒ deny external effects .dylib (+ quarantine/codesign) .dll; locked-file replacement on update
Approval round trip (RPC + UI event) park → decide → TTL → restart survival same same, path/locking differences
Auto-approve + stub Jev judge allow, low-confidence ⇒ human, timeout ⇒ human, Deny never overridden same same
Path policy through tools floor for ~/.ssh; symlink/.. escapes APFS case-insensitivity, /private/var drive/UNC/\\?\/8.3/reserved names
Shell tool classification sh/bash zsh PowerShell + cmd quoting via platform_shell.rs
Sandbox execution through tinybox Landlock/bwrap/microvm (KVM job)/docker Seatbelt/docker AppContainer/docker; untrusted tier refuses Noop
Redaction in logs/Sentry/approval rows /home/x /Users/x C:\Users\x, %USERPROFILE%
SSRF (http_request, browser) metadata IP, rebinding same same incl. IPv6 zone IDs
Keyring/crypto Secret Service / file Keychain Credential Manager
Fail closed module killed ⇒ external effects denied; no retry same same

Frontend flows additionally get mocked-desktop e2e under app/test/e2e/specs/ (approval prompt, log, judge badge); E2E code uses helpers/element-helpers.ts.

Definition of done

  • The only tinysecurity dependency is tinysecurity-bus; CI enforces it.
  • One redactor, one URL guard, one policy/approval path, one audit log; the lists above are deleted.
  • Every config field is enforced or removed; policy_info is complete.
  • tinybox is used through BoxSpec/plans for every untrusted spawner; no silent Noop for untrusted tiers.
  • Characterization suite green before and after each phase; three-OS e2e green; pnpm rust:layout, pin/feature-forwarding checks, pnpm docs:check green.
  • Bus latency budget met (benchmark committed).

Activity

  1. senamakel
    added
    security-workSecurity hardening, vulnerabilities, or policy work.
    rust-coreCore Rust runtime in src/: CLI, core_server, shared infrastructure.
    on Oct 10, 2026

  2. senamakel commented on Oct 14, 2026

    @senamakel
    senamakel
    on Oct 14, 2026
    MemberAuthor

    Tool-policy placement note (from #7627, tinytools#66, OpenHuman #7726/#7773/#7787).

    Current split, at the pins on main:

    • Generic classification engine (ToolPolicyEngine, ToolPolicySession, agent_policy vocabulary, registry types/denials, deferred exposure) lives in tinytools (nested vendor/tinyagents/vendor/tinytools). It is a kernel library: no bus contract, no [components] toggle, no registry record.
    • OpenHuman keeps only host policy: tools/rules (operator deny/allow layers, deny-overrides, child inherits operator layers only), tools/policy_session.rs (builds the session from host config and traces under [tool-policy]), the approval gate, and AutonomyConfig.

    Proposed placement for #7328:

    1. Keep the tool-classification engine in tinytools. tinysecurity should not absorb it, because tinytools is a dependency of tinyagents and tinysecurity sits above it.
    2. tinysecurity owns the decision inputs it already plans to take: autonomy posture, approvals, redaction, SSRF, sandbox. It should expose them as plain data that the host feeds into ToolPolicyEngine (posture and deny/allow rules in, classification out), not by reimplementing the engine.
    3. The "3-4 tool-policy layers" cleanup in Tracker: consolidate security, policy, approvals and sandboxing into the tinysecurity bus module (+ tinybox audit) #7328 (agent/tool_policy.rs, the approval/tool_policy middleware pair, disallowed_tools in three places) is host-side and belongs in phase 2/6 there; it should consume tinytools::ToolPolicyEngine rather than add a second engine.
    4. ToolPolicyPosture / policy_info_payload copying AutonomyConfig should be replaced by tinysecurity's config type in phase 2.

    Nothing further is needed in #7627. Closing it, with #7702 and #7541 whose checklists are done (#7623, #7624, #7627, #7628). Open follow-ups live in #7328.

  3. senamakel
    added 3 commits that reference this issue on Oct 14, 2026

    test(approval): prove judge fallback matrix, auto_approve_all audit a…

    a8d6b1c

    feat(bus): ConsequenceHost review of approved irreversible and paying…

    2b70495

    docs(security): document fail-closed TinySecurity module

    ac02418

  4. senamakel commented on Oct 15, 2026

    @senamakel
    senamakel
    on Oct 15, 2026
    MemberAuthor

    Progress on PR #7331 (draft, Part of this issue). Done: phases 0 and 1 (characterization suite, module wiring, registry/pins, bus-only CI check, security-module default-on) and part of phase 2 (scoped policy via bus). Pinned to tinysecurity v0.7.0 and tinybox 0.1.34. Remaining: authenticated authority for RegisterPathPolicy, the measured latency gate, the shell/network gate migration, phases 3-9, three-OS e2e. No checklist items are ticked because none of the Definition of done items is fully met. Details in the PR body.

  5. senamakel
    added 2 commits that reference this issue on Oct 16, 2026

    fix(approval): report the subject handle only to a registration that …

    7869234

    Merge pull request #113 from senamakel/epic-7328-p7-cleanup

    a4474c1

  6. senamakel commented on Oct 18, 2026

    @senamakel
    senamakel
    on Oct 18, 2026
    MemberAuthor

    Handoff, 2026-10-18. Draft PR #7331 is now at the fork epic tip a58464dfc6, pinned to tinysecurity v0.14.0 (contract 1.21). Its body holds the full handoff: what has merged, the remaining steps in order, the rules, and the open decisions.

    Where it stands

    Next steps

    1. Finish fix(policy): Windows-normalized parent segments count as traversal tinysecurity#33 and merge it once CI is green.
    2. Release tinysecurity v0.15.0.
    3. Merge the three host branches into the epic, never rebasing them.
    4. Re-pin to v0.15.0 with release-and-repin.mjs --version 0.15.0.
    5. Run the full gates, including the full lib suite and the released-archive ignored tests.
    6. Merge upstream main into the epic, push to security-bus-7328, and mark feat(security): vendor TinySecurity and migrate filesystem authorization #7331 ready.

    Still open

  7. senamakel
    self-assigned this
    on Oct 18, 2026

  8. senamakel commented on Oct 18, 2026

    @senamakel
    senamakel
    on Oct 18, 2026
    MemberAuthor

    core-shrink audit: rows handed to this tracker

    The reworked #7390 audited every non-test file in crates/openhuman-core/src/ that no domain epic owns (198.6k lines, 2026-10-18 on main a48737721c). These rows match this tracker's tinysecurity target, so #7390 files no leaves for them. They are listed here so your phases can pick them up. Paths are relative to crates/openhuman-core/src/.

    File Lines Verdict Target / upstream symbol
    config/schema/channels.rs 96 RELOCATE config/schema/security.rs (new name)
    config/schema/privacy.rs 54 REIMPLEMENT tinysecurity_bus::egress::PrivacyMode (~/work/tinysecurity/crates/tinysecurity-bus/src/egress.rs:7)
    config/ops/sandbox.rs 170 REIMPLEMENT vendor/tinybox/crates/tinybox-jail/src/detect.rs::pick_backend
    security/secret_storage/encrypted_file_backend/key_source.rs 130 REIMPLEMENT ~/work/tinysecurity/crates/tinysecurity-crypto/src/keyring/mod.rs (MasterResolver, MasterMint, LegacySource) and tsd `file::{HexK...
    security/secret_storage/encrypted_file_backend.rs 680 REIMPLEMENT tsd file::{FileImportSource, prepare_file_import, cleanup_file_import, recover_file_import_source} (file/migration.rs) and `load_or_c...
    security/secret_storage/encrypted_store.rs 715 REIMPLEMENT ~/work/tinysecurity/crates/tinysecurity-crypto/src/secretstore/mod.rs (SecretCipher: enc2, legacy enc:, decrypt_and_migrate) via ...
    security/approval/flow_surface.rs 21 REIMPLEMENT tinysecurity-bus approval_scopes (RegisterApprovalScope2 / RetireApprovalScope2), #7328 phase 4
    security/approval/gate_state.rs 514 REIMPLEMENT tinysecurity-bus Decide2 / RecordExecution2 / ListApprovals2 / PreauthorizeFlow2
    security/approval/redact.rs 252 DELETE tinysecurity-bus RedactMode::StructuredArguments / HomePath (module impl: `~/work/tinysecurity/crates/tinysecurity-redact/src/struc...
    security/approval/store_flow_trust.rs 78 REIMPLEMENT tinysecurity-bus PreauthorizeFlow2 and the auto:flow-grant scope
    security/approval/store_import.rs 330 REIMPLEMENT tinysecurity-bus ImportApprovalHistory2
    security/audit.rs 340 REIMPLEMENT tinysecurity-audit (sink.rs, event.rs, rotation.rs) via tinysecurity-bus audited
    security/core.rs 12 DELETE tinysecurity-bus RedactMode::LegacyMask
    security/live_policy.rs 330 REIMPLEMENT tinysecurity-module SDK reinit (generation plus PolicyChanged)
    security/policy/command_checks.rs 616 REIMPLEMENT tinysecurity-policy command_shell/* and command_registry.rs
    security/policy/path_checks.rs 728 REIMPLEMENT tinysecurity-policy path.rs, path_scope.rs, scoped.rs via bus CheckPath / ValidatePath / RegisterPathPolicy
    security/policy/types.rs 431 REIMPLEMENT bus PolicyInfo and policy config, with SecurityPolicy as a thin host view
    security/scrub.rs 32 REIMPLEMENT tinysecurity-bus RedactMode (Text, CredentialsOnly)
    security/devices/crypto.rs 362 REIMPLEMENT tinysecurity_crypto::device (KeyPair, SessionKeys, Role, seal/open, seal_handshake/open_handshake/seal_ack/open_ack) in `~/wo...
    security/egress/enforce.rs 147 REIMPLEMENT tinysecurity_egress::privacy::check and tinysecurity_bus::{PrivacyMode, EgressPolicy, ScopedEgressRequest} (#7328)
    security/encryption/core.rs 89 DELETE Replacement is tinysecurity-crypto/src/password.rs (same Argon2id and AES-256-GCM scheme) if it is ever needed
    security/prompt_injection/detector.rs 528 REIMPLEMENT tinysecurity-redact prompt Scanner, ScanPromptRequest and ScanToolDefinitionRequest through tinysecurity-bus (`tinysecurity-bus...
    util/redact.rs 66 DELETE tinysecurity_redact::Redactor (#7328), or tinymemory_core::util::redact
    core/log_redaction.rs 66 REIMPLEMENT tinysecurity tinysecurity-redact (crates/tinysecurity-redact/src/patterns.rs and lib.rs::Redactor::redact), through tinysecurity-bus
    core/rpc_log.rs 60 REIMPLEMENT tinysecurity tinysecurity-redact (structured.rs, structured JSON redaction)
    integrations/composio/tools/redact.rs 141 REIMPLEMENT ~/work/tinysecurity/crates/tinysecurity-redact/src/lib.rs (Redactor, RedactorConfig.secrets), reached via tinysecurity-bus (#7328)
    hosting/tools.rs 224 UPSTREAM vendor/tinyhosts/crates/tinyhosts-bus (launch and rollback orchestration); tinyagents-harness-tools (#8088) for the Tool adapter

    Findings the audit adds for your phases:

  9. senamakel commented on Oct 18, 2026

    @senamakel
    senamakel
    on Oct 18, 2026
    MemberAuthor

    Progress after the handoff:

    TinySecurity #1, TinyBox #27, and TinyBus #76 remain open. None of the unfinished platform enforcement or migration work is being treated as complete.

  10. senamakel commented on Oct 18, 2026

    @senamakel
    senamakel
    on Oct 18, 2026
    MemberAuthor

    TinySecurity v0.15.0 (contract 1.22) is published at 26db0d31d47a6d09d87e1095a53574da5379e5ba. Release run 39169878119 passed all 16 platform bundles and verification of the published module through TinyBus. All 16 archive hashes match the published checksum manifest and GitHub asset digests.

    The local host integration is re-pinned in 31bc1297fff3fc289ee71677d5141992d087b167; strict default Clippy, default/no-default core checks, documentation and static checks passed. This commit is not yet in #7331's published head, which remains draft at a58464dfc6.

    TinyBus #92 is merged and #76 closed; TinySecurity #38 consumes the fix and removes the advisory exceptions. TinySecurity #37 is also merged. Current-main integration has 133 conflicts and needs an upstream TinyAgents terminal-outcome hook for reliable failure/cancellation auditing.

    Phase 8 remains full scope: existing paired channels need module-owned import of their distinct encrypted core keys, plus recovery of durable confirmations whose responses are lost. Both are being implemented before host migration. TinyBox #96 has one final availability regression being fixed; #98/#101 prepare the required deprecation release. TinyBox #27's actual platform enforcement remains unfinished. The expanded current-work section in #7331 records these details.

  11. senamakel commented on Oct 18, 2026

    @senamakel
    senamakel
    on Oct 18, 2026
    MemberAuthor

    Current integration findings and owning-repository work:

    • TinyAgents #498 is open and ready for review. It reports approved-call terminal outcomes, including typed failure/cancellation and abandoned futures, exactly once while preserving the original result/control. The old cancellation path reproduced zero callbacks; the final focused suite passes 29 tests and strict Clippy. Host consumption waits for the upstream dependency.
    • TinySecurity Work on closing the conscious loop #35 has green CI, but merge is held for a confirmed clock-ordering problem: concurrent workers sample time before the registry mutex, and a delayed earlier sample can permanently fault all device scopes. The fix samples inside the registry transition and keeps frame crypto outside the mutex. A deterministic regression and full gates are required before merge.
    • The new phase-8 import/recovery native module builds, but its loaded-module fixture currently fails while preparing legacy ciphertexts. Focused bus/crypto tests are not being counted as runtime completion. Existing device pairing explicitly used encryption-enabled SecretStore, so the actual available legacy key records are encrypted even when the general secrets encryption setting was disabled.
    • A fresh browser audit confirmed an additional required owning-repository capability: TinyComputer #111. Current TinyComputer documents that DNS is not resolved and subresources are not checked. OpenHuman navigation preflight therefore cannot prove connection-time SSRF/rebinding enforcement. This remains in scope and needs module transport enforcement and real browser tests.

    The published OpenHuman PR remains a draft. Main integration preserves the newer hosted-layer and TinyAgents ownership extractions; the existing three-OS module policy fixture is only part of the epic’s required end-to-end coverage.

  12. senamakel commented on Oct 19, 2026

    @senamakel
    senamakel
    on Oct 19, 2026
    MemberAuthor

    Progress on #7328:

    • TinyAgents #498 and #500 are merged after their checks passed. They add terminal outcome callbacks and an optional admission/audit callback for allowed calls; OpenHuman wiring is still in progress.
    • TinySecurity #38 and TinyBox #98 are merged. The former consumes the merged TinyBus dependency/security cleanup; the latter documents the one-release command-policy deprecation before contract 2.0 removes it.
    • The integration checkout passes the desktop app cargo check, default workspace check, strict default/no-default Clippy checks, and the recorded focused tests. These results predate the current-main integration, whose textual conflicts are resolved and whose lockfiles and behavior still need validation.
    • Host review found a headless non-shell module-failure bypass and approvals-disabled handling that concealed external-effect metadata from the module. Both are assigned for correction and behavioral regression tests before the host change is published.
    • Phase 8 pairing/import/recovery passed a loaded-module native run, including the race cases. Clippy refactoring followed, so that artifact result is historical until the final source is rebuilt and the full gates rerun.
    • TinyBox docs: REPL / interactive shell design (#92) #96 and [Tech debt] Remove dynamic imports from app/src (static imports only) #102 still await macOS CI. Linux native resource enforcement is being implemented separately; the fractional CPU quota rounding bug now has a failing-before/passing-after regression and passing Linux tests, but the complete native jail path is unfinished.

    PR #7331 remains draft. The complete original epic scope, including browser transport enforcement and the remaining platform/runtime flows, remains open.

  13. senamakel commented on Oct 19, 2026

    @senamakel
    senamakel
    on Oct 19, 2026
    MemberAuthor

    Dependency and verification update:

    PR #7331 remains draft. Native resource containment, audit wiring, host/runtime migration, browser transport enforcement and the original cross-platform requirements remain open.

  14. senamakel commented on Oct 19, 2026

    @senamakel
    senamakel
    on Oct 19, 2026
    MemberAuthor

    TinyBox v0.1.39 is published at e8beaf1e42a2d0cc48bf611f48e4d2174ccb6312, including #96, #98 and #102. Release run 39183441172 passed all 17 platform package jobs and publication. All 17 archive hashes match both the published checksum manifest and GitHub asset digests. I also downloaded the Ubuntu 24.04 x86_64 archive, verified its hash, and loaded it through TinyBus with the verifier built from the exact tag. Native execution, Cancel/Close and child/descendant cleanup passed. The host pin update is assigned; it has not been pushed to OpenHuman #7331 yet.

    TinySecurity #35 is merged at 77b058046559df0545e7abd62bb35f05bcc487cd after all 23 checks passed or completed neutrally and fresh feedback had no unresolved objections. #36 now merges canonical main at 0300d0391b8ed80eabcd9882b64b53eb0cafe9a9 and is ready for review: formatting, all 1,162 workspace tests and strict Clippy passed; hosted checks are running. Pairing #39 remains a dependent draft. Its Rust 1.99 test-assertion lint fix is pushed at 279d751d7b142507c60b9af68b3e1cfbf49a0210; eight pairing tests and strict Clippy pass, with hosted CI rerunning.

    The current-main host merge compiles its core library. A real TinyHumans endpoint-resolution regression failed before the fix and passes afterward, including IPv4/IPv6 loopback and nonlocal/lookalike controls. Core test-target migration repairs still precede the remaining module-fault, combined policy gate, audit, egress and cron behavioral validation.

    Native resource work now has passing full workspace tests and live resource/escape/cleanup proofs, but strict lint cleanup, final coverage/hosted CI and its owning PR remain unfinished. Browser connection-time enforcement is being implemented in TinyComputer with a minimal bus callback to TinySecurity; actual socket enforcement and platform containment remain required. TinyBox #27, TinyComputer #111 and the full Phase 8 host migration remain open scope. OpenHuman #7331 stays draft; its published head has not changed.

  15. senamakel commented on Oct 19, 2026

    @senamakel
    senamakel
    on Oct 19, 2026
    MemberAuthor

    Resumed the remaining epic work and rechecked current sources and GitHub state.

    • TinyBox Fix/skills 3 #103 at 51fd6cfa667d1d66c01c0fdd4490f01cfec66933 has all hosted checks green, including required live Linux resource enforcement and the three-platform feature/module jobs. It remains a dependent draft on [Feature] Discord notifications for new GitHub releases (changelog / revision) #100 and the host adapter; this does not complete tinybox#27.
    • TinySecurity Feat/memory flow #36 at 94231ea5987f967fec241572fd1a32693369ce09 still fails the Windows native contract: a prospective Microsoft credential-store path uses lowercase components instead of the native spelling. Its two review threads and the failure are being addressed before merge. fix: remove standalone bins from Cargo.toml to fix Tauri bundler failure #39 remains a dependent draft and also needs the Windows correction.
    • The local OpenHuman integration branch preserves the upstream-main merge and prior integration history. Regression tests now demonstrate and fix two approval bypasses: desktop approvals off no longer drops external-effect metadata, and it cannot waive a session-level approval requirement. Full production gate wiring and mandatory terminal-audit persistence are still being implemented and tested.
    • The TinySecurity browser destination-lease contract and TinyComputer authenticated proxy pass local compile, strict Clippy, tests, and four real Chromium fixtures. Review found response traffic can reset the periodic lease timer; a regression and repair are required before publication. Native confinement against direct browser network channels on Linux, macOS and Windows remains open.
    • TinyBox v0.1.40 was published independently, adding the Bubblewrap jail backend. Its 17 archive digests match the published manifest/GitHub asset digests, and the downloaded Ubuntu archive matches the manifest. Published module loading is being checked before the host consumes it.

    OpenHuman #7331 remains a draft. Remaining host migration, crypto/pairing adoption, native containment, and the full required cross-OS matrix are not complete.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

rust-coreCore Rust runtime in src/: CLI, core_server, shared infrastructure.security-workSecurity hardening, vulnerabilities, or policy work.

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions