Repository navigation
Complete native security engines and scoped policy enforcement - #5
Merged
Merged
Conversation
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
|
Warning Review limit reached
This review includes 144 billable files and costs up to $36.00. View limit details
Comment |
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Co-authored-by: Medulla <medulla@tinyhumans.ai>
senamakel
marked this pull request as ready for review
October 11, 2026 06:39
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 03d5e36e7a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+352
to
+354
| /// Deliberately NOT flagged here: plain redirects (`>`, `2>&1`, `2>/dev/null`), | ||
| /// `tee`, and `${VAR}` expansion. `classify_command` already lifts a redirect / | ||
| /// `tee` to `Write`, so the gate prompts and — once the human approves — the |
There was a problem hiding this comment.
In POSIX harness-gated scopes, ${...} is deliberately omitted from hidden-execution detection, but parameter expansion can introduce executable find predicates after classification. For example, with UNSET absent, find . -maxdepth 0 ${UNSET:--exec} touch /tmp/pwn '{}' \; is classified as Read because the scanner never sees a literal -exec, then the shell expands it and executes touch; this bypasses ReadOnly and runs without approval. Treat expansion in security-sensitive arguments as hidden execution or fail the classification closed.
AGENTS.md reference: AGENTS.md:L18-L20
Useful? React with 👍 / 👎.
| "log", | ||
| "diff", | ||
| "show", | ||
| "remote", |
There was a problem hiding this comment.
When the command is git remote add, git remote remove, or git remote set-url, checking only the first Git subcommand marks it Read, so a read-only harness scope allows repository configuration changes; the allowlisted path also considers these arguments safe and assigns them low risk. Distinguish the observational git remote/git remote -v forms from its mutating nested subcommands.
AGENTS.md reference: AGENTS.md:L18-L20
Useful? React with 👍 / 👎.
Comment on lines
+116
to
+117
| let mut scoped = audit.clone(); | ||
| scoped.scope = registration.subject.clone(); |
There was a problem hiding this comment.
When approvals register multiple subjects with audit.native_path set, every per-scope client clones the same path and stream ID and changes only scope. Consequently all clients open one journal, but JsonlSink::append_locked rejects any recovered row whose scope differs (sink.rs:154-156), so after one subject writes an audit event every other subject's required audit—and therefore approval—fails. Partition the native journal/stream per registered scope or make the journal support independent scoped streams.
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the remaining native TinySecurity engines for tinyhumansai/openhuman#7328 and TinySecurity #1, following the merged immutable path scopes in #4. OpenHuman integration remains in tinyhumansai/openhuman#7331.
Implemented and independently reviewed:
Immutable command policies, POSIX/PowerShell/cmd parsing, unconditional credential protections, distinct harness-gated and allowlisted execution rules, and atomic raw-command hourly accounting. Full scoped tool rules and parked/resumed reservation deduplication remain part of the pending policy composition.
One native redaction registry with init-only literal credentials, explicit legacy and structured/endpoint modes, bounded secret/PII handling, and real prompt/tool-definition scanning integrated into conservative policy decisions. Regressions cover primitive JSON credentials, normalized URL and key collisions, retained endpoint tokens, and credential-transfer instructions. Scanner findings never grant authorization.
Native scoped URL/privacy decisions with DNS candidate validation, stricter Sensitive inspection, request-bound expiring one-time transport authorizations, and real HTTP/TLS pinning fixtures. Consuming these authorizations in production transport owners remains pending; fixtures demonstrate the contract rather than claim current OpenHuman rebinding protection.
This is the single cumulative owner PR. It remains a draft while final audit integration tests, scoped policy composition, durable approvals, auto-approval/Jev, sandbox planning, and crypto/keyring/pairing are completed and reviewed. Authenticated incoming TinyBus context is implemented in tinyhumansai/tinybus#46; that prerequisite remains independently reviewable. It must not merge until the full implementation and platform checks pass. The description will be rewritten around the final change before marking ready.
At egress checkpoint
87d909f, all local gates pass: formatting, strict all-target/all-feature Clippy, default and all-feature tests, all-target builds, MSRV 1.88, warning-denying rustdoc, dependency checks, per-source-file coverage above 90%, and actual Linux native module loading/dispatch from two working directories. Hosted Linux, macOS and Windows native CI, MSRV, docs and supply-chain checks also pass (runs 38089097165 and 38089100777). Later engines and the final cumulative revision require fresh checks.Audit checkpoint
94b0d31implements authenticated native ingress, exact V2 receipts, required versus optional failure handling, original-request-bound audited permission calls, and bounded journal sinks. Unix uses descriptor-relative protected files. Windows requires a preprovisioned protected NTFS namespace and journal; actual-handle ACL checks and retained share-enforced directory handles reject unsafe ancestors and replacement. Views are reconstructable; the synced journal determines commitment and exact retry. Capacity limits fail closed, and an indeterminate timeout never claims rollback.The exact
94b0d31native matrix passes Linux, macOS and Windows (run 38097091889). Windows executes 11 focused ACL/path/rotation/recovery tests and three subprocess lock/crash/retry tests. Required directory pinning has genuine native RED-to-GREEN evidence, as do protected inheritance flags and rotation denial. These tests prove process recovery; they do not claim power-loss namespace guarantees. Later loaded-module real-sink permission and ordinary-account checks are still being completed and require their own exact-head CI. The previous lint and coverage failures are resolved; final cumulative gates and independent audit review remain required before readiness.