Skip to content

Commit 9f5b061

Browse files
SecAI-Hubclaude
SecAI-Hub
and
claude
committed
Wire enforcement chains and close security review gaps (M42)
- Wire integrity-monitor → incident-recorder: violations auto-report with severity classification (high/critical) and evidence - Wire runtime-attestor → incident-recorder: degraded/failed attestation states trigger incident reports with TPM evidence - Wire incident-recorder → containment execution: freeze agent, disable airlock, force vault relock, quarantine model via HTTP - Fix data races: pass token/endpoint snapshots to goroutines instead of reading globals (all 3 services) - Add CI supply-chain verification job: Syft SBOM generation, cosign availability, release workflow provenance validation - Fix security-status.md: remove stale "planned" entries (HSM is M41), add M42 milestone - Update README.md: 42 milestones, 25+ defense layers, 348 Go tests, all 9 Go services in project structure, new component docs - Update architecture.md: enforcement chain diagram, verification & enforcement layer, 16 trust boundaries, updated dependency graph - Update test-matrix.md: accurate counts (348 Go, 658 Python) - Add 7 enforcement chain integration tests verifying full paths: violation → incident → containment dispatch - Total: 348 Go tests, 658 Python tests (~1006 total) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent b7f25d4 commit 9f5b061

16 files changed

Lines changed: 1874 additions & 89 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,3 +132,66 @@ jobs:
132132
steps:
133133
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
134134
- run: bash .github/scripts/check-action-pins.sh
135+
136+
supply-chain-verify:
137+
name: Supply Chain & SBOM Verification
138+
runs-on: ubuntu-latest
139+
permissions:
140+
contents: read
141+
steps:
142+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
143+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
144+
with:
145+
go-version: "1.23"
146+
147+
- name: Install Syft (SBOM generator)
148+
run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
149+
150+
- name: Install cosign (signing & attestation)
151+
uses: sigstore/cosign-installer@3454372be43ec08971210d50303c1018d382600b # v3.8.2
152+
153+
- name: Verify SBOM generation (Go services)
154+
run: |
155+
echo "=== SBOM generation verification ==="
156+
for svc in airlock registry tool-firewall gpu-integrity-watch mcp-firewall \
157+
policy-engine runtime-attestor integrity-monitor incident-recorder; do
158+
echo "--- ${svc} ---"
159+
syft dir:services/${svc} -o cyclonedx-json=/dev/null
160+
echo "OK: ${svc} SBOM generated"
161+
done
162+
163+
- name: Verify SBOM generation (Python services)
164+
run: |
165+
for svc in agent ui quarantine common diffusion-worker search-mediator; do
166+
if [ -d "services/${svc}" ]; then
167+
syft dir:services/${svc} -o cyclonedx-json=/dev/null
168+
echo "OK: ${svc} SBOM generated"
169+
fi
170+
done
171+
172+
- name: Verify cosign is functional
173+
run: |
174+
cosign version
175+
echo "OK: cosign available for signing and attestation"
176+
177+
- name: Verify release workflow has provenance steps
178+
run: |
179+
echo "=== Checking release.yml provenance pipeline ==="
180+
# Verify release workflow exists and contains required supply-chain steps
181+
test -f .github/workflows/release.yml || { echo "FAIL: release.yml missing"; exit 1; }
182+
183+
for keyword in "sbom-action" "attest-build-provenance" "cosign" "cyclonedx" "SHA256SUMS"; do
184+
grep -q "${keyword}" .github/workflows/release.yml || \
185+
{ echo "FAIL: release.yml missing '${keyword}'"; exit 1; }
186+
echo "OK: release.yml contains '${keyword}'"
187+
done
188+
189+
# Verify build workflow has SBOM attestation
190+
test -f .github/workflows/build.yml || { echo "FAIL: build.yml missing"; exit 1; }
191+
for keyword in "sbom-action" "cosign attest" "cyclonedx"; do
192+
grep -q "${keyword}" .github/workflows/build.yml || \
193+
{ echo "FAIL: build.yml missing '${keyword}'"; exit 1; }
194+
echo "OK: build.yml contains '${keyword}'"
195+
done
196+
197+
echo "=== Supply chain verification passed ==="

‎README.md‎

Lines changed: 62 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ Built on [uBlue](https://universal-blue.org/) (Fedora Atomic / Silverblue). All
3939
- **Hands-off security** -- All scanning, verification, and promotion happens automatically. Users never run security tools manually.
4040
- **Deterministic policy** -- Promotion to "trusted" is rule-based (signatures, hashes, scans, tests), not ad-hoc.
4141
- **Short-lived workers** -- No swap, tmpfs for temp data, inference workers restart between sessions.
42-
- **20+ defense layers** -- From UEFI Secure Boot and TPM2 to seccomp-BPF, Landlock, canary files, and 3-level emergency wipe.
42+
- **25+ defense layers** -- From UEFI Secure Boot and TPM2 to seccomp-BPF, Landlock, runtime attestation, continuous integrity monitoring, automated incident containment, and 3-level emergency wipe.
4343

4444
---
4545

@@ -137,14 +137,20 @@ Every model passes through the same fully automatic pipeline:
137137
| **Auth** | Scrypt passphrase hashing, rate-limited login, session management |
138138
| **Vault** | Auto-lock after 30 min idle, TPM2-sealed keys |
139139
| **Services** | Systemd sandboxing: ProtectSystem, PrivateNetwork, seccomp-bpf, Landlock |
140-
| **Agent** | Deny-by-default policy engine, capability tokens, hard budgets, loopback-only IPC, IPAddressDeny |
141-
| **GPU** | Vendor-specific DeviceAllow, PrivateNetwork on all workers |
140+
| **Agent** | Deny-by-default policy engine, HMAC-signed capability tokens, hard budgets, loopback-only IPC |
141+
| **Policy Engine** | Unified decision point (6 domains), structured evidence, OPA/Rego-upgradeable |
142+
| **Attestation** | TPM2 quote verification, HMAC-signed runtime state bundles, startup gating |
143+
| **Integrity** | Continuous baseline-verified file watcher (30s scans), signed baselines, auto-degradation |
144+
| **Incident Response** | 9 incident classes, auto-containment (freeze agent, disable airlock, vault relock, quarantine model) |
145+
| **GPU** | Vendor-specific DeviceAllow, PrivateNetwork, driver fingerprinting, device allowlist |
146+
| **HSM/Keys** | Pluggable keystore (software/TPM2/PKCS#11), key rotation, PCR-sealed key hierarchy |
142147
| **Clipboard** | VM clipboard agents disabled, auto-clear every 60s |
143148
| **Tripwire** | Canary files in sensitive dirs, inotify real-time monitoring |
144149
| **Emergency** | 3-level panic (lock / wipe keys / full wipe) with passphrase gates |
145150
| **Updates** | Cosign-verified rpm-ostree, staged workflow, greenboot auto-rollback |
151+
| **Supply Chain** | Per-service CycloneDX SBOMs, SLSA3 provenance attestation, cosign-signed checksums |
146152

147-
See [docs/threat-model.md](docs/threat-model.md) for threat classes, residual risks, and security invariants. See [docs/security-status.md](docs/security-status.md) for implementation status of all 31 milestones.
153+
See [docs/threat-model.md](docs/threat-model.md) for threat classes, residual risks, and security invariants. See [docs/security-status.md](docs/security-status.md) for implementation status of all 42 milestones.
148154

149155
### Verify Image Signatures
150156

@@ -194,8 +200,8 @@ See [docs/policy-schema.md](docs/policy-schema.md) for full schema reference. Se
194200
| [Threat Model](docs/threat-model.md) | Threat classes, invariants, residual risks |
195201
| [API Reference](docs/api.md) | HTTP API for all services |
196202
| [Policy Schema](docs/policy-schema.md) | Full policy.yaml schema reference |
197-
| [Security Status](docs/security-status.md) | Implementation status of all 31 milestones |
198-
| [Test Matrix](docs/test-matrix.md) | Test coverage: 700+ tests across Go, Python, shell |
203+
| [Security Status](docs/security-status.md) | Implementation status of all 42 milestones |
204+
| [Test Matrix](docs/test-matrix.md) | Test coverage: 1000+ tests across Go, Python, shell |
199205
| [Compatibility Matrix](docs/compatibility-matrix.md) | GPU, VM, and hardware support |
200206
| [Security Test Matrix](docs/security-test-matrix.md) | Security feature test coverage |
201207
| [FAQ](docs/faq.md) | Common questions |
@@ -210,8 +216,14 @@ See [docs/policy-schema.md](docs/policy-schema.md) for full schema reference. Se
210216
| [Tool Firewall](docs/components/tool-firewall.md) | Policy-gated tool invocation |
211217
| [Airlock](docs/components/airlock.md) | Sanitized egress proxy |
212218
| [Quarantine](docs/components/quarantine.md) | 7-stage scanning pipeline |
213-
| [Agent](docs/components/agent.md) | Policy-bound local autopilot |
219+
| [Agent](docs/components/agent.md) | Policy-bound local autopilot with verified supervisor |
214220
| [Search Mediator](docs/components/search-mediator.md) | Tor-routed web search |
221+
| [GPU Integrity Watch](docs/components/gpu-integrity-watch.md) | Continuous GPU runtime verification |
222+
| [MCP Firewall](docs/components/mcp-firewall.md) | Model Context Protocol policy gateway |
223+
| [Policy Engine](docs/components/policy-engine.md) | Unified policy decision point |
224+
| [Runtime Attestor](docs/components/runtime-attestor.md) | TPM2 attestation and startup gating |
225+
| [Integrity Monitor](docs/components/integrity-monitor.md) | Continuous file integrity verification |
226+
| [Incident Recorder](docs/components/incident-recorder.md) | Security event capture and auto-containment |
215227

216228
### Install Guides
217229

@@ -294,12 +306,13 @@ Privacy: Tor-routed, PII stripped, injection detection, privacy-preserving query
294306
## Running Tests
295307

296308
```bash
297-
# Go tests (26 total)
298-
cd services/registry && go test -v -race ./...
299-
cd services/tool-firewall && go test -v -race ./...
300-
cd services/airlock && go test -v -race ./...
309+
# Go tests (348 total across 9 services)
310+
for svc in airlock registry tool-firewall gpu-integrity-watch mcp-firewall \
311+
policy-engine runtime-attestor integrity-monitor incident-recorder; do
312+
(cd services/$svc && go test -v -race ./...)
313+
done
301314

302-
# Python tests (700+ total)
315+
# Python tests (658 total)
303316
pip install pytest flask requests pyyaml
304317
python -m pytest tests/ -v
305318

@@ -314,7 +327,7 @@ See [docs/test-matrix.md](docs/test-matrix.md) for full breakdown.
314327
## Roadmap
315328

316329
<details>
317-
<summary>All 31 milestones (click to expand)</summary>
330+
<summary>All 42 milestones (click to expand)</summary>
318331

319332
- [x] **M0** -- Threat model, dataflow, invariants, policy files
320333
- [x] **M1** -- Bootable OS, encrypted vault, GPU drivers
@@ -348,6 +361,17 @@ See [docs/test-matrix.md](docs/test-matrix.md) for full breakdown.
348361
- [x] **M29** -- Garak LLM vulnerability scanner
349362
- [x] **M30** -- gguf-guard deep GGUF integrity scanner
350363
- [x] **M31** -- Agent Mode (Phase 1: safe local autopilot)
364+
- [x] **M32** -- GPU Integrity Watch (continuous GPU runtime verification)
365+
- [x] **M33** -- MCP Firewall (Model Context Protocol policy gateway)
366+
- [x] **M34** -- Release provenance + per-service SBOMs (SLSA3, CycloneDX, cosign)
367+
- [x] **M35** -- Unified policy decision engine (6 domains, OPA/Rego-upgradeable)
368+
- [x] **M36** -- Runtime attestation + startup gating (TPM2, HMAC state bundles)
369+
- [x] **M37** -- Continuous integrity monitor (baseline-verified file watcher)
370+
- [x] **M38** -- Incident recorder + containment automation (9 classes, 4-state lifecycle)
371+
- [x] **M39** -- GPU integrity deep integration (driver fingerprinting, attestor/incident wiring)
372+
- [x] **M40** -- Agent verified supervisor hardening (signed tokens, replay protection, two-phase approval)
373+
- [x] **M41** -- HSM-backed key handling (pluggable keystore: software/TPM2/PKCS#11)
374+
- [x] **M42** -- Enforcement wiring + CI supply chain verification
351375

352376
</details>
353377

@@ -356,26 +380,34 @@ See [docs/test-matrix.md](docs/test-matrix.md) for full breakdown.
356380
## Project Structure
357381

358382
```
359-
recipes/ BlueBuild recipe (image definition)
383+
recipes/ BlueBuild recipe (image definition)
360384
files/
361385
system/
362-
etc/secure-ai/ Policy and config files baked into image
363-
etc/nftables/ Firewall rules (default-deny egress)
364-
usr/lib/systemd/ Systemd service units (sandboxed)
365-
usr/libexec/ Helper scripts (firstboot, vault, securectl, canary)
386+
etc/secure-ai/ Policy and config files baked into image
387+
etc/nftables/ Firewall rules (default-deny egress)
388+
usr/lib/systemd/ Systemd service units (sandboxed)
389+
usr/libexec/ Helper scripts (firstboot, vault, securectl, canary)
366390
services/
367-
registry/ Go -- Trusted Registry
368-
tool-firewall/ Go -- Policy engine + tool gateway
369-
airlock/ Go -- Online egress proxy
370-
agent/ Python/Flask -- Policy-bound local autopilot
371-
quarantine/ Python -- 7-stage verification + scanning pipeline
372-
diffusion-worker/ Python -- Image/video generation
373-
search-mediator/ Python -- Tor-routed web search
374-
ui/ Python/Flask -- Web UI
375-
tests/ 700+ Python tests, 26 Go tests
376-
docs/ Architecture, API, threat model, install guides
377-
schemas/ OpenAPI spec, JSON Schema for config files
378-
examples/ Task-oriented walkthroughs
391+
registry/ Go -- Trusted Registry (:8470)
392+
tool-firewall/ Go -- Policy-gated tool gateway (:8475)
393+
airlock/ Go -- Online egress proxy (:8490)
394+
gpu-integrity-watch/ Go -- GPU runtime verification (:8495)
395+
mcp-firewall/ Go -- MCP policy gateway (:8496)
396+
policy-engine/ Go -- Unified policy decisions (:8500)
397+
runtime-attestor/ Go -- TPM2 attestation + startup gating (:8505)
398+
integrity-monitor/ Go -- Continuous file integrity watcher (:8510)
399+
incident-recorder/ Go -- Incident capture + containment (:8515)
400+
agent/ Python/Flask -- Verified supervisor autopilot (:8476)
401+
quarantine/ Python -- 7-stage verification + scanning pipeline
402+
diffusion-worker/ Python -- Image/video generation (:8455)
403+
search-mediator/ Python -- Tor-routed web search (:8485)
404+
ui/ Python/Flask -- Web UI (:8480)
405+
common/ Python -- Shared utilities (audit, auth, mlock)
406+
tests/ 658 Python tests, 348 Go tests (~1006 total)
407+
docs/ Architecture, API, threat model, install guides
408+
schemas/ OpenAPI spec, JSON Schema for config files
409+
examples/ Task-oriented walkthroughs
410+
.github/workflows/ CI (test/lint), build (image), release (SLSA3/SBOM)
379411
```
380412

381413
---

0 commit comments

Comments
 (0)