d3318c5910
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Builds on the merged W2 store/ack (EPIC #892). Adds A3 (digest.sh) and A5 (sign.sh) under packages/mosaic/framework/tools/wake/, honoring CONVERGED-DESIGN. A3 — digest.sh (cumulative-state digest renderer), §2.1: - CUMULATIVE-STATE: renders the FULL unacked set since consumed_seq from the durable pending-inbox (state-since-CONSUMED, not an event delta). - TWO-TIER TRUST: orientation tier (who/lane/board-head + changed-obligation list with observed_seq + locators) decides the no-op case with ZERO tool calls; actionable tier renders every consequential fact ONLY as a CLAIM-TO-VERIFY, point-in-time-at-seq — never auto-actioned. - HARD LOCATORS: every actionable claim must carry repo+issue#/40-char SHA/ file:anchor; a missing locator is fail-loud (exit 4, nothing emitted). - BOUNDING/INJECTION/SECRETS: source free-text is quoted only inside a delimited, length-capped, ANSI/bidi/zero-width-stripped untrusted block; secret-canary redaction over any inlined content; embeds the W2 ack line. A5 — sign.sh (non-circular HMAC signer), §2.5: - wake_id generated INDEPENDENTLY at emit (not derived from, and not a member of, the signed field-tuple); wake_mac = HMAC(key, wake_id || agent_identity || mission_generation || observed_seq || emit_ts || content_hash) — over wake_id PLUS the fields, genuinely non-circular (the MAC is never its own input). Fills the `hmac` placeholder W2 left in store entries. - Key resolved BY NAME from the credential store, never inlined, never echoed; no flag accepts key material. Same-uid threat boundary documented; off-uid signer named as a future gate. RED-FIRST tests (test-wake-digest-hmac.sh, wired into test:framework-shell): cumulative-state, hard-locator fail-loud, two-tier (zero-call orientation + claim-to-verify), scrub (secret-canary + ANSI/bidi/zero-width), non-circular HMAC (independent wake_id + tamper-breaks-MAC), key-by-name-never-inline. Each verified to go RED on a targeted regression. shellcheck clean; operator-agnostic (XDG/env only). manifest.txt bumped to 0.2.0. Part of #892 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
279 lines
15 KiB
Bash
Executable File
279 lines
15 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# test-wake-digest-hmac.sh — RED-FIRST invariant harness for W3 (EPIC #892):
|
|
# the cumulative-state digest renderer (digest.sh, A3) + the non-circular HMAC
|
|
# signer (sign.sh, A5).
|
|
#
|
|
# Each test asserts ONE CONVERGED-DESIGN invariant and is designed to go RED if
|
|
# that invariant regresses:
|
|
# D1 CUMULATIVE-STATE: two still-pending changes both render (not just the
|
|
# latest delta) — a delta would silently drop the older change. (§2.1)
|
|
# D2 HARD-LOCATOR enforcement: an actionable claim with no precise locator
|
|
# FAILS LOUD (non-zero exit, nothing emitted). (§2.1)
|
|
# D3 TWO-TIER trust: orientation decides the no-op case with ZERO tool calls;
|
|
# an actionable fact is a CLAIM-TO-VERIFY, never auto-actioned. (§2.1)
|
|
# D4 SCRUB: a secret-canary + ANSI/bidi/zero-width in SOURCE free-text is
|
|
# stripped/neutralized in the rendered digest. (§2.1)
|
|
# H1 NON-CIRCULAR HMAC: wake_id is NOT a member of the signed field-tuple and
|
|
# is independently generated; wake_mac is not its own input; tampering ANY
|
|
# signed field (or wake_id) breaks the MAC. (§2.5)
|
|
# H2 KEY BY-NAME, NEVER INLINE: the key is resolved by NAME from the credential
|
|
# store; no flag accepts key material; the key never leaks into output; the
|
|
# same-uid threat boundary is documented. (§2.5)
|
|
#
|
|
# Isolated: every test runs against a fresh temp state / credential file.
|
|
set -uo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
STORE="$SCRIPT_DIR/store.sh"
|
|
DIGEST="$SCRIPT_DIR/digest.sh"
|
|
SIGN="$SCRIPT_DIR/sign.sh"
|
|
|
|
command -v jq >/dev/null 2>&1 || {
|
|
echo "SKIP: jq not available" >&2
|
|
exit 0
|
|
}
|
|
command -v openssl >/dev/null 2>&1 || {
|
|
echo "SKIP: openssl not available" >&2
|
|
exit 0
|
|
}
|
|
|
|
TMP_ROOT="$(mktemp -d)"
|
|
trap 'rm -rf "$TMP_ROOT"' EXIT
|
|
|
|
# Failures recorded to a marker FILE (not a shell var): each test runs in a
|
|
# subshell for env isolation and a subshell cannot mutate a parent variable, so
|
|
# a var-based counter would silently swallow failures.
|
|
FAILFILE="$TMP_ROOT/failures"
|
|
: >"$FAILFILE"
|
|
pass=0
|
|
fail_msg() {
|
|
echo " FAIL: $*" >&2
|
|
echo "x" >>"$FAILFILE"
|
|
}
|
|
ok() { pass=$((pass + 1)); }
|
|
|
|
fresh_state() {
|
|
local d="$TMP_ROOT/$1"
|
|
rm -rf "$d"
|
|
mkdir -p "$d"
|
|
printf '%s' "$d"
|
|
}
|
|
|
|
# A 40-hex sha, for hard locators.
|
|
SHA40="abcdef0123456789abcdef0123456789abcdef01"
|
|
|
|
# fresh_cred NAME KEYNAME KEYVALUE — write a temp credential store with a wake
|
|
# HMAC key at .wake.hmac_keys.<KEYNAME> and echo its path.
|
|
fresh_cred() {
|
|
local f="$TMP_ROOT/$1.cred.json"
|
|
jq -cn --arg k "$2" --arg v "$3" '{wake:{hmac_keys:{($k):$v}}}' >"$f"
|
|
printf '%s' "$f"
|
|
}
|
|
|
|
# ===========================================================================
|
|
echo "== D1: CUMULATIVE-STATE — two pending changes BOTH render (not just latest) =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state d1)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT WAKE_LANE
|
|
# Two distinct obligations observed since the last CONSUMED. A delta-style
|
|
# renderer would show only the newest; cumulative-state must show BOTH.
|
|
"$STORE" enqueue --seq 1 --class actionable --locators '{"repo":"r","issue":11}' >/dev/null
|
|
"$STORE" enqueue --seq 2 --class actionable --locators '{"repo":"r","issue":22}' >/dev/null
|
|
out="$("$DIGEST" render)" || fail_msg "D1: render exited non-zero"
|
|
echo "$out" | grep -q 'issue=#11' || fail_msg "D1: OLDER change (issue #11) dropped — digest is a delta, not cumulative state"
|
|
echo "$out" | grep -q 'issue=#22' || fail_msg "D1: newer change (issue #22) missing"
|
|
echo "$out" | grep -q 'seq 1' || fail_msg "D1: seq 1 not listed in cumulative set"
|
|
echo "$out" | grep -q 'seq 2' || fail_msg "D1: seq 2 not listed in cumulative set"
|
|
# A coalescing digest-class entry is STATE (full), not a delta: a later digest
|
|
# subsumes the earlier, but the cumulative unacked set (both actionables) stays.
|
|
echo "$out" | grep -q 'pending=2' || fail_msg "D1: cumulative pending count wrong (expected 2)"
|
|
) && ok
|
|
|
|
echo "== D2: HARD-LOCATOR enforcement — actionable claim with no locator FAILS LOUD =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state d2)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT WAKE_LANE
|
|
# An actionable claim carrying NO hard locator (no repo+issue / sha / file).
|
|
"$STORE" enqueue --seq 1 --class actionable --locators '{"claim":"mergeable=true"}' >/dev/null
|
|
if out="$("$DIGEST" render 2>/dev/null)"; then
|
|
fail_msg "D2: malformed digest (actionable, no locator) must FAIL, but render succeeded"
|
|
fi
|
|
rc=0
|
|
"$DIGEST" render >/dev/null 2>&1 || rc=$?
|
|
[ "$rc" -eq 4 ] || fail_msg "D2: expected fail-loud exit 4, got $rc"
|
|
# Nothing emitted on stdout when malformed (no silent partial send).
|
|
[ -z "${out:-}" ] || fail_msg "D2: a malformed digest emitted body instead of failing loud [$out]"
|
|
# A present-but-imprecise sha (not 40 hex) does NOT satisfy the hard locator.
|
|
WAKE_STATE_HOME="$(fresh_state d2b)"
|
|
export WAKE_STATE_HOME
|
|
"$STORE" enqueue --seq 1 --class actionable --locators '{"claim":"ci=green","sha":"abc123"}' >/dev/null
|
|
rc=0
|
|
"$DIGEST" render >/dev/null 2>&1 || rc=$?
|
|
[ "$rc" -eq 4 ] || fail_msg "D2: imprecise sha (not 40-hex) must not satisfy the hard-locator gate (got exit $rc)"
|
|
# The SAME claim WITH a precise 40-hex sha renders fine.
|
|
WAKE_STATE_HOME="$(fresh_state d2c)"
|
|
export WAKE_STATE_HOME
|
|
"$STORE" enqueue --seq 1 --class actionable --locators "$(jq -cn --arg s "$SHA40" '{claim:"ci=green",sha:$s}')" >/dev/null
|
|
"$DIGEST" render >/dev/null 2>&1 || fail_msg "D2: a well-located actionable claim must render"
|
|
) && ok
|
|
|
|
echo "== D3: TWO-TIER — orientation no-op with ZERO tool calls; actionable = claim-to-verify =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state d3)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT WAKE_LANE
|
|
# Tool-call tripwire: shim git/gh/tea/curl on PATH; any invocation touches a
|
|
# marker. The orientation no-op path must decide with ZERO of them.
|
|
bin="$TMP_ROOT/d3bin"
|
|
mkdir -p "$bin"
|
|
for t in git gh tea curl wget; do
|
|
{
|
|
printf '#!/usr/bin/env bash\n'
|
|
printf 'touch "%s/TOOL_CALLED"\n' "$WAKE_STATE_HOME"
|
|
printf 'exit 0\n'
|
|
} >"$bin/$t"
|
|
chmod +x "$bin/$t"
|
|
done
|
|
# No pending obligations => no-op common case.
|
|
out="$(PATH="$bin:$PATH" "$DIGEST" render --lane build)" || fail_msg "D3: no-op render failed"
|
|
echo "$out" | grep -q 'NO-OP' || fail_msg "D3: empty inbox must render an explicit NO-OP orientation"
|
|
[ -e "$WAKE_STATE_HOME/TOOL_CALLED" ] && fail_msg "D3: orientation no-op made a live tool call (must be ZERO)"
|
|
# Now an actionable, consequential fact. It must be a CLAIM-TO-VERIFY, never
|
|
# rendered as a trusted assertion or an auto-action.
|
|
"$STORE" enqueue --seq 1 --class actionable \
|
|
--locators "$(jq -cn --arg s "$SHA40" '{repo:"r",issue:7,claim:"ci=success",file:"pkg/x.ts",sha:$s}')" >/dev/null
|
|
out2="$(PATH="$bin:$PATH" "$DIGEST" render)" || fail_msg "D3: actionable render failed"
|
|
# Rendering itself still makes ZERO live calls (it only lays out claims).
|
|
[ -e "$WAKE_STATE_HOME/TOOL_CALLED" ] && fail_msg "D3: rendering an actionable claim made a live call (must defer to the consumer's gate)"
|
|
echo "$out2" | grep -q 'CLAIM@seq' || fail_msg "D3: consequential fact not framed as CLAIM@seq"
|
|
echo "$out2" | grep -qi 'VERIFY LIVE' || fail_msg "D3: claim not marked for live verification"
|
|
echo "$out2" | grep -qi 'do NOT act on this line' || fail_msg "D3: claim missing do-not-auto-action framing"
|
|
# The consequential fact must NOT appear as a bare trusted directive.
|
|
echo "$out2" | grep -qiE 'merge now|go ahead and (merge|deploy)|safe to merge' &&
|
|
fail_msg "D3: digest auto-actioned a consequential fact (imperative present)"
|
|
# And its hard locator + one-call re-verify hint are present.
|
|
echo "$out2" | grep -q "re-verify (ONE call)" || fail_msg "D3: actionable claim missing one-call re-verify locator"
|
|
true
|
|
) && ok
|
|
|
|
echo "== D4: SCRUB — secret-canary + ANSI/bidi/zero-width in source free-text neutralized =="
|
|
(
|
|
WAKE_STATE_HOME="$(fresh_state d4)"
|
|
export WAKE_STATE_HOME
|
|
unset WAKE_AGENT WAKE_LANE
|
|
# Build hostile source free-text: ANSI CSI, bidi override (U+202E), zero-width
|
|
# space (U+200B), ZWNBSP (U+FEFF), a C0 control (BEL), and two secret canaries.
|
|
nasty="$(printf 'good\x1b[31mRED\xe2\x80\xaeEVIL\xe2\x80\x8bZW\xef\xbb\xbfBOM\x07BEL ghp_0123456789abcdefghijABCDEFGHIJ012345 AKIAIOSFODNN7EXAMPLE')"
|
|
loc="$(jq -cn --arg s "$nasty" --arg sha "$SHA40" '{repo:"r",issue:3,claim:"changed",sha:$sha,summary:$s}')"
|
|
"$STORE" enqueue --seq 1 --class actionable --locators "$loc" >/dev/null
|
|
out="$("$DIGEST" render)" || fail_msg "D4: render failed"
|
|
# ANSI escape / CSI must be gone.
|
|
printf '%s' "$out" | LC_ALL=C grep -q "$(printf '\x1b')" && fail_msg "D4: ANSI ESC survived the scrub"
|
|
# bidi/zero-width/BOM UTF-8 sequences must be gone.
|
|
printf '%s' "$out" | LC_ALL=C grep -qP '\xe2\x80[\x8b-\x8f\xaa-\xae]|\xef\xbb\xbf' &&
|
|
fail_msg "D4: bidi/zero-width/BOM survived the scrub"
|
|
# C0 control bytes (except tab/newline) must be gone.
|
|
printf '%s' "$out" | LC_ALL=C grep -qP '[\x00-\x08\x0e-\x1f\x7f]' && fail_msg "D4: a C0 control byte survived the scrub"
|
|
# Secret canaries must be redacted, never inlined.
|
|
printf '%s' "$out" | grep -q 'ghp_0123456789' && fail_msg "D4: GitHub-token canary LEAKED into the digest"
|
|
printf '%s' "$out" | grep -q 'AKIAIOSFODNN7EXAMPLE' && fail_msg "D4: AWS-key canary LEAKED into the digest"
|
|
printf '%s' "$out" | grep -q 'REDACTED-SECRET' || fail_msg "D4: secret redaction marker absent — canary may not have been scrubbed"
|
|
# Free-text is quoted inside a DELIMITED untrusted block, framed as NOT instructions.
|
|
printf '%s' "$out" | grep -q 'BEGIN UNTRUSTED DATA' || fail_msg "D4: source free-text not placed in a delimited untrusted block"
|
|
# The 40-hex git SHA locator must NOT be mangled by the secret scrubber.
|
|
printf '%s' "$out" | grep -q "$SHA40" || fail_msg "D4: legitimate 40-hex SHA locator was wrongly scrubbed"
|
|
true
|
|
) && ok
|
|
|
|
echo "== H1: NON-CIRCULAR HMAC — wake_id independent + not a signed field; tamper breaks MAC =="
|
|
(
|
|
MOSAIC_CREDENTIALS_FILE="$(fresh_cred h1 default 'key-material-h1')"
|
|
export MOSAIC_CREDENTIALS_FILE
|
|
WAKE_AGENT=agentA
|
|
WAKE_MISSION_GENERATION=3
|
|
export WAKE_AGENT WAKE_MISSION_GENERATION
|
|
unset WAKE_HMAC_KEY_NAME
|
|
env1="$("$SIGN" sign --observed-seq 5 --content-hash "$SHA40")" || fail_msg "H1: sign failed"
|
|
# wake_id is NOT a member of the signed field-tuple (it is prepended to the MAC
|
|
# input, not one of the signed fields whose authenticity the MAC establishes).
|
|
echo "$env1" | jq -e '.signed | has("wake_id") | not' >/dev/null || fail_msg "H1: wake_id must NOT appear inside the signed field-tuple"
|
|
# wake_mac is not its own input: it is not a member of `signed` either.
|
|
echo "$env1" | jq -e '.signed | has("wake_mac") | not' >/dev/null || fail_msg "H1: wake_mac must not be part of its own signed inputs (self-reference)"
|
|
echo "$env1" | jq -e 'has("wake_id") and has("wake_mac")' >/dev/null || fail_msg "H1: envelope must carry independent wake_id + wake_mac"
|
|
# Independently generated: two emits over IDENTICAL fields yield DIFFERENT
|
|
# wake_ids (id not derived from the tuple) AND different MACs (id is bound in).
|
|
env2="$("$SIGN" sign --observed-seq 5 --content-hash "$SHA40")"
|
|
w1="$(echo "$env1" | jq -r .wake_id)"
|
|
w2="$(echo "$env2" | jq -r .wake_id)"
|
|
[ -n "$w1" ] && [ "$w1" != "null" ] || fail_msg "H1: wake_id missing"
|
|
[ "$w1" != "$w2" ] || fail_msg "H1: wake_id not independently generated (identical fields produced identical id — derived, not fresh)"
|
|
m1="$(echo "$env1" | jq -r .wake_mac)"
|
|
m2="$(echo "$env2" | jq -r .wake_mac)"
|
|
[ "$m1" != "$m2" ] || fail_msg "H1: MAC did not bind the independent wake_id (same MAC despite different wake_id)"
|
|
# Untampered verifies.
|
|
echo "$env1" | "$SIGN" verify >/dev/null 2>&1 || fail_msg "H1: untampered envelope failed to verify"
|
|
# Tampering ANY signed field breaks the MAC.
|
|
for mut in \
|
|
'.signed.agent_identity="attacker"' \
|
|
'.signed.mission_generation="9"' \
|
|
'.signed.observed_seq="6"' \
|
|
'.signed.emit_ts="0"' \
|
|
'.signed.content_hash="deadbeef"'; do
|
|
if echo "$env1" | jq "$mut" | "$SIGN" verify >/dev/null 2>&1; then
|
|
fail_msg "H1: tampering [$mut] did NOT break the MAC"
|
|
fi
|
|
done
|
|
# Tampering the independent wake_id also breaks the MAC (it is bound in).
|
|
if echo "$env1" | jq '.wake_id="wake_forged"' | "$SIGN" verify >/dev/null 2>&1; then
|
|
fail_msg "H1: forging wake_id did not break the MAC (id not bound)"
|
|
fi
|
|
# A wrong key fails verification (the MAC genuinely depends on the key).
|
|
wrong="$(fresh_cred h1b default 'DIFFERENT-key')"
|
|
if echo "$env1" | MOSAIC_CREDENTIALS_FILE="$wrong" "$SIGN" verify >/dev/null 2>&1; then
|
|
fail_msg "H1: verify passed under a DIFFERENT key (MAC not key-dependent)"
|
|
fi
|
|
) && ok
|
|
|
|
echo "== H2: KEY BY-NAME, never inline; no key leak; same-uid boundary documented =="
|
|
(
|
|
MOSAIC_CREDENTIALS_FILE="$(fresh_cred h2 signing-key 'SUPERSECRET-KEYVALUE-XYZ')"
|
|
export MOSAIC_CREDENTIALS_FILE
|
|
WAKE_AGENT=agentB
|
|
WAKE_MISSION_GENERATION=1
|
|
export WAKE_AGENT WAKE_MISSION_GENERATION
|
|
# Resolve BY NAME (the credential-store key name), never the key material.
|
|
env1="$(WAKE_HMAC_KEY_NAME=signing-key "$SIGN" sign --observed-seq 1 --content-hash "$SHA40")" ||
|
|
fail_msg "H2: by-name key resolution failed"
|
|
echo "$env1" | jq -e .wake_mac >/dev/null || fail_msg "H2: no MAC produced from by-name key"
|
|
# The key VALUE must never appear in the signed output.
|
|
echo "$env1" | grep -q 'SUPERSECRET-KEYVALUE-XYZ' && fail_msg "H2: key material LEAKED into the signed envelope"
|
|
# A signed store-entry (hmac placeholder filled) must not leak the key either.
|
|
entry="$(printf '{"observed_seq":1,"locators":{"repo":"r","issue":1},"class":"actionable","emit_ts":1700000000,"hmac":""}' |
|
|
WAKE_HMAC_KEY_NAME=signing-key "$SIGN" sign-entry)"
|
|
echo "$entry" | grep -q 'SUPERSECRET-KEYVALUE-XYZ' && fail_msg "H2: key material LEAKED into the signed entry"
|
|
echo "$entry" | jq -e '.hmac != "" and .hmac != null' >/dev/null || fail_msg "H2: sign-entry did not fill the hmac placeholder"
|
|
# No flag may accept key MATERIAL inline — only a key NAME. An attempt to pass
|
|
# a literal key must be rejected as an unknown option (never silently honored).
|
|
for badflag in --key --secret --hmac-key --key-value; do
|
|
if WAKE_HMAC_KEY_NAME=signing-key "$SIGN" sign --observed-seq 1 --content-hash "$SHA40" "$badflag" 'INLINE-KEY' >/dev/null 2>&1; then
|
|
fail_msg "H2: sign.sh accepted an inline-key flag [$badflag] (key must be by-name only)"
|
|
fi
|
|
done
|
|
# An unknown key NAME fails loud (never signs unsigned / with an empty key).
|
|
if WAKE_HMAC_KEY_NAME=does-not-exist "$SIGN" sign --observed-seq 1 --content-hash "$SHA40" >/dev/null 2>&1; then
|
|
fail_msg "H2: signing with an unresolvable key name must FAIL LOUD"
|
|
fi
|
|
# The same-uid threat boundary + off-uid follow-up must be DOCUMENTED in the tool.
|
|
grep -qi 'same-uid' "$SIGN" || fail_msg "H2: same-uid threat boundary not documented in sign.sh"
|
|
grep -qi 'off-uid' "$SIGN" || fail_msg "H2: off-uid future signer not named in sign.sh"
|
|
) && ok
|
|
|
|
echo
|
|
if [ -s "$FAILFILE" ]; then
|
|
echo "wake digest/hmac harness: FAILED ($(grep -c . "$FAILFILE") assertion(s))" >&2
|
|
exit 1
|
|
fi
|
|
echo "wake digest/hmac harness: all invariants passed ($pass groups)"
|