Repository navigation
Conversation
Under the signed authority the plane now refuses to start when its own account can write trust.roster or a directory on its path, as it already does for the configuration, the root key, the pause file, the route, the stop list and the run records. A test classifies every file key the signed authority reads as checked or plane-writable, so a new one cannot be missed. The operator commands that judge with --roster say on standard error which roster they judged, its serial and its expiry, before they sign or list. Doctor's signed route and stop list reads get a test, and stops init --carry runs as a command in a test. Signed-off-by: Konrad Karauda <konrad@karauda.com>
…he seam The plane's account still writes trust.floor_dir: raising the roster floor withholds a newer roster until the held one expires. The pages now say so, and that what the placement check adds is that the plane's account can no longer put an older roster in place. Doctor's signed stop list read is a method with its own test run with the plane-owned switch off, so a doctor that takes a list the plane's own account owns fails a test. react's guard against the plane's account is a variable, so a test on one account reaches the roster line it prints. The classification test also runs over a minimal signed tree, so a check that depends on another key being set fails it. Signed-off-by: Konrad Karauda <konrad@karauda.com>
…grant Reading is not a roster capability: the health socket answers a peer by its uid against health.socket_uid, and a file is read by whoever its modes let read it. The roster's read level parses and is reserved; it grants nothing yet. doctor now says so when a roster holds a read grant, and its trust line names every file the signed start checked, from the same list the start uses, the roster included. B13 keeps only open work: cross-project reads and operations refused at every receiver, a stop naming its agent or principal scope, and adversarial tests of two users and overlapping runs. docs/contracts.md gains a table of every signed file and answer a plane takes in, with its tenant and project check and the test that pins it; a docscheck test fails when a cited test, file or function does not exist, or the table is empty. ADR-0071 is amended for the reserved read level. Signed-off-by: Konrad Karauda <konrad@karauda.com>
Answers and pauses are judged under tenant_id; runs, routes and stops under the listener's tenant, which is listener.principal.tenant_id where set. The table names it per row and says an operator needs a grant over each tenant where the two differ. The route rows cite the route's tenant check, the floors are named as unsigned state, and the page covers every file the table cites, so changing one of those checks flags it. Signed-off-by: Konrad Karauda <konrad@karauda.com>
Signed-off-by: Konrad Karauda <konrad@karauda.com>
🚀 Deploying Preview to Cloudflare 🚀Preview Deployments by commit
|
Signed-off-by: Konrad Karauda <konrad@karauda.com>
karauda
added a commit
that referenced
this pull request
Nov 11, 2026
GO-2026-6859 (a race on `MaxBytesReader`'s header that can crash an HTTP/1 server) is fixed in go1.27.4. `govulncheck` finds it reachable from the plane's HTTP servers under go1.27.3, so the quality gate and "Known Go vulnerabilities" fail on every pull request (first seen on #97). Both modules move to Go 1.27.4, and the pages that name the toolchain follow: README, the filesystem-server guide and status. CHANGELOG gets a Security line. Verified: - `go tool govulncheck ./...` under go1.27.4: no vulnerabilities, both in the root module and in `examples/evidence-report`. - Negative control: under go1.27.3 on main, the same scan reports GO-2026-6859 (exit 3). - Test binaries for `internal/docscheck`, `internal/console`, `internal/core/approval`, `internal/metrics` and `internal/core` under go1.27.4. - `make vet`, `check-imports`, `check-brand`, `check-sizes`, golangci-lint, docs-gen. The whole suite under go1.27.4 is this pull request's quality gate. Signed-off-by: Konrad Karauda <konrad@karauda.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reading a plane is not a roster capability. The health socket answers a peer by its uid against
health.socket_uid, and a file is read by whoever its modes let read it. The roster'sreadlevel parses and is reserved: it grants nothing yet. This change says so where an operator looks, and adds a table of every signed file a plane takes in, with the check and the test behind each.doctor'strustline names every file the signed start checked, the roster among them, from the same list the start uses (signedStartFiles, extracted fromcheckSignedStartwith no change in behaviour). When the roster holdsreadgrants, it adds that they grant nothing yet.docs/contracts.md, new section "Signed files and their project checks": one row per receiver, giving what it takes, the tenant and project it holds the file to, the function that checks it, and the test that refuses another project's.tenant_id.listener.principal.tenant_idwhere set). Where the two differ, an operator needs a grant over each.coversnames every cited file, so a change to one of those checks flags it.docs/backlog.mdkeeps only open work: reads and operations of another project refused at every receiver, a stop naming its agent or principal scope, and adversarial tests of two users and overlapping runs.readlevel. The status trust row and CHANGELOG are updated.Verified:
runs.diralways named, and each docscheck existence check turned off.cmd/guardana-gateway(whole),internal/docscheck,internal/console,internal/core/approval,internal/metricsandinternal/core.make vet,check-imports,check-brand,check-sizes, golangci-lint.Not covered:
docs-impact: 0 uncovered surfaces; frozen paths ADR-0071, contracts.md (the new section) and status. Suspect pages read; none made false.