AI/Tasks/ExecutionUpgrades/Execution_Phase01_SecurityAuthorizationCorrectness_Supplemental_FocusedRepair.txt
|
PHASE 01 SUPPLEMENTAL PROMPT - FOCUSED REPAIR (SECURITY, AUTHORIZATION, CORRECTNESS)
Goal: Close the specific Phase 01 implementation gaps reported in the latest execution run without reopening completed work. Run context: - Prior run delivered partial Phase 01 baseline (registry + fail-closed args + path-root auth + atomic helper), but did not complete endpoint restrictions, DNS hardening, full replacement-write wiring, or new negative tests. - This prompt is a focused repair pass only. Inputs: - AI/Tasks/ExecutionUpgrades/Implementation_Overview.txt - AI/Tasks/ExecutionUpgrades/Execution_Phase01_SecurityAuthorizationCorrectness_Implementation.txt - AI/Tasks/ExecutionUpgrades/Execution_Phase01_SecurityAuthorizationCorrectness_Strict.txt - AI/Tasks/ExecutionUpgrades/Overview.txt - Latest run markdown in LogsAndExports/Logs/TechAgentMarkdown (most recent TechAgent_*.md) Primary target surfaces: - src/TechToolbox.Agent/Execution/* - src/TechToolbox.Agent/Tools/* (only direct execution/validation seams) - src/TechToolbox.Agent/Orchestrator/* (only direct integration seams) - src/TechToolbox.Agent/Tests/*Execution* and focused security test files Global invariants (must remain true): - Security pipeline order is fixed: resolve -> validate -> authorize -> execute -> normalize. - Authority precedence is fixed: policy/system guardrails > execution safety/authorization/confirmation > explicit intent > reliability/routing details. - Never weaken authorization, confirmation, sandboxing, refusal rules, or execution safety. - Logs/telemetry/diagnostics must remain redacted and resource-bounded. Required focused repair work: 1) Wire atomic replacement into all replacement-write paths - Ensure replacement semantics are used by WRITE-FILE overwrite flows and REPLACE-IN-FILE commit paths. - If APPEND-FILE has a replacement-style branch (rewrite whole file), route through the same atomic commit helper. - Re-check authorization immediately before commit for replacement writes. - Preserve existing short-overwrite and confirmation safeguards. 2) Complete endpoint policy seams for network execution surfaces - SEARCH-WEB must enforce allowlisted providers only (deterministic failure outcome on disallowed provider/endpoint). - NOAA fetch paths must enforce approved hostnames and safe redirect targets. - FETCH-URL must enforce explicit endpoint policy and DNS rebinding defense. - Keep file-root authorization and network authorization separated (no cross-coupling logic). 3) Add explicit transport safety limits - Enforce bounded redirect count. - Enforce response-size ceiling. - Enforce DNS lookup timeout bound. - Enforce connection/request timeout bound. - Ensure limit failures produce stable, named failure codes/messages suitable for test assertions. 4) Implement DNS rebinding defenses for hostname-based fetch - Pin resolved address set for the initial connection decision. - Revalidate host/address constraints on redirects. - Reject private, loopback, link-local, and other disallowed destination classes unless explicitly policy-allowed. - Fail closed on resolution ambiguity or policy-check failure. 5) Expand strict registry coverage only as needed for touched built-ins - Keep metadata and validation fail-closed. - Do not broaden into unrelated tooling or architectural decomposition. Minimum tests to add/update (required in this pass): - Atomic replacement integration tests for WRITE-FILE overwrite and REPLACE-IN-FILE commit behavior. - Pre-commit authorization re-check test for replacement writes. - SEARCH-WEB allowlist rejection test. - NOAA redirect/host restriction tests (allowed host success + disallowed host failure). - FETCH-URL DNS rebinding test (address change or disallowed class between resolution/redirect). - Redirect loop or redirect-limit exhaustion test. - Request/response size and timeout limit tests (at least one deterministic assertion per limit type). Implementation constraints: - Keep edits bounded and deterministic. - Preserve current contracts for error/result model, cancellation semantics, authorization ownership, telemetry ownership, file-operation semantics, rollback/recovery behavior. - Do not introduce Phase 02+ work (async leasing, broad architecture decomposition, observability expansion beyond minimal assertions needed by this phase). Validation commands: - dotnet build src/TechToolbox.Agent/TechToolbox.Agent.csproj -c Release - dotnet test src/TechToolbox.Agent/Tests/TechToolbox.Agent.Tests.csproj -c Release --filter "Security|Authorization|Path|Atomic|Redirect|DNS|Allowlist|Fetch|Noaa|Write" Step budget (hard limits): 1) Discovery: <= 8 read/search calls. 2) Edits: <= 10 file edits. 3) Validation: 1 build + 1 targeted test run. 4) Repair cycles: at most 1 focused repair cycle for phase-related failures. 5) Stop once acceptance criteria pass. Stop conditions: - Stop immediately if a requested change would weaken any safety invariant. - After one failed repair cycle, emit FAILED_VALIDATION with exact failing assertions and no broad refactor fallback. Acceptance criteria (must all pass): - Atomic replacement helper is integrated into all replacement-write commit paths touched in this phase. - Authorization is re-checked immediately before replacement-write commit. - SEARCH-WEB/NOAA/FETCH-URL endpoint restrictions are explicit, enforced, and test-covered. - Redirect, DNS, connection, and response-size limits are enforced with deterministic failure outcomes. - DNS rebinding protections are enforced across initial resolution and redirects. - Negative tests exist for traversal/escape-adjacent remote-policy failures, redirect abuse, and rebinding behavior. - Build and targeted security tests pass. Output results in markdown using this structure: 1) Summary 2) Files changed 3) Focused repair changes (atomic writes, endpoint policy, DNS/redirect limits) 4) Tests added/updated 5) Validation results 6) Remaining known risks (if any) 7) Step-budget report (planned vs actual) |