validate: separation-of-duties agent + Symbiont 1.14.1#3
Merged
Conversation
The path dep ../../../symbiont was broken since the project moved under repos/ -- it resolved to /home/jascha/Documents/symbiont which does not exist. Pin symbi-runtime = 1.14.1 and symbi-channel-adapter = 0.1.3 from crates.io so builds work without a sibling checkout.
Add a validate agent that adjudicates findings and is the only principal allowed to flip findings.verified / false_positive. Without this the unverified_critical_high_count gate in evidence.cedar was a permanent deadlock -- nothing could ever satisfy it. - agents/validate.symbi: capabilities exclude store_finding by construction - policies/validation.cedar: forbid validate from store_finding; forbid every non-validate principal from verify_finding / mark_false_positive - src/evidence_tools.rs: verify_finding + mark_false_positive MCP tools (Cedar action verify_evidence); both fail fast on empty inputs - src/db.rs: Verdict enum, NewVerification, transactional record_verification() that updates flags + inserts audit row atomically - db/schema.sql: finding_verifications audit table with verifier/verdict/ rationale; idx_verifications_finding for lookup - db/migrations/2026-05-21-validate-cutover.sql: one-time backfill for legacy findings stuck at verified = FALSE; smoke-tested - agents/engagement-controller.symbi: invoke validate after vuln-assess (gates exploit phase) and after post-exploit (unblocks reporter) - tests/db_tests.rs: 3 new tests for verified / false-positive / unknown - tests/tool_registration_tests.rs: evidence 5 -> 7, total 33 -> 35 Also rename agents/*.dsl -> agents/*.symbi (canonical extension in symbi-dsl 1.14.1; .dsl is supported as legacy) and refresh AGENTS.md / README.md.
cargo install symbi@1.10.0 now fails because the crate was yanked from crates.io. v1.14.1 is the current published release and matches the runtime dep we just pinned in Cargo.toml. v1.14.1 also brings the security-audit response (fail-closed default policy gate, JWT algorithm allowlist, hardened invis-strip).
v1.14.0's security audit response made `native-sandbox` a compile-time error in release builds (zero isolation; "use Docker, gVisor, Firecracker, or E2B"). cargo install always builds release, so the previous feature set fails outright. This container is itself the sandbox (Kali image with dropped caps), so the native sandbox runner was never the right primitive. Drop it. Add `cedar` because v1.14.0 also flipped the default policy gate to fail-closed: without the Cedar feature every tool call is denied at runtime, which would brick the whole pen-test pipeline. `interactive` is already in the symbi default feature set, so the explicit listing was redundant.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
symbi-runtime/symbi-channel-adapterto crates.io v1.14.1 / 0.1.3 (the../../../symbiontpath dep was broken — it resolved to a directory that doesn't exist on disk).agents/validate.symbias the only principal allowed to flipfindings.verified/false_positive. Without this, theunverified_critical_high_count > 0gate inevidence.cedarwas a permanent deadlock — nothing could satisfy it.policies/validation.cedar: validate is forbidden fromstore_finding; every non-validate principal is forbidden fromverify_finding/mark_false_positive. Deny-overrides keeps these absolute even if a future tool-auth rule slips up.verify_findingandmark_false_positive(Cedar actionverify_evidence) write afinding_verificationsaudit row + flip flags atomically.finding_verificationstable withverifier/verdict/rationale;idx_verifications_finding.vuln_findings_reviewed) and after post-exploit (clearsunverified_critical_high_countso reporter can run).db/migrations/2026-05-21-validate-cutover.sqlbackfills legacy findings stuck atverified = FALSEwith apre_validate_cutoververifier identity — smoke-tested.agents/*.dsl→agents/*.symbi(canonical extension in symbi-dsl 1.14.1;.dslstill supported as legacy).Test plan
cargo build -j10greencargo test -j10— 96 tests pass (28 + 1 + 15 + 15 + 37, plus 3 new verification tests indb_tests.rs)cargo clippy -j10 --all-targets -- -D warningscleanfalse_positive=TRUEpreserved whileverifiedflipspolicies/validation.cedardeny-overrides interaction with existingtool-authorization.cedarrules