From d99c6dccffbf5fa7142720892885e143df5d206e Mon Sep 17 00:00:00 2001 From: Dzmitry Prychyna Date: Mon, 17 Aug 2026 20:55:36 -0300 Subject: [PATCH] assurance: harden runtime capability boundary --- ...est_alpha4_runtime_release_architecture.py | 84 ++++++++++++ tools/alpha4_runtime_expression_airgap.py | 120 +++++++++++++++++- tools/alpha4_runtime_public_release_audit.py | 6 +- tools/alpha4_runtime_release_admission.py | 16 ++- .../alpha4_runtime_triangulated_expression.py | 4 +- 5 files changed, 218 insertions(+), 12 deletions(-) diff --git a/tests/test_alpha4_runtime_release_architecture.py b/tests/test_alpha4_runtime_release_architecture.py index 68e11e6..85ed69e 100644 --- a/tests/test_alpha4_runtime_release_architecture.py +++ b/tests/test_alpha4_runtime_release_architecture.py @@ -158,4 +158,88 @@ class Binding: assert evidence["cases"]["grand_total"] == 7265 assert evidence["companion_import_surface"] == "RESTRICTED" assert evidence["companion_file_access"] == "MATERIALIZED_PROFILE_TREE_READ_ONLY" + assert evidence["companion_dynamic_builtins"] == "DENIED" + assert evidence["companion_filesystem_method_aliasing"] == "DENIED" + assert evidence["companion_seed_loader_exec"] == "EXACT_SEED_BASE_BYTES_ONLY" + assert evidence["runtime_capability_isolation"] == "PASS" + assert evidence["process_isolation"] == "NOT_CLAIMED" assert evidence["status"] == "PASS" + + +def test_runtime_airgap_rejects_bound_filesystem_capability_alias() -> None: + import pytest + + from tools.alpha4_runtime_expression_airgap import ( + AirgapError, + _validate_companion_ast, + ) + + source = "from pathlib import Path\nprobe = Path('.').iterdir\n" + with pytest.raises( + AirgapError, + match="filesystem inspection forbidden", + ): + _validate_companion_ast( + source, + allowed_imports=frozenset({"pathlib"}), + allow_seed_loader=False, + ) + + +def test_runtime_airgap_denies_aliased_dynamic_builtin_at_runtime( + tmp_path, +) -> None: + import pytest + + from tools.alpha4_runtime_expression_airgap import ( + AirgapError, + _load_expression, + ) + + subject = tmp_path / "runtime-subject.py" + subject.write_text( + "capability = getattr\ncapability((), 'missing')\n", + encoding="utf-8", + ) + + with pytest.raises( + AirgapError, + match="forbidden runtime capability", + ): + _load_expression( + subject, + tmp_path, + allowed_imports=frozenset(), + allow_seed_loader=False, + ) + + +def test_runtime_airgap_denies_arbitrary_compile_exec_alias( + tmp_path, +) -> None: + import pytest + + from tools.alpha4_runtime_expression_airgap import ( + AirgapError, + _load_expression, + ) + + subject = tmp_path / "runtime-compile-subject.py" + subject.write_text( + "compiler = compile\n" + "executor = exec\n" + "code = compiler('VALUE = 1\\n', 'not-seed.py', 'exec')\n" + "executor(code)\n", + encoding="utf-8", + ) + + with pytest.raises( + AirgapError, + match="compile path is not exact Seed base", + ): + _load_expression( + subject, + tmp_path, + allowed_imports=frozenset(), + allow_seed_loader=True, + ) diff --git a/tools/alpha4_runtime_expression_airgap.py b/tools/alpha4_runtime_expression_airgap.py index 2b5fdc6..b7590da 100644 --- a/tools/alpha4_runtime_expression_airgap.py +++ b/tools/alpha4_runtime_expression_airgap.py @@ -49,6 +49,43 @@ } ) +_FILESYSTEM_MUTATION_METHODS = frozenset( + { + "write_text", + "write_bytes", + "unlink", + "rename", + "replace", + "mkdir", + "touch", + "chmod", + "symlink_to", + "hardlink_to", + } +) + +_DENIED_RUNTIME_BUILTINS = frozenset( + { + "breakpoint", + "copyright", + "credits", + "delattr", + "dir", + "eval", + "exit", + "getattr", + "globals", + "help", + "input", + "license", + "locals", + "quit", + "setattr", + "type", + "vars", + } +) + class AirgapError(RuntimeError): pass @@ -105,8 +142,17 @@ def enclosing_function(node: ast.AST) -> str | None: ) elif isinstance(node, ast.Name) and node.id == "__builtins__": raise AirgapError("air-gap companion accesses __builtins__") - elif isinstance(node, ast.Attribute) and node.attr.startswith("_"): - raise AirgapError(f"air-gap companion private attribute forbidden: {node.attr}") + elif isinstance(node, ast.Attribute): + if node.attr.startswith("_"): + raise AirgapError(f"air-gap companion private attribute forbidden: {node.attr}") + require( + node.attr not in _FILESYSTEM_INSPECTION_METHODS, + f"air-gap companion filesystem inspection forbidden: {node.attr}", + ) + require( + node.attr not in _FILESYSTEM_MUTATION_METHODS, + f"air-gap companion filesystem mutation forbidden: {node.attr}", + ) elif isinstance(node, ast.Call) and isinstance(node.func, ast.Name): if node.func.id in { "__import__", @@ -218,18 +264,76 @@ def guarded_import( raise ImportError(f"air-gap companion import forbidden: {name}") return original_import(name, globals, locals, fromlist, level) + original_compile = builtins.compile + original_exec = builtins.exec + approved_exec_codes: dict[int, object] = {} + expected_seed_base = ( + allowed_root / "base" / "seed" / "python" / "aset_seed_alpha4.py" + ).resolve() + + def denied(*args: object, **kwargs: object) -> object: + raise AirgapError("air-gap companion attempted forbidden runtime capability") + + def guarded_compile( + source_value: object, + filename: object, + mode: object, + *args: object, + **kwargs: object, + ) -> object: + require( + allow_seed_loader, + "air-gap companion compile forbidden outside exact Seed base loader", + ) + require( + isinstance(source_value, (str, bytes)) and isinstance(filename, str) and mode == "exec", + "air-gap companion compile permitted only for exact Seed base loader", + ) + candidate = Path(filename).resolve() + require( + candidate == expected_seed_base, + "air-gap companion compile path is not exact Seed base", + ) + with original_io_open(candidate, "rb") as stream: + expected_bytes = stream.read() + actual_bytes = ( + source_value.encode("utf-8") if isinstance(source_value, str) else source_value + ) + require( + actual_bytes == expected_bytes, + "air-gap companion compiled Seed source bytes mismatch", + ) + code = original_compile( + source_value, + filename, + mode, + *args, + **kwargs, + ) + approved_exec_codes[id(code)] = code + return code + safe_builtins = dict(vars(builtins)) + for name in _DENIED_RUNTIME_BUILTINS: + if name in safe_builtins: + safe_builtins[name] = denied safe_builtins["__import__"] = guarded_import safe_builtins["open"] = guarded_open + safe_builtins["compile"] = guarded_compile def guarded_exec( code: object, globals_dict: dict[str, Any] | None = None, locals_dict: dict[str, Any] | None = None, ) -> None: + require( + allow_seed_loader and approved_exec_codes.get(id(code)) is code, + "air-gap companion exec permitted only for exact Seed base code", + ) + approved_exec_codes.pop(id(code), None) target_globals = {} if globals_dict is None else globals_dict - target_globals.setdefault("__builtins__", safe_builtins) - exec(code, target_globals, locals_dict) + target_globals["__builtins__"] = safe_builtins + original_exec(code, target_globals, locals_dict) safe_builtins["exec"] = guarded_exec namespace: dict[str, Any] = { @@ -521,6 +625,11 @@ def check_expression_airgap(profiles_root: Path) -> dict[str, Any]: "generator_runtime_dependency": "NONE", "companion_import_surface": "RESTRICTED", "companion_file_access": "MATERIALIZED_PROFILE_TREE_READ_ONLY", + "companion_dynamic_builtins": "DENIED", + "companion_filesystem_method_aliasing": "DENIED", + "companion_seed_loader_exec": "EXACT_SEED_BASE_BYTES_ONLY", + "runtime_capability_isolation": "PASS", + "process_isolation": "NOT_CLAIMED", "seed_base": {"sha256": sha256(seed_base), "status": "EXACT"}, "profile_tree_digest": tree_before, "cases": { @@ -560,7 +669,8 @@ def main() -> int: f"{cases['identity_sensitivity']}/5 PASS" ) print(f"ALPHA4_RUNTIME_PYTHON_AIRGAP_GRAND_TOTAL={cases['grand_total']}/7265 PASS") - print("ALPHA4_RUNTIME_PYTHON_COMPANION_RUNTIME_ISOLATION=PASS") + print("ALPHA4_RUNTIME_PYTHON_COMPANION_RUNTIME_CAPABILITY_ISOLATION=PASS") + print("ALPHA4_RUNTIME_PYTHON_COMPANION_PROCESS_ISOLATION=NOT_CLAIMED") print( "ALPHA4_RUNTIME_PYTHON_EVIDENCE_SET_ORDER=" f"{evidence['evidence_set_order_checks']}/{evidence['evidence_set_order_checks']} PASS" diff --git a/tools/alpha4_runtime_public_release_audit.py b/tools/alpha4_runtime_public_release_audit.py index 6c22711..4cce719 100644 --- a/tools/alpha4_runtime_public_release_audit.py +++ b/tools/alpha4_runtime_public_release_audit.py @@ -171,7 +171,11 @@ def check_public_release( and python_airgap.get("structural_cases") == 7260 and python_airgap.get("identity_sensitivity_cases") == 5 and python_airgap.get("grand_total_cases") == 7265 - and python_airgap.get("runtime_isolation") == "PASS", + and python_airgap.get("runtime_capability_isolation") == "PASS" + and python_airgap.get("process_isolation") == "NOT_CLAIMED" + and python_airgap.get("dynamic_builtins") == "DENIED" + and python_airgap.get("filesystem_method_aliasing") == "DENIED" + and python_airgap.get("seed_loader_exec") == "EXACT_SEED_BASE_BYTES_ONLY", "Python air-gap public evidence invalid", ) require(certificate.get("archive_binding") == "EXACT", "archive binding is not exact") diff --git a/tools/alpha4_runtime_release_admission.py b/tools/alpha4_runtime_release_admission.py index ae83869..9c6a8ba 100644 --- a/tools/alpha4_runtime_release_admission.py +++ b/tools/alpha4_runtime_release_admission.py @@ -114,7 +114,12 @@ def check_release_admission( airgap.get("semantic_source_runtime_dependency") == "NONE" and airgap.get("generator_runtime_dependency") == "NONE" and airgap.get("companion_import_surface") == "RESTRICTED" - and airgap.get("companion_file_access") == "MATERIALIZED_PROFILE_TREE_READ_ONLY", + and airgap.get("companion_file_access") == "MATERIALIZED_PROFILE_TREE_READ_ONLY" + and airgap.get("companion_dynamic_builtins") == "DENIED" + and airgap.get("companion_filesystem_method_aliasing") == "DENIED" + and airgap.get("companion_seed_loader_exec") == "EXACT_SEED_BASE_BYTES_ONLY" + and airgap.get("runtime_capability_isolation") == "PASS" + and airgap.get("process_isolation") == "NOT_CLAIMED", "Runtime Python air-gap independence boundary drift", ) @@ -164,7 +169,11 @@ def check_release_admission( "structural_cases": airgap["cases"]["total"], "identity_sensitivity_cases": airgap["cases"]["identity_sensitivity"], "grand_total_cases": airgap["cases"]["grand_total"], - "runtime_isolation": "PASS", + "runtime_capability_isolation": "PASS", + "process_isolation": "NOT_CLAIMED", + "dynamic_builtins": "DENIED", + "filesystem_method_aliasing": "DENIED", + "seed_loader_exec": "EXACT_SEED_BASE_BYTES_ONLY", }, "release": { "tree_digest": release_tree, @@ -231,7 +240,8 @@ def main() -> int: print(f"ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_AIRGAP={cases}/{cases} PASS") print("ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_AIRGAP_IDENTITY_SENSITIVITY=5/5 PASS") print("ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_AIRGAP_GRAND_TOTAL=7265/7265 PASS") - print("ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_RUNTIME_ISOLATION=PASS") + print("ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_RUNTIME_CAPABILITY_ISOLATION=PASS") + print("ALPHA4_RUNTIME_RELEASE_ADMISSION_PYTHON_PROCESS_ISOLATION=NOT_CLAIMED") print("ALPHA4_RUNTIME_RELEASE_ADMISSION_ARCHIVE_BINDING=EXACT") print("ALPHA4_RUNTIME_PUBLIC_ASSURANCE_REPRESENTATIONS=OPERATIONAL,RELATIONAL,CAUSAL") print("ALPHA4_RUNTIME_PUBLIC_POST_BUILD_FORMAL_ASSURANCE=PASS") diff --git a/tools/alpha4_runtime_triangulated_expression.py b/tools/alpha4_runtime_triangulated_expression.py index 08780cf..793337f 100644 --- a/tools/alpha4_runtime_triangulated_expression.py +++ b/tools/alpha4_runtime_triangulated_expression.py @@ -229,9 +229,7 @@ def print_evidence(evidence: dict[str, object]) -> None: "ALPHA4_RUNTIME_RELATIONAL_SOURCE_DERIVATIONS=" f"{relational_derivations}/{relational_derivations} PASS" ) - print( - f"ALPHA4_RUNTIME_INTERFACE_VALIDATOR_INDEPENDENCE={validator_cases}/{validator_cases} PASS" - ) + print(f"ALPHA4_RUNTIME_INTERFACE_VALIDATOR_CROSSCHECK={validator_cases}/{validator_cases} PASS") print(f"ALPHA4_RUNTIME_IDENTITY_FIELD_SENSITIVITY={sensitivity}/{sensitivity} PASS") print(f"ALPHA4_RUNTIME_EVIDENCE_SET_ORDER_INVARIANCE={evidence_set}/{evidence_set} PASS") print("ALPHA4_RUNTIME_REPRESENTATION_SOURCE_INDEPENDENCE=PASS")