Repository navigation
feat(approval): origin classes, durable flow trust and scored prompt screening (contract 1.22) - #31
Conversation
…screening (contract 1.22)
Adds Origin::{TrustedAutomation, LocalOperator, Unlabelled} to approval evaluation,
GrantFlowTool2/RevokeFlowTool2/ListFlowTrust2 persisted through the ApprovalStore2
callback, and ScanPrompt2 with the host detector's score tiers, normalization and
false-positive tuning. Ports the detector's test corpus as fixtures.
Co-authored-by: Medulla <medulla@tinyhumans.ai>
Tiny Sweeper reviewTiny Sweeper completed its review; deterministic results follow. State: Incomplete Review snapshot
Completeness: Incomplete What changedThe diff extends the wire contract to 1.22 in three areas and reworks approval evaluation to honour them. `Origin` gains `TrustedAutomation`, `LocalOperator` and `Unlabelled`; `Rule` gains `GrantOnly`; and the approval engine routes calls through a new `origin_rule` and `automatic_grant` that decide denial, whole-tool grants, human-only remapping and attribution labels before any prompt or judge. New `flow_trust` and `prompt_score` bus modules are re-exported from `lib.rs`, their member names are added to the advertised `METHODS` list, and the module adapter exposes `grant_flow_tool2`, `revoke_flow_tool2`, `list_flow_trust2` and `scan_prompt2` and advertises them in `module_export!`. The redactor gains a `Scorer` behind `scan_prompt_scored`, and the existing verdict scanner now also reports a space-padded `jailbreak`. Documentation in `MODULE.md` and `README.md` describes the new behaviour. The previously raised finding ("Move fenced reaper spawn after lock is shipped") does not correspond to anything in this diff — no reaper spawn or lock ordering appears in the changed files — so it is not reproduced and is dropped. Features
Tests
FindingsNo active actionable findings. Resolved this pass
Could not review: tinysweeper/description Before merge
How this fits togetherflowchart LR
n0["lifecycle_valid<br/>changed"]:::changed
n1["Engine<br/>changed"]:::changed
n2["ScopeEntry<br/>changed"]:::changed
n3["...eports_the_subject_handle_only_when_asked<br/>changed"]:::changed
n4["Rule<br/>changed"]:::changed
n5["...tcuts_and_saas_has_no_implicit_permission<br/>changed"]:::changed
n6["scope_handle"]:::impacted
n7["evaluate"]:::impacted
n8["ApprovalScope2"]:::impacted
n9["ApprovalRow2"]:::impacted
n10["grant_flow_tool"]:::impacted
n0 -->|uses| n9
n1 -->|uses| n9
n2 -->|uses| n8
n3 -->|calls| n6
n3 -->|tests| n6
n5 -->|uses| n8
n7 -->|uses| n4
n7 -->|uses| n8
n10 -->|calls| n6
classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reached
This review includes 26 billable files and costs up to $6.50. Or wait 24 minutes for your next included review. View limit details
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 800fcb456f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
There was a problem hiding this comment.
Requesting changes: 1 lane(s) blocking, worst finding is high.
Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.
$0.0150 · 3,394,007 in / 139,940 out · 686,464 cached (20%) · ladder/vectors-oai3, deepseek-v4.1-flash, , glm-5.3-flash · 772 embedded
critique: $0.0115 · 1,987,641 in / 117,850 out · 392,448 cached (20%) · deepseek-v4.1-flash,
security: $0.0021 · 1,101,218 in / 13,839 out · 193,024 cached (18%) · deepseek-v4.1-flash, glm-5.3-flash
tests: $0.0001 · 111,438 in / 429 out · 55,424 cached (50%) · deepseek-v4.1-flash
description: $0.0005 · 145,696 in / 900 out · 45,568 cached (31%) · glm-5.3-flash, deepseek-v4.1-flash
… tests Co-authored-by: Medulla <medulla@tinyhumans.ai>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3cbe32234
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }; | ||
| let entry = self.entry(&request.scope_id)?; | ||
| let granted = entry | ||
| let mut granted = entry |
There was a problem hiding this comment.
When an Unlabelled call was approved by a whole-tool grant, replacing the scope with only a matching per-flow grant leaves the unconsumed row executable because this generic grant() check accepts either grant type. This bypasses the new rule that unlabelled origins may be authorized only by a whole-tool grant; revalidation should use tool_grant() for these rows or rerun the origin-specific grant rule.
Useful? React with 👍 / 👎.
| judge: None, | ||
| audit: request.audit, | ||
| }; | ||
| self.persist(None, &row).await?; |
There was a problem hiding this comment.
If a scope already has the maximum valid load of 1,024 approval records, a distinct flow-trust grant reaches this persistence call and creates record 1,025 while still returning Granted. Every subsequent operation that loads the scope then fails because ApprovalLoadRequest2::verify_response rejects responses containing more than 1,024 records, effectively bricking approvals for that scope; enforce the shared record capacity before persisting another long-lived trust row.
Useful? React with 👍 / 👎.
| if request.flow_id.is_empty() || request.flow_id.len() > 1024 || request.tool.is_empty() { | ||
| return Err(Error::Invalid); |
There was a problem hiding this comment.
For revocations containing whitespace/control characters, names over the 256-byte grant limit, or human-only/native tools, this weaker validation accepts values that grant_flow_tool can never create and reports Absent instead of refusing the malformed request. Reuse trust_pair_valid here so grant and revoke enforce the documented name and tool constraints consistently.
Useful? React with 👍 / 👎.
Co-authored-by: Medulla <medulla@tinyhumans.ai>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 11f9731aca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // A human-only tool needs a fresh human decision under every origin: the | ||
| // trusted-origin shortcuts never cover it. | ||
| Rule::Automatic | ||
| if matches!(origin, Origin::TrustedAutomation | Origin::LocalOperator) | ||
| && (HUMAN_ONLY_TOOLS2.contains(&request.request.call.tool.as_str()) | ||
| || binding::is_native(&request.request.call.tool)) => | ||
| { | ||
| Ok(Rule::Approval) |
There was a problem hiding this comment.
When a TrustedAutomation or LocalOperator call repeats the content of a previously human-approved policy_change whose choice was Tool or Flow, this fallback changes the origin result to Approval, but begin_reuse still treats only sandbox_host_network, device_crypto, and native entry points as human-only. It therefore returns an automatically approved exact-reviewed-grant row without obtaining the fresh decision required for every human-only call. The fresh evidence after the earlier fix is the narrower human-only check at begin_reuse, so this guard should also prevent reuse for every entry in HUMAN_ONLY_TOOLS2.
Useful? React with 👍 / 👎.
| flow_id.len() <= 1024 | ||
| && ApprovalGrants2 { | ||
| tools: vec![], | ||
| flows: vec![FlowToolGrant2 { | ||
| flow_id: flow_id.into(), | ||
| tool: tool.into(), | ||
| }], | ||
| } | ||
| .is_valid() |
There was a problem hiding this comment.
For flow identifiers between 257 and 1,024 bytes, approval evaluation accepts CallerContext::flow, and revocation/list filtering also explicitly accept up to 1,024 bytes, but wrapping the pair in ApprovalGrants2 invokes is_valid, whose shared grant-name limit is 256 bytes. Consequently GrantFlowTool2 rejects an otherwise valid flow that the rest of this API supports, so flow and tool validation need separate bounds here.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinysecurity-approval/src/engine.rs, tinysweeper/description.
$0.0187 · 550,166 in / 88,521 out · 37,632 cached (7%) · ladder/vectors-oai3, glm-5.3-flash, deepseek-v4.1-flash · 775 embedded
critique: $0.0028 · 97,714 in / 25,233 out · 25,856 cached (26%) · glm-5.3-flash, deepseek-v4.1-flash
security: $0.0144 · 299,053 in / 56,437 out · 11,776 cached (4%) · deepseek-v4.1-flash, glm-5.3-flash
tests: $0.0006 · 54,757 in / 3,030 out · 0 cached (0%) · glm-5.3-flash
description: $0.0004 · 47,031 in / 682 out · 0 cached (0%) · glm-5.3-flash
Co-authored-by: Medulla <medulla@tinyhumans.ai>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 47c0e5f570
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| /// A call whose origin the host could not label (contract 1.22). Approval | ||
| /// evaluation denies it unless the registered scope holds a whole-tool grant for | ||
| /// the tool, which approves it as an audited automatic approval. | ||
| Unlabelled, |
There was a problem hiding this comment.
When this shared variant is used in SandboxScope2, a local scope with origin: Unlabelled, a TrustedHost source, and environment: Disabled can request host_run and receive an unjailed host artifact: crates/tinysecurity-sandbox/src/engine.rs:438-440 makes isolation mandatory only for Origin::Saas. The same fallthrough also treats the new origin as eligible for operator host-network and process-isolation exceptions, even though Unlabelled explicitly means the host could not classify the caller. Update the sandbox origin checks to allowlist actual operator origins rather than letting every new non-SaaS variant inherit operator privileges.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: tinysweeper/tests.
$0.0141 · 482,190 in / 48,175 out · 105,856 cached (22%) · ladder/vectors-oai3, deepseek-v4.1-flash, glm-5.3-flash · 775 embedded
critique: $0.0090 · 242,130 in / 41,004 out · 60,032 cached (25%) · deepseek-v4.1-flash
security: $0.0012 · 47,385 in / 1,384 out · 0 cached (0%) · glm-5.3-flash, deepseek-v4.1-flash
description: $0.0005 · 144,319 in / 864 out · 45,824 cached (32%) · glm-5.3-flash, deepseek-v4.1-flash
Co-authored-by: Medulla <medulla@tinyhumans.ai>
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: tinysweeper/description.
$0.0008 · 462,561 in / 6,631 out · 199,552 cached (43%) · ladder/vectors-oai3, deepseek-v4.1-flash · 784 embedded
critique: $0.0001 · 105,812 in / 1,048 out · 50,048 cached (47%) · deepseek-v4.1-flash
security: $0.0001 · 102,246 in / 870 out · 49,024 cached (48%) · deepseek-v4.1-flash
tests: $0.0001 · 111,203 in / 445 out · 54,528 cached (49%) · deepseek-v4.1-flash
description: $0.0001 · 94,137 in / 907 out · 45,952 cached (49%) · deepseek-v4.1-flash
1 participant
Summary
Closes the approval and prompt-scan GAPs of epic tinyhumansai/openhuman#7328 so the host can delete its remaining copies. Contract 1.22 (no release in this PR).
OrigingainsTrustedAutomation,LocalOperator,Unlabelled.EvaluateApproval2answers them without parking: the first two are audited automatic approvals (auto:trusted-automation,auto:local-operator);Unlabelledis denied unless the scope holds a whole-tool grant (auto:tool-grant), with no prompt, reuse, judge orauto_approve_all. Cron external effects still deny; human-only tools still need a human.GrantFlowTool2,RevokeFlowTool2,ListFlowTrust2. One auditedApprovedrow per (flow, tool) through the host-servedApprovalStore2callback, so it persists across restarts (tested over a restarted module on the disk-ledger fixture). Domain-separated digests keep it from ever being consumed, resumed or used forPreauthorizeFlow2; it is re-checked at consumption so revoking it revokes its unconsumed approvals.ScanPrompt2.{ tier, score_milli, rule_ids }: the host detector's weights, thresholds (550/700), leet/Cyrillic/fullwidth/invisible normalization, lowered/collapsed/compact variants and false-positive tuning (recalled-memory transcripts, plural "tokens", "Dan"), ported with its whole test corpus. Base64 and invisible-character markers are reported with no weight. The host's optional env classifier is not ported.ScanPrompt/ScanToolDefinitionalso report a space-paddedjailbreak(override.obfuscated_role).MODULE.md. All new requests aredeny_unknown_fields, redactedDebug, golden fixtures intests/fixtures/v1_22_approval_scan.json.Test plan
cargo +1.98 fmt --all -- --checkcargo +1.98 clippy --all-targets --all-features -- -D warningscargo +1.98 test --all-features