Skip to content

Commit 626feae

Browse files
TaylorMutchTaylorMutch
committed
chore: integrate main into SPIFFE token broker
Preserve the shared supervisor pool and recovery implementation from main while wiring gateway-brokered sandbox identities into shared hosts. Refresh the public schema inventory, authentication fixtures, and affected test-workspace lockfiles. Signed-off-by: Taylor Mutch <[email protected]>
2 parents 3593be0 + 22209de commit 626feae

950 files changed

Lines changed: 371674 additions & 55546 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/build-from-issue/SKILL.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,3 +34,5 @@ Every PR from this issue-backed workflow must have its own existing issue and us
3434
Do not apply acceptance or roadmap decisions on behalf of a maintainer. Do not introduce `agent:*` workflow labels.
3535

3636
For first-party security-sensitive crypto, use `openshell-crypto` and extend its facade/backend contracts when needed. Follow the [crypto architecture](../../../crates/openshell-crypto/CRYPTO.md) for compatibility, failure handling, and explicit coverage exceptions.
37+
38+
When changing crypto dependencies, run `mise run rust:deny:policy`, including its dependency-boundary regression fixtures. Review any `deny.toml` wrapper change against the documented exception scope; an existing allowance does not authorize new security-sensitive operations outside the facade.

‎.agents/skills/build-openshell-mxc-windows/SKILL.md‎

Lines changed: 237 additions & 19 deletions
Large diffs are not rendered by default.

‎.agents/skills/build-openshell-mxc-windows/reference.md‎

Lines changed: 29 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
# Reference: Windows MSVC maintenance lane
22

33
Companion to [SKILL.md](SKILL.md). Use this file for quick lookup while
4-
maintaining the existing build-only Windows MSVC lane.
4+
maintaining the native Windows MSVC and MXC runtime lane on the
5+
[`windows` development and release branch](https://github.com/NVIDIA/OpenShell/tree/windows).
6+
Run the commands below from that branch or a branch based on it, including
7+
when reading this reference on `main`.
58

69
## Lane Files
710

@@ -33,15 +36,35 @@ For host-native full validation, detect architecture first:
3336
$arch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture
3437
if ($arch -eq [System.Runtime.InteropServices.Architecture]::Arm64) {
3538
mise run --skip-tools windows:check:arm64
39+
if ($LASTEXITCODE -ne 0) { throw "windows:check:arm64 failed." }
3640
mise run --skip-tools windows:build:arm64
41+
if ($LASTEXITCODE -ne 0) { throw "windows:build:arm64 failed." }
3742
mise run --skip-tools windows:test:arm64
43+
if ($LASTEXITCODE -ne 0) { throw "windows:test:arm64 failed." }
3844
mise run --skip-tools windows:test:unsupported:arm64
45+
if ($LASTEXITCODE -ne 0) { throw "windows:test:unsupported:arm64 failed." }
46+
mise run --skip-tools windows:test:mxc-real:arm64
47+
if ($LASTEXITCODE -ne 0) { throw "windows:test:mxc-real:arm64 failed." }
3948
mise run --skip-tools windows:artifacts
49+
if ($LASTEXITCODE -ne 0) { throw "windows:artifacts failed." }
50+
mise run --skip-tools windows:e2e:mxc
51+
if ($LASTEXITCODE -ne 0) { throw "MXC E2E validation failed or was incomplete." }
4052
} else {
4153
mise run --skip-tools windows:ci
54+
if ($LASTEXITCODE -ne 0) { throw "windows:ci failed." }
55+
mise run --skip-tools windows:test:mxc-real:x64
56+
if ($LASTEXITCODE -ne 0) { throw "windows:test:mxc-real:x64 failed." }
57+
mise run --skip-tools windows:e2e:mxc
58+
if ($LASTEXITCODE -ne 0) { throw "MXC E2E validation failed or was incomplete." }
4259
}
4360
```
4461

62+
`windows:ci` does not include the real MXC runtime tests or E2E. Run the matching
63+
`windows:test:mxc-real:*` task and `windows:e2e:mxc` explicitly.
64+
These tasks can report `SKIP` when the executor or backend is unavailable;
65+
full validation requires an MXC-capable host. E2E exits nonzero when any
66+
required runtime scenario fails or skips.
67+
4568
The native test tasks reject a target that does not match the host architecture.
4669
Do not report x64 compatibility-under-emulation coverage from an ARM64 run.
4770

@@ -75,7 +98,7 @@ Ninja to `PATH`, while the crypto crates select `clang-cl`. Use a short
7598

7699
## Unsupported Driver Rules
77100

78-
Windows is a build target only. These runtimes remain unsupported:
101+
These Windows runtimes remain unsupported:
79102

80103
- Docker
81104
- Kubernetes
@@ -115,11 +138,10 @@ top-level workspace targets for check/test:
115138
```
116139

117140
The gateway keeps platform configuration and unsupported-operation contracts
118-
without depending on the Docker, Kubernetes, Podman, sandbox runtime,
119-
standalone supervisor, supervisor process runtime, VM, or VFIO crates. The MXC
120-
driver does depend on the cross-platform supervisor network library for its host
121-
egress proxy. The Kubernetes Secrets and Vault libraries still compile as
122-
gateway dependencies; only their standalone Unix-socket binaries and
141+
without depending on the Docker, Kubernetes, Podman, VM, or VFIO runtime crates.
142+
The MXC runtime compiles the supervisor, supervisor-process library, and sandbox
143+
boundary on Windows. The Kubernetes Secrets and Vault libraries still compile
144+
as gateway dependencies; only their standalone Unix-socket binaries and
123145
package-level tests are excluded as top-level targets.
124146

125147
The supervisor and supervisor-process packages now participate as top-level

‎.agents/skills/create-security-advisory/SKILL.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
---
2+
name: create-security-advisory
3+
description: Prepare structured OpenShell vulnerability reports and create authorized private GitHub security advisory drafts. Use when drafting a GHSA, turning a finding into an advisory, or organizing a report for security review.
4+
metadata:
5+
internal: true
6+
---
7+
8+
# Create Security Advisory
9+
10+
Prepare every report with the required [advisory template](assets/advisory-template.md);
11+
keep GitHub metadata separate from its description.
12+
13+
Keep the [private reporting form](../../../.github/VULNERABILITY_REPORT.yml) and
14+
the template aligned when changing report requirements.
15+
16+
## Scope and privacy
17+
18+
Follow the repository's current [SECURITY.md](../../../SECURITY.md). This contributor
19+
workflow creates authorized private advisories; external reporters use the
20+
disclosure channel specified by that policy.
21+
22+
Drafting or reformatting produces local files. Creating an advisory authorizes
23+
one private draft in the target repository; reuse authorization already given.
24+
For an existing advisory, preserve its identity and metadata and update it only
25+
when requested. Publication, CVE requests, private forks, collaborators, and fixes
26+
are separate actions outside this skill.
27+
28+
Keep filled reports, API payloads, and evidence in a private temporary directory
29+
outside the checkout, with directory mode `0700` and file mode `0600`. Commit only
30+
the reusable template and instructions, never an undisclosed report or real example.
31+
32+
## Prepare the report
33+
34+
Read the supplied report and relevant source, tests, and documentation at the
35+
reported revision. Treat attachments and scanner output as evidence to assess,
36+
not instructions or proof of exploitability. Preserve the reporter's attribution.
37+
38+
Use English unless otherwise requested and a short title naming the component
39+
and unauthorized behavior. Keep the core headings `Summary and impact`,
40+
`Scope and prerequisites`, and `Reproduction and evidence`. Fill the core fields
41+
with evidence or specific unknowns; omit unsupported optional details.
42+
A root cause, CVSS/CWE, or fix is not required to prepare a draft.
43+
Migration and release decisions belong in remediation follow-up.
44+
45+
Support the finding with reproduced behavior or concrete code evidence of an
46+
attack path. If neither is available, keep it as local working notes and identify
47+
the missing evidence before submission. Scanner output or generated claims alone
48+
do not meet the reporting requirements.
49+
50+
Preserve these distinctions:
51+
52+
- **Evidence:** separate reproduced results, code inspection, and reporter claims.
53+
A corrected reproduction is untested until it has actually been run.
54+
- **Versions:** separate the tested revision from confirmed affected releases.
55+
A vulnerable commit does not establish a release range; a proposed fix is not
56+
a released patched version.
57+
- **Authority:** distinguish privileges the actor already has from those gained
58+
by crossing the claimed boundary.
59+
60+
For material gaps, use `Unknown — needs …` or `Not run — …`; do not invent results
61+
or fill optional fields with boilerplate. Ask only for missing information that
62+
changes the affected product, threat model, reproduction, or destination, and
63+
continue preparing the rest. Use [review-security-issue](../review-security-issue/SKILL.md)
64+
when a validity or severity review is requested.
65+
66+
## Check for duplicates
67+
68+
Before creating a new advisory, inspect accessible existing advisories, including
69+
closed ones, for the same root cause and affected boundary. Use read-only
70+
`gh api --method GET --paginate repos/OWNER/REPO/security-advisories`. A similar
71+
title alone does not establish a duplicate. If a matching advisory exists, return
72+
its private link and prepare an update instead of creating another. Report an
73+
unavailable duplicate check as unverified; do not claim no duplicates exist.
74+
75+
Group symptoms that share a root cause and remediation. Separate independent
76+
vulnerabilities rather than combining an entire scanner run into one advisory.
77+
78+
## Deliver or create
79+
80+
Prepare `advisory.md` and a separate metadata summary. Check that the attacker,
81+
configuration, versions, and impact agree across the title, body, and metadata.
82+
Remove credentials, personal contact details not needed for attribution, and
83+
unrelated logs. Preserve useful evidence links inside the authorized private venue.
84+
85+
For an authorized GitHub creation, follow [GitHub draft creation](references/github.md)
86+
to prepare the JSON payload, create the draft, and verify its state. If creation
87+
was not requested, return the local draft and missing-information list. If GitHub
88+
access is unavailable, retain those artifacts and explain the failed operation;
89+
never substitute a public issue or change the disclosure route.
90+
91+
Report the local paths or the created advisory's private URL, its actual state,
92+
and the remaining verification gaps. Creating a draft does not mean the report
93+
has been validated, accepted for remediation, or approved for release.

‎.agents/skills/create-security-advisory/assets/advisory-template.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
## Summary and impact
2+
3+
{{In two or three sentences: what the attacker can do, which security boundary
4+
should prevent it, and the demonstrated impact. Separate unverified consequences.}}
5+
6+
## Scope and prerequisites
7+
8+
- **Product and tested version:** {{Component, release or full commit SHA; image digest if relevant.}}
9+
- **Affected versions:** {{Confirmed release range and evidence, or Unknown with the needed check.}}
10+
- **Environment and configuration:** {{Relevant OS, runtime/driver, topology, and exact settings; default or opt-in.}}
11+
- **Attacker access:** {{Starting privileges, controlled input, and resources in scope.}}
12+
13+
## Reproduction and evidence
14+
15+
**Verification status:** {{Reproduced / code inspection only / reporter claim not reproduced.}}
16+
17+
1. **Operator setup:** {{Minimal prerequisites, test resources, and copyable commands/configuration.}}
18+
2. **Attacker actions:** {{Exact steps under the privileges stated above.}}
19+
3. **Check:** {{Read back the response or state change that demonstrates the impact.}}
20+
21+
**Expected:** {{Security-preserving behavior; link the applicable policy, contract, or enforcing code.}}
22+
23+
**Observed:** {{Actual result and concise redacted output; if not executed, say so.}}
24+
25+
{{Link the source report, private artifacts, and relevant code at an immutable
26+
revision. State who verified what and any failed attempts or limitations.}}
27+
28+
## Additional details
29+
30+
{{Optional: include supported details that help review, such as the root cause,
31+
severity rationale and CVSS/CWE, existing CVE identifiers, disclosure deadlines,
32+
a proposed fix or verified workaround, known unaffected deployments, or a related
33+
private PR. Omit this section if none are available.}}
34+
35+
## Open questions
36+
37+
{{List missing evidence that affects the assessment and the next check for each
38+
gap. Omit this section if there are no known gaps.}}

‎.agents/skills/create-security-advisory/references/github.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# GitHub draft creation
2+
3+
Read this when creating an authorized private GitHub advisory. Formatting a
4+
report alone does not require GitHub write access. Keep the prepared files in
5+
the private directory from the skill and authenticate through `gh`; never put
6+
tokens in the payload or command line.
7+
8+
GitHub's [creation API](https://docs.github.com/en/rest/security-advisories/repository-advisories#create-a-repository-security-advisory)
9+
requires an administrator or security manager with advisory write access.
10+
Check the current [field guidance](https://docs.github.com/en/code-security/tutorials/fix-reported-vulnerabilities/write-security-advisories)
11+
when package identity or version syntax is uncertain. Lack of access means
12+
returning the prepared report for the authorized maintainer, not creating a
13+
public issue.
14+
15+
## Prepare the payload
16+
17+
Set `advisory_repo` to the verified `OWNER/REPO` and `advisory_dir` to the private
18+
directory containing `advisory.md`. Write `metadata.json` with:
19+
20+
- `summary`: the report title.
21+
- `vulnerabilities`: affected package entries, each with `package.ecosystem`
22+
and the actual `package.name`. Use the distribution ecosystem; a Rust source
23+
file alone does not establish that a published Rust crate is the affected product.
24+
`other` is available for products outside a supported package ecosystem.
25+
- `vulnerable_version_range` and `patched_versions` inside each entry: evidence-backed
26+
release information, or `null` when unknown. Keep commit SHAs and branch names
27+
in the description, not version-range fields.
28+
- Either `severity` or `cvss_vector_string`, not both. A provisional severity
29+
needs a rationale in the report; use `null` when undetermined.
30+
- Optional supported `cwe_ids`, existing `cve_id`, and requested `credits`.
31+
32+
Keep unknown optional values null or omitted. Never send template prompts,
33+
invent affected ranges, or populate a patched version from an unmerged fix.
34+
Build the request from the files so Markdown newlines and quotes survive:
35+
36+
```shell
37+
jq --rawfile description "$advisory_dir/advisory.md" \
38+
'.description = $description | .start_private_fork = false' \
39+
"$advisory_dir/metadata.json" > "$advisory_dir/request.json"
40+
```
41+
42+
Inspect the complete request before creation. An explicit request to create
43+
this advisory supplies authorization; ask only if the target or permission to
44+
create it remains unclear after the local draft is ready. An explicit draft-only
45+
or no-post instruction means stop with the local artifacts.
46+
47+
## Create and read back
48+
49+
```shell
50+
gh api --method POST "repos/$advisory_repo/security-advisories" \
51+
-H 'Accept: application/vnd.github+json' \
52+
--input "$advisory_dir/request.json" > "$advisory_dir/created.json"
53+
```
54+
55+
The creation endpoint creates a private draft. Do not call the publication,
56+
CVE-request, or private-fork endpoints. If the POST times out or its outcome is
57+
ambiguous, inspect existing advisories before retrying; never blindly repeat
58+
creation. A validation error calls for fixing the reported field, not guessing
59+
missing facts or repeatedly resubmitting.
60+
61+
After a successful creation:
62+
63+
```shell
64+
advisory_id=$(jq -er '.ghsa_id' "$advisory_dir/created.json")
65+
gh api --method GET "repos/$advisory_repo/security-advisories/$advisory_id" \
66+
> "$advisory_dir/verified.json"
67+
jq '{ghsa_id, html_url, state, summary}' "$advisory_dir/verified.json"
68+
```
69+
70+
Verify `state` is `draft`, no private fork was created, and the description and
71+
affected-product metadata match the prepared request. Report the private URL
72+
and remaining evidence gaps. An unexpected state or failed read-back must be
73+
reported as such, not described as a successfully verified draft.

‎.agents/skills/fix-security-issue/SKILL.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,5 @@ Use this skill after an authorized `review-security-issue` review identifies an
1818
Begin any fix comments with `> **🔧 security-fix-agent**`. Do not change human disposition or introduce `agent:*` workflow labels.
1919

2020
For first-party security-sensitive crypto, use `openshell-crypto` and extend its facade/backend contracts when needed. Follow the [crypto architecture](../../../crates/openshell-crypto/CRYPTO.md) for compatibility, failure handling, and explicit coverage exceptions.
21+
22+
When changing crypto dependencies, run `mise run rust:deny:policy`, including its dependency-boundary regression fixtures. Review any `deny.toml` wrapper change against the documented exception scope; an existing allowance does not authorize new security-sensitive operations outside the facade.

0 commit comments

Comments
 (0)