Security Proof / Red-Team Adversarial Suite

English | 日本語 (SECURITY_PROOF.ja.md)

Scope note (Adversarial Security Test Suite, not a formal proof): Each "Proof" section in this document maps a concrete threat class to its enforcement mechanism in the reference implementation and an executable adversarial regression test in conformance/security-proofs.test.ts (plus the P0–P2 conformance tests). Those cases are empirical security and red-team regression tests executed in CI by pnpm test:security-proof. They are not machine-checked formal or mathematical proofs (for example TLA+, Coq, Lean, or symbolic protocol verification).

Skeptical engineers can rerun every proof below with:

pnpm test:security-proof

That command is vitest run conformance/security-proofs.test.ts. CI runs the same step, Run Security Proof Suite (Red-Team Adversarial Tests), after the main test suite. A passing run is the check: each case drives the production function, asserts the attack is rejected, and fails if a secret, injected command, cross-session read, or forged signature is accepted.

How to read a row

Proof 1 — Memory and environment secret exfiltration

Threat class: a compromised worker task dumps process.env, inspects the credential broker, or redeems an expired, forged, or other-task handle, trying to recover host secrets such as OPENAI_API_KEY or GITHUB_TOKEN. This is the post-PHP2Shell memory-disclosure class named alongside CVE-2026-109618 / CVE-2026-109619: raw provider material must stay in the host process.

Proof 2 — Command injection and path traversal

Threat class: task input or adapter arguments contain $(touch …), `id`, ; rm -rf /, | cat /etc/passwd, ../../etc/passwd, or __proto__.

LLM CLI adapters (claude, codex, openai) receive untrusted input from remote peers. ClaudeCodeAdapter / ClaudeCodeCliAdapter in packages/adapters/src/command.ts defaults to --tools Read,Glob,Grep, --disallowedTools Bash,Edit,Write,MultiEdit,NotebookEdit,WebFetch,WebSearch, and --permission-mode dontAsk, which disables shell execution, file writes, and web tools. CodexCliAdapter defaults to --sandbox read-only. extraArgs or explicit adapter options replace one flag and do not emit a second copy. Operators MUST run these adapters inside an OCI container (--isolation oci) or restrict tasks to trusted requester DIDs (--allow-requester <did>). conformance/p1-3-adapter-tool-restrictions.test.ts locks the defaults, the override path, and the argv a mock executable actually receives (pnpm test).

Proof 3 — Cross-session bleed and isolation downgrade

Threat class: concurrent principals read each other's relay inbox, a finished task leaves readable state, or a worker claims oci_container / container while the run was a subprocess (and the reverse direction of an under-reported required level). Mapped to CVE-2026-109619 and CVE-2026-115419.

The requester trusts the worker's signature over the host-reported level. Untrusted task output is not that level. packages/runtime/src/session.ts copies reportIsolation into the signed attestation, including sandboxBoundary when the sandbox runner supplies it.

Subprocess boundary versus OCI

subprocess_restricted is a separate OS process with a sanitized environment, a temporary scratch directory, a timeout followed by SIGTERM then SIGKILL, and an output byte cap. detectNodePermissionFlag selects --permission on Node.js >= 22.13 and on Node.js 23+, or --experimental-permission on earlier Node.js 20 and 22 releases, and resolveNodePermissionArgs pairs that flag with --allow-fs-read and --allow-fs-write for the scratch directory only. If the binary advertises neither flag, those --allow-fs-* arguments are omitted and sandboxBoundary.permissionModelActive is false. The permission model restricts filesystem, child-process, worker-thread, and native-addon access. It does not block fetch, node:net, node:http, node:https, node:dns, or node:dgram, and it is not a kernel network namespace.

Task code is evaluated with node:vm in that same process. Node.js documents that node:vm is not a security mechanism against untrusted code. A null-prototype context, and deleting globalThis.fetch and WebSocket in the wrapper, only shrink the guest API surface.

Untrusted third-party code requires oci_container. Callers set isolationLevel: 'oci_container' (conformance helpers pass this as requireOci: true). That path runs Podman or Docker with --network none, --read-only, --cap-drop ALL, --security-opt no-new-privileges, and PID and memory limits. ExecutionAttestation.effectiveIsolationLevel records the path that ran. VerificationEngine rejects a lower attestation when the contract requires oci_container and allowSubprocessFallback is not true. sandboxBoundary.kernelNetworkIsolated is true only for oci_container. permissionModelActive is false on that path because the container runtime, not the Node permission flag, is the boundary. conformance/p2-13-sandbox-boundary-accuracy.test.ts locks the flag selection and this wording.

Proof 4 — Resource exhaustion and SSRF

Threat class: oversized relay bodies, queue floods, nonce replay, and relay URLs aimed at instance metadata, loopback, or file:. Mapped to the exhaustion side of CVE-2026-109618.

Public http: and ws: relay endpoints stay allowed. conformance/security-hardening.test.ts (accepts public http: endpoints) locks that policy. This proof does not claim cleartext public HTTP is blocked.

AcpMcpServer in packages/runtime/src/mcp-server.ts applies the same outbound boundary to MCP hosts such as Claude Desktop or Cursor. acp_delegate_task and acp_delegate_multi parse invite tokens locally. Before any dial they reject a worker DID outside allowedWorkerDids with MCP_WORKER_NOT_ALLOWED, and a relay URL outside allowedRelayUrls with MCP_RELAY_NOT_ALLOWED. A plain worker DID must be listed. An invite matches when either agentDid or ownerDid is listed. Relay URLs from the configured relay, tool arguments, and invite tokens are normalized to origin plus pathname with no trailing slash. A configured relay is not replaced unless allowAnyRelay is set or the new URL is allowlisted. approvalWebhookUrl posts { taskId, summaryHash, reason, approverDid } and signs the owner decision only when the webhook returns { approved: true }. { approved: false } and non-2xx responses throw APPROVAL_REJECTED before task input is sent. The tool descriptions state that input is transmitted externally. acp_discover_workers reads the relay directory with the same relay allowlist and validateRelayEndpointUrl check before the GET, and it does not send task input. conformance/p1-7-mcp-outbound-policy.test.ts locks these checks (pnpm test).

Proof 5 — Envelope and artifact tampering

Threat class: one-byte or one-field edits to a signed TaskContract budget or scope, an artifact hash / UsageReceipt, or a RelayAuth timestamp or signature. Canonicalization is RFC 8785 JCS and the signature algorithm is Ed25519 (packages/core/src/crypto.ts).

An unmodified contract, delivery, and fresh token are accepted first. A verifier that rejected everything would fail those controls.

Proof 9 — End-to-end payload encryption

Threat class: a curious or compromised relay operator reads task inputs, CapabilityTokens, or task results from queued envelopes or a storage snapshot. A third party who copies a ciphertext, or moves it onto another taskId or seq, tries to decrypt it.

The outer Ed25519 signature still covers the ciphertext, so the relay checks envelope shape without a decryption key. decryptEnvelopePayload, WorkerNode, RequesterClient, and VerificationEngine require encrypted envelopes (requireEncrypted: true) by default and reject a cleartext session envelope with UNENCRYPTED_ENVELOPE_REJECTED. A caller opens cleartext only by passing { requireEncrypted: false } or allowUnencryptedEnvelopes: true, for a legacy in-memory fixture. Routing metadata remains visible.

HKDF-SHA256 uses the 12-byte AES-GCM nonce as salt. Its info is the canonical envelope header plus the ephemeral X25519 public key and the recipient X25519 public key, each the base64url form of the raw 32-byte key. AES-GCM additional data remains the canonical header. A ciphertext whose AES key was derived with header-only info, or whose ephemeral or recipient public key was swapped, fails decryptEnvelopePayload with ENVELOPE_DECRYPTION_FAILED (conformance/p2-11-hkdf-key-binding.test.ts).

Proof 10 — Token revocation and live cancellation

Threat class: a stolen invite or capability is presented after the issuer revokes it; a third party forges a RevocationNotice; a requester must stop a running sandbox without leaving an unsigned hole in the audit log.

Proof 11 — Encrypted progress and Byzantine quorum

Threat class: a relay reads a PROGRESS message; a compromised worker returns a verified but poisoned deliverable and tries to become the result.

Audit log truncation

Threat class: an operator treats sealbridge audit-verify output of VALID as proof that the file is the latest log. An older, still-consistent bilateral bundle — a truncated prefix with its own checkpoint — verifies the same way. The hash chain cannot name the latest head by itself.

This check is part of pnpm test. It is not part of pnpm test:security-proof.

Local verification

From a built checkout (Node.js 22, pnpm 10):

pnpm test:security-proof

Expect every test in conformance/security-proofs.test.ts to pass. The full regression suite remains pnpm test.