Files

T

Jon Chery bbfcbcc4d3 docs(P00): grill — v1.28 adversarial review (PROCEED 0.76, 3 critical + 16 tracked conditions applied)

---ci---
project: acdl
phase: 0
milestone: v1.28
status: grill
---/ci---

2026-08-19 22:10:15 +00:00

5.1 KiB

Raw Blame History

GRILL — v1.28 CLI Canonicalization + Identity Layer

Adversarial review of the v1.28 SPECIFY + CLARIFY + RESEARCH + PLAN. Griller: ci-griller subagent. Autonomy: full. All 9 axes reviewed; every claim verified against the live codebase.

Overall verdict: PROCEED-WITH-CONDITIONS · Confidence 0.76

The plan is fundamentally sound — architecture correct, re-mapping clean (no ID collisions), technical depth accurate (DER→raw, strong- read revocation, stdin TTY), highest-risk item (kj binary) has a Fargate fallback. Not unfeasible, not over-scoped beyond an agent-driven repo's capacity, not security-broken by design.

3 critical conditions (must-fix before P1) + 16 tracked conditions. No escalations (all axes ≥ 0.70 confidence).

Axis verdicts

Axis	Verdict	Confidence	Critical condition
§1 Feasibility	PROCEED-WITH-CONDITIONS	0.82	C-1.1 KMS asym verify; C-1.2 Argon2 fail-closed test
§2 Scope	PROCEED-WITH-CONDITIONS	0.74	C-2.1 fold P5 into P4; C-2.2 P4 overload
§3 Cost	PROCEED-WITH-CONDITIONS	0.70	C-3.1 cost estimate; C-3.2 CodeArtifact P1 task
§4 Schedule	PROCEED-WITH-CONDITIONS	0.76	C-4.1 P4 critical path; C-4.2 per-phase exit
§5 Technical Depth	PROCEED-WITH-CONDITIONS	0.80	C-5.1 ABAC shape; C-5.2 JWS KDF
§6 Operational Readiness	PROCEED-WITH-CONDITIONS	0.72	C-6.1 ABAC fail-closed; C-6.2 threat model; C-6.3 ops guide
§7 Security Posture	PROCEED-WITH-CONDITIONS	0.73	C-7.1 ABAC fail-closed; C-7.2 Argon2 params; C-7.3 cred file
§8 Dependency Risk	PROCEED-WITH-CONDITIONS	0.83	C-8.1 CodeArtifact P1; C-8.2 pin kj version
§9 Re-mapping Integrity	PROCEED-WITH-CONDITIONS	0.84	C-9.1 traceability fix; C-9.2 INV audit

Critical conditions (the 3 must-fix-before-P1)

🔴 C-6.1 / C-7.1 — ABAC fail-closed

The token-vend Lambda's behavior on kj absence/error is unspecified. Without fail-closed, INV-17 is documentation, not a runtime guarantee — a kj load failure would bypass the ABAC gate (every PAT gets a token). Fix applied to PLAN.md P4 Wave 4 Task 4.1: "If KyvernoJsonEngine.is_configured() returns false or evaluate() raises, return 403 + audit token.vend.denied (reason: abac_eval_failed). Never fail open. Test: tests/test_abac_fail_closed.py."

🔴 C-5.2 — JWS-from-PAT key derivation

REQ-332's AC ("public key derivable from the PAT") is unimplementable without a specified KDF. A PAT is a JWT, not a keypair. Fix applied to PLAN.md P2 Wave 2 Task 2.3 + REQ-332 AC: the JWS uses HMAC-SHA256 with a key derived via HKDF-SHA256(PAT_bytes, salt='nova-local-attestation', info='jws-signing-key') → 32-byte symmetric key. The "public key derivable" AC is re-interpreted: the verification key is derived from the PAT via the same KDF (the PAT is the shared secret). This is a symmetric scheme, not asymmetric.

🔴 C-9.1 — Traceability drift

REQUIREMENTS.md §v1.28 traceability table mapped 16 REQs to P2; PLAN.md splits them across P2/P3/P4/P5/P6. Fix applied to REQUIREMENTS.md — traceability table updated to match PLAN.md phase structure.

Tracked conditions (16 — applied to PLAN.md as amendments)

C-1.1 KMS asymmetric key verification before P4 Wave 3 (one aws kms create-key --key-spec ECC_NIST_P256 call).
C-1.2 Argon2 fail-closed test in P3 Wave 2 (Lambda returns 503 on ImportError, not a crash or pure-Python hash).
C-2.1 Fold P5 (idp-setup) into P4 as P4 Wave 8 → reduces to 6 execution phases (P1..P6, P7 = final). Applied.
C-2.2 P4 is a double-length phase; acknowledged in P4 header.
C-3.1 Cost envelope subsection added to PLAN.md.
C-3.2 / C-8.1 CodeArtifact provisioning = P1 Wave 0 task with binary go/no-go gate; Gitea wheel index fallback documented.
C-4.1 P4 flagged as critical-path phase (kj spike = highest- probability schedule slip; Fargate = +1 week).
C-4.2 Per-phase exit criteria added to PLAN.md.
C-5.1 requested_claims = list of claim names (the policy asserts the subject is allowed to request those claims).
C-6.2 Threat model (REQ-347) adds: JWKS DDoS surface, PAT theft
- max TTL (≤24h dev, ≤1h service-account), ABAC fail-closed, INV-18..21 compression audit.
C-6.3 Operator guide (REQ-345) adds: KMS rotation, layer update, PITR restore, emergency PAT revocation.
C-7.2 Argon2id parameters: t=3, m=65536 KiB, p=1 (OWASP min).
C-7.3 ~/.nova/credentials.json stores OIDC token + PAT metadata (jti, exp, type), NOT the raw PAT.
C-8.2 kj pinned to a specific release + SHA256 recorded.
C-9.2 Threat model includes INV-18..21 compression audit (verify spec's attestation invariant semantics are captured by INV-15/16/17 + REQ-332).

Escalations

None. All 9 axes resolved at confidence ≥ 0.70. No human escalation required (full autonomy).

Grill complete

The plan proceeds with the 3 critical fixes and 16 tracked conditions applied to PLAN.md + REQUIREMENTS.md. The binding decisions above are the authoritative grill record. Next: MVP/UX CHECK → SHIP phase 0.

5.1 KiB Raw Blame History