Jon Chery
110 lines
5.1 KiB
Markdown
110 lines
5.1 KiB
Markdown
# GRILL — v1.28 CLI Canonicalization + Identity Layer
|
|
|
|
> Adversarial review of the v1.28 SPECIFY + CLARIFY + RESEARCH + PLAN.
|
|
> Griller: ci-griller subagent. Autonomy: full. All 9 axes reviewed;
|
|
> every claim verified against the live codebase.
|
|
|
|
---
|
|
|
|
## Overall verdict: **PROCEED-WITH-CONDITIONS** · Confidence 0.76
|
|
|
|
The plan is fundamentally sound — architecture correct, re-mapping
|
|
clean (no ID collisions), technical depth accurate (DER→raw, strong-
|
|
read revocation, stdin TTY), highest-risk item (kj binary) has a
|
|
Fargate fallback. Not unfeasible, not over-scoped beyond an agent-driven
|
|
repo's capacity, not security-broken by design.
|
|
|
|
**3 critical conditions (must-fix before P1) + 16 tracked conditions.**
|
|
No escalations (all axes ≥ 0.70 confidence).
|
|
|
|
---
|
|
|
|
## Axis verdicts
|
|
|
|
| Axis | Verdict | Confidence | Critical condition |
|
|
|------|---------|-----------|-------------------|
|
|
| §1 Feasibility | PROCEED-WITH-CONDITIONS | 0.82 | C-1.1 KMS asym verify; C-1.2 Argon2 fail-closed test |
|
|
| §2 Scope | PROCEED-WITH-CONDITIONS | 0.74 | C-2.1 fold P5 into P4; C-2.2 P4 overload |
|
|
| §3 Cost | PROCEED-WITH-CONDITIONS | 0.70 | C-3.1 cost estimate; C-3.2 CodeArtifact P1 task |
|
|
| §4 Schedule | PROCEED-WITH-CONDITIONS | 0.76 | C-4.1 P4 critical path; C-4.2 per-phase exit |
|
|
| §5 Technical Depth | PROCEED-WITH-CONDITIONS | 0.80 | C-5.1 ABAC shape; **C-5.2 JWS KDF** |
|
|
| §6 Operational Readiness | PROCEED-WITH-CONDITIONS | 0.72 | **C-6.1 ABAC fail-closed**; C-6.2 threat model; C-6.3 ops guide |
|
|
| §7 Security Posture | PROCEED-WITH-CONDITIONS | 0.73 | **C-7.1 ABAC fail-closed**; C-7.2 Argon2 params; C-7.3 cred file |
|
|
| §8 Dependency Risk | PROCEED-WITH-CONDITIONS | 0.83 | C-8.1 CodeArtifact P1; C-8.2 pin kj version |
|
|
| §9 Re-mapping Integrity | PROCEED-WITH-CONDITIONS | 0.84 | **C-9.1 traceability fix**; C-9.2 INV audit |
|
|
|
|
---
|
|
|
|
## Critical conditions (the 3 must-fix-before-P1)
|
|
|
|
### 🔴 C-6.1 / C-7.1 — ABAC fail-closed
|
|
The token-vend Lambda's behavior on `kj` absence/error is unspecified.
|
|
Without fail-closed, INV-17 is documentation, not a runtime guarantee —
|
|
a `kj` load failure would bypass the ABAC gate (every PAT gets a token).
|
|
**Fix applied to PLAN.md P4 Wave 4 Task 4.1:** "If
|
|
`KyvernoJsonEngine.is_configured()` returns false or `evaluate()`
|
|
raises, return 403 + audit `token.vend.denied` (reason:
|
|
`abac_eval_failed`). Never fail open. Test: `tests/test_abac_fail_closed.py`."
|
|
|
|
### 🔴 C-5.2 — JWS-from-PAT key derivation
|
|
REQ-332's AC ("public key derivable from the PAT") is unimplementable
|
|
without a specified KDF. A PAT is a JWT, not a keypair.
|
|
**Fix applied to PLAN.md P2 Wave 2 Task 2.3 + REQ-332 AC:** the JWS
|
|
uses HMAC-SHA256 with a key derived via
|
|
`HKDF-SHA256(PAT_bytes, salt='nova-local-attestation', info='jws-signing-key')`
|
|
→ 32-byte symmetric key. The "public key derivable" AC is re-interpreted:
|
|
the *verification key* is derived from the PAT via the same KDF (the
|
|
PAT is the shared secret). This is a symmetric scheme, not asymmetric.
|
|
|
|
### 🔴 C-9.1 — Traceability drift
|
|
REQUIREMENTS.md §v1.28 traceability table mapped 16 REQs to P2;
|
|
PLAN.md splits them across P2/P3/P4/P5/P6. **Fix applied to
|
|
REQUIREMENTS.md** — traceability table updated to match PLAN.md phase
|
|
structure.
|
|
|
|
---
|
|
|
|
## Tracked conditions (16 — applied to PLAN.md as amendments)
|
|
|
|
- **C-1.1** KMS asymmetric key verification before P4 Wave 3 (one
|
|
`aws kms create-key --key-spec ECC_NIST_P256` call).
|
|
- **C-1.2** Argon2 fail-closed test in P3 Wave 2 (Lambda returns 503
|
|
on `ImportError`, not a crash or pure-Python hash).
|
|
- **C-2.1** Fold P5 (idp-setup) into P4 as P4 Wave 8 → **reduces to 6
|
|
execution phases** (P1..P6, P7 = final). Applied.
|
|
- **C-2.2** P4 is a double-length phase; acknowledged in P4 header.
|
|
- **C-3.1** Cost envelope subsection added to PLAN.md.
|
|
- **C-3.2 / C-8.1** CodeArtifact provisioning = P1 Wave 0 task with
|
|
binary go/no-go gate; Gitea wheel index fallback documented.
|
|
- **C-4.1** P4 flagged as critical-path phase (kj spike = highest-
|
|
probability schedule slip; Fargate = +1 week).
|
|
- **C-4.2** Per-phase exit criteria added to PLAN.md.
|
|
- **C-5.1** `requested_claims` = list of claim names (the policy
|
|
asserts the subject is *allowed* to request those claims).
|
|
- **C-6.2** Threat model (REQ-347) adds: JWKS DDoS surface, PAT theft
|
|
+ max TTL (≤24h dev, ≤1h service-account), ABAC fail-closed,
|
|
INV-18..21 compression audit.
|
|
- **C-6.3** Operator guide (REQ-345) adds: KMS rotation, layer update,
|
|
PITR restore, emergency PAT revocation.
|
|
- **C-7.2** Argon2id parameters: t=3, m=65536 KiB, p=1 (OWASP min).
|
|
- **C-7.3** `~/.nova/credentials.json` stores OIDC token + PAT metadata
|
|
(jti, exp, type), NOT the raw PAT.
|
|
- **C-8.2** `kj` pinned to a specific release + SHA256 recorded.
|
|
- **C-9.2** Threat model includes INV-18..21 compression audit
|
|
(verify spec's attestation invariant semantics are captured by
|
|
INV-15/16/17 + REQ-332).
|
|
|
|
---
|
|
|
|
## Escalations
|
|
|
|
None. All 9 axes resolved at confidence ≥ 0.70. No human escalation
|
|
required (full autonomy).
|
|
|
|
---
|
|
|
|
## Grill complete
|
|
|
|
The plan proceeds with the 3 critical fixes and 16 tracked conditions
|
|
applied to PLAN.md + REQUIREMENTS.md. The binding decisions above are
|
|
the authoritative grill record. Next: MVP/UX CHECK → SHIP phase 0. |