security: leviathan projection apply reuses generic card scopes (no dedicated write authority) #53

New issue

Open

opened 2026-05-10 14:19:23 +02:00 by pdurlej · 2 comments

pdurlej commented

2026-05-10 14:19:23 +02:00

Owner

Source

3+3 review on PR #50 (feat: add controlled leviathan projection apply), merged 2026-05-10 via chain drain #52.

"real apply reuses generic cards:create/cards:move scopes and lacks dedicated projection write authority/feature gate in the API path"

Problem

Iskra MCP token (or any token with cards:create/cards:move scope) can trigger projection writes through the apply endpoint. There is no projection-specific scope or feature gate to constrain who/what can run applyProjection.

This violates least-privilege: a token issued for normal AI Inbox card creation can drive batch projection mutations against Leviathan board.

Scope

Add dedicated projection:write (or similar) scope on machine identities.
Gate applyProjection API route on this scope; reject 403 if missing.
Add feature flag (default off in production) so projection apply requires both scope + flag.
Update docs/agent-mcp-contract.md with new scope/gate.

Non-goals

No retroactive scope change on existing tokens (operator decides per-token).
No projection feature kill — narrow it.

Acceptance criteria

Token with only cards:create scope cannot call applyProjection (returns auth error).
Token with projection:write scope + feature flag enabled can apply.
Existing AI Inbox card flows (#31, #44, #46 etc.) unchanged.
Tests cover both allow and deny paths.

Refs

PR #50 (closed-as-merged into chain, on main via #52)
3+3 review comment id 3200

Owner gates

Production scope issuance: hard stop, Piotr only.
Default feature flag value in production: Piotr decision.

## Source 3+3 review on PR #50 (`feat: add controlled leviathan projection apply`), merged 2026-05-10 via chain drain #52. > "real apply reuses generic `cards:create`/`cards:move` scopes and lacks dedicated projection write authority/feature gate in the API path" ## Problem Iskra MCP token (or any token with `cards:create`/`cards:move` scope) can trigger projection writes through the apply endpoint. There is no projection-specific scope or feature gate to constrain who/what can run `applyProjection`. This violates least-privilege: a token issued for normal AI Inbox card creation can drive batch projection mutations against Leviathan board. ## Scope - Add dedicated `projection:write` (or similar) scope on machine identities. - Gate `applyProjection` API route on this scope; reject 403 if missing. - Add feature flag (default off in production) so projection apply requires both scope + flag. - Update `docs/agent-mcp-contract.md` with new scope/gate. ## Non-goals - No retroactive scope change on existing tokens (operator decides per-token). - No projection feature kill — narrow it. ## Acceptance criteria - Token with only `cards:create` scope cannot call `applyProjection` (returns auth error). - Token with `projection:write` scope + feature flag enabled can apply. - Existing AI Inbox card flows (#31, #44, #46 etc.) unchanged. - Tests cover both allow and deny paths. ## Refs - PR #50 (closed-as-merged into chain, on main via #52) - 3+3 review comment id 3200 ## Owner gates - Production scope issuance: hard stop, Piotr only. - Default feature flag value in production: Piotr decision.

pdurlej added the

priority:p0

security

3plus3-followup

labels

2026-05-10 14:19:23 +02:00

ollama referenced this issue

2026-05-18 09:28:38 +02:00

cross-repo: security gate pattern matches infisical-mcp + platform infisical identity work #78

codex commented

2026-06-04 01:33:52 +02:00

Collaborator

Deployment evidence (Codex, 2026-06-04):

Deployed Kan-ductor sha-98f70e7e0cce on RS2000 using platform release compose and kan-migrate.
Runtime images are healthy:
- git.pdurlej.com/pdurlej/kan:sha-98f70e7e0cce
- git.pdurlej.com/pdurlej/kan-mcp:sha-98f70e7e0cce
kan-migrate completed successfully; operational_snapshot table exists in the production Kan database.
Runtime smoke passed: https://kan.pdurlej.com/ returns 200 with redirects followed; https://kan.pdurlej.com/mcp/health returns ok: true and upstream kanApi: "ok".
Code evidence at deployed commit: applyLeviathanProjection requires projection:write and real writes are gated by KAN_PROJECTION_APPLY_ENABLED=true.
Publish evidence: Forgejo Actions docker publish run for deployed main succeeded.

Recommendation: #53 is truly closed.

Deployment evidence (Codex, 2026-06-04): - Deployed Kan-ductor `sha-98f70e7e0cce` on RS2000 using platform release compose and `kan-migrate`. - Runtime images are healthy: - `git.pdurlej.com/pdurlej/kan:sha-98f70e7e0cce` - `git.pdurlej.com/pdurlej/kan-mcp:sha-98f70e7e0cce` - `kan-migrate` completed successfully; `operational_snapshot` table exists in the production Kan database. - Runtime smoke passed: `https://kan.pdurlej.com/` returns 200 with redirects followed; `https://kan.pdurlej.com/mcp/health` returns `ok: true` and upstream `kanApi: "ok"`. - Code evidence at deployed commit: `applyLeviathanProjection` requires `projection:write` and real writes are gated by `KAN_PROJECTION_APPLY_ENABLED=true`. - Publish evidence: Forgejo Actions docker publish run for deployed main succeeded. Recommendation: #53 is truly closed.

Iskra commented

2026-06-08 03:14:33 +02:00

Collaborator

{
"confidence": 5,
"effort_hint": "medium",
"escalation": {
"kind": "none",
"reason": ""
},
"evidence_refs": [
{
"note": "Issue reports Leviathan projection apply reusing generic card scopes without dedicated write authority.",
"type": "forgejo",
"value": "issue-title-body-labels-and-target-snapshot"
},
{
"note": "Body states tokens with normal card create or move scopes can trigger batch projection mutations.",
"type": "forgejo",
"value": "issue-body-problem"
},
{
"note": "Scope adds projection write scope, feature flag gating, 403 rejection, and contract documentation updates.",
"type": "forgejo",
"value": "issue-body-scope"
}
],
"impact": 5,
"judge_actor": {
"name": "iskra",
"runtime": "openclaw"
},
"judged_at": "2026-06-08T01:13:00Z",
"labels_to_apply": [
"judge/p0",
"judge/codex-candidate"
],
"piotr_fit": "high",
"priority": "p0",
"rationale_summary": "This is P0 Codex-ready security work because generic card scopes currently authorize high-blast-radius projection writes and violate least privilege.",
"reach": 5,
"recommended_next_action": "codex_candidate",
"rerun_reason": "no_prior_judgment",
"schema": "openclaw.judge.v0",
"target": {
"kind": "issue",
"number": 53,
"repo": "pdurlej/kan-ductor"
},
"target_snapshot": {
"body_hash": "sha256:0474e0e005e943b8db6706403d65867154b2190f1f30d0cd466d3de964d67eec",
"commit_count": null,
"evidence_hash": "sha256:56957fc6ae93fac60a98e7b69131fc23db955d89b270370c0ee27fb2e79a5aa1",
"head_sha": null,
"labels": [
"3plus3-followup",
"priority:p0",
"security"
],
"labels_hash": "sha256:108b6261a9fa1681b7fbb2dafb7d389589e1dd87303b23bbb3bebb919f917115",
"state": "open",
"title_hash": "sha256:963bfff226ba7d288f11739dd459a3cf106cff56f8a938889bf470fc95c54c7f",
"updated_at": "2026-06-04T01:33:52+02:00"
},
"top_caveat": "Keep the production feature flag default-off and verify generic card tokens receive 403 for projection apply."
}

{ "confidence": 5, "effort_hint": "medium", "escalation": { "kind": "none", "reason": "" }, "evidence_refs": [ { "note": "Issue reports Leviathan projection apply reusing generic card scopes without dedicated write authority.", "type": "forgejo", "value": "issue-title-body-labels-and-target-snapshot" }, { "note": "Body states tokens with normal card create or move scopes can trigger batch projection mutations.", "type": "forgejo", "value": "issue-body-problem" }, { "note": "Scope adds projection write scope, feature flag gating, 403 rejection, and contract documentation updates.", "type": "forgejo", "value": "issue-body-scope" } ], "impact": 5, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-08T01:13:00Z", "labels_to_apply": [ "judge/p0", "judge/codex-candidate" ], "piotr_fit": "high", "priority": "p0", "rationale_summary": "This is P0 Codex-ready security work because generic card scopes currently authorize high-blast-radius projection writes and violate least privilege.", "reach": 5, "recommended_next_action": "codex_candidate", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "issue", "number": 53, "repo": "pdurlej/kan-ductor" }, "target_snapshot": { "body_hash": "sha256:0474e0e005e943b8db6706403d65867154b2190f1f30d0cd466d3de964d67eec", "commit_count": null, "evidence_hash": "sha256:56957fc6ae93fac60a98e7b69131fc23db955d89b270370c0ee27fb2e79a5aa1", "head_sha": null, "labels": [ "3plus3-followup", "priority:p0", "security" ], "labels_hash": "sha256:108b6261a9fa1681b7fbb2dafb7d389589e1dd87303b23bbb3bebb919f917115", "state": "open", "title_hash": "sha256:963bfff226ba7d288f11739dd459a3cf106cff56f8a938889bf470fc95c54c7f", "updated_at": "2026-06-04T01:33:52+02:00" }, "top_caveat": "Keep the production feature flag default-off and verify generic card tokens receive 403 for projection apply." }

Iskra added the

judge/codex-candidate

judge/p0

labels

2026-06-08 03:14:34 +02:00

Iskra referenced this issue from pdurlej/judging-claw

2026-06-08 03:14:34 +02:00

[Judging Claw] codex_candidate for pdurlej/kan-ductor#53 (p0) #69