security: projection apply ignores secret/gate warnings (warnings do not block writes) #54

New issue

Open

opened 2026-05-10 14:19:30 +02:00 by pdurlej · 2 comments

pdurlej commented

2026-05-10 14:19:30 +02:00

Owner

Source

3+3 review on PR #50 (feat: add controlled leviathan projection apply), merged 2026-05-10 via chain drain #52.

"secret/gate warnings do not block writes"

Problem

Projection apply path emits warnings when secret/gate-relevant conditions trip (e.g. missing approved scope, partial drift, etc.) — but the write proceeds anyway. Warnings without enforcement = security theater.

Scope

Identify all warning paths in applyProjection that should be hard blockers.
Convert them from log-only to result: blocked returns.
Add --allow-warnings opt-in flag for explicit operator override (with audit).
Document which warnings are blocking vs advisory in docs/agent-mcp-contract.md.

Non-goals

No removal of warnings — keep emit, change enforcement.
No new scope (separate p0 issue tracks projection scope).

Acceptance criteria

Default behavior: warnings tied to security/gate checks block the write.
--allow-warnings only respected if caller has elevated scope.
Audit event records warning + override decision.
Tests cover blocking, override, and replay scenarios.

Refs

PR #50 (chain drain via #52)
3+3 review comment id 3200

Owner gates

--allow-warnings enabling for production: Piotr only.

## Source 3+3 review on PR #50 (`feat: add controlled leviathan projection apply`), merged 2026-05-10 via chain drain #52. > "secret/gate warnings do not block writes" ## Problem Projection apply path emits warnings when secret/gate-relevant conditions trip (e.g. missing approved scope, partial drift, etc.) — but the write proceeds anyway. Warnings without enforcement = security theater. ## Scope - Identify all warning paths in `applyProjection` that should be hard blockers. - Convert them from log-only to `result: blocked` returns. - Add `--allow-warnings` opt-in flag for explicit operator override (with audit). - Document which warnings are blocking vs advisory in `docs/agent-mcp-contract.md`. ## Non-goals - No removal of warnings — keep emit, change enforcement. - No new scope (separate p0 issue tracks projection scope). ## Acceptance criteria - Default behavior: warnings tied to security/gate checks block the write. - `--allow-warnings` only respected if caller has elevated scope. - Audit event records warning + override decision. - Tests cover blocking, override, and replay scenarios. ## Refs - PR #50 (chain drain via #52) - 3+3 review comment id 3200 ## Owner gates - `--allow-warnings` enabling for production: Piotr only.

pdurlej added the

security

3plus3-followup

priority:p0

labels

2026-05-10 14:19:30 +02:00

ollama referenced this issue

2026-05-18 09:28:38 +02:00

cross-repo: security gate pattern matches infisical-mcp + platform infisical identity work #78

codex commented

2026-06-04 01:33:53 +02:00

Collaborator

Deployment evidence (Codex, 2026-06-04):

Deployed Kan-ductor sha-98f70e7e0cce on RS2000 using platform release compose and kan-migrate.
Runtime smoke passed: kan-web and kan-mcp are healthy; /mcp/health returns ok: true and upstream kanApi: "ok".
Code evidence at deployed commit: projection apply computes blocking warnings via getBlockingProjectionWarnings(...).
Non-dry-run writes with blocking warnings require the explicit override path: allowWarnings: true, confirmOverride: "allow_projection_warnings", and token scope projection:override_warnings.
Audit payload records warning state, including warning codes and whether warning override was used.

Recommendation: #54 is truly closed.

Deployment evidence (Codex, 2026-06-04): - Deployed Kan-ductor `sha-98f70e7e0cce` on RS2000 using platform release compose and `kan-migrate`. - Runtime smoke passed: `kan-web` and `kan-mcp` are healthy; `/mcp/health` returns `ok: true` and upstream `kanApi: "ok"`. - Code evidence at deployed commit: projection apply computes blocking warnings via `getBlockingProjectionWarnings(...)`. - Non-dry-run writes with blocking warnings require the explicit override path: `allowWarnings: true`, `confirmOverride: "allow_projection_warnings"`, and token scope `projection:override_warnings`. - Audit payload records warning state, including warning codes and whether warning override was used. Recommendation: #54 is truly closed.

Iskra commented

2026-06-08 03:14:34 +02:00

Collaborator

{
"confidence": 5,
"effort_hint": "medium",
"escalation": {
"kind": "none",
"reason": ""
},
"evidence_refs": [
{
"note": "Issue reports projection apply warnings tied to secret or gate checks do not block writes.",
"type": "forgejo",
"value": "issue-title-body-labels-and-target-snapshot"
},
{
"note": "Body states warning-only enforcement lets security or gate-relevant conditions proceed anyway.",
"type": "forgejo",
"value": "issue-body-problem"
},
{
"note": "Scope converts blocking warning paths to blocked results and adds audited elevated override documentation.",
"type": "forgejo",
"value": "issue-body-scope"
}
],
"impact": 5,
"judge_actor": {
"name": "iskra",
"runtime": "openclaw"
},
"judged_at": "2026-06-08T01:14:00Z",
"labels_to_apply": [
"judge/p0",
"judge/codex-candidate"
],
"piotr_fit": "high",
"priority": "p0",
"rationale_summary": "This is P0 Codex-ready security work because gate and secret warnings must fail closed instead of allowing projection writes by default.",
"reach": 5,
"recommended_next_action": "codex_candidate",
"rerun_reason": "no_prior_judgment",
"schema": "openclaw.judge.v0",
"target": {
"kind": "issue",
"number": 54,
"repo": "pdurlej/kan-ductor"
},
"target_snapshot": {
"body_hash": "sha256:616a6bc8a32329848a6ccb6a9404d11f22b62db5e1a7e126b48668e18053807b",
"commit_count": null,
"evidence_hash": "sha256:32b5d83b152635b08b81c41b4ba5b2167f45df08eb06c86e108ec5f422944459",
"head_sha": null,
"labels": [
"3plus3-followup",
"priority:p0",
"security"
],
"labels_hash": "sha256:108b6261a9fa1681b7fbb2dafb7d389589e1dd87303b23bbb3bebb919f917115",
"state": "open",
"title_hash": "sha256:fdb6a42d27addd92a050f38db30037ac3d7e4fb283e54cfece0dc9d5db624236",
"updated_at": "2026-06-04T01:33:53+02:00"
},
"top_caveat": "Require elevated audited override for allow-warnings and keep advisory warnings clearly separate from blockers."
}

{ "confidence": 5, "effort_hint": "medium", "escalation": { "kind": "none", "reason": "" }, "evidence_refs": [ { "note": "Issue reports projection apply warnings tied to secret or gate checks do not block writes.", "type": "forgejo", "value": "issue-title-body-labels-and-target-snapshot" }, { "note": "Body states warning-only enforcement lets security or gate-relevant conditions proceed anyway.", "type": "forgejo", "value": "issue-body-problem" }, { "note": "Scope converts blocking warning paths to blocked results and adds audited elevated override documentation.", "type": "forgejo", "value": "issue-body-scope" } ], "impact": 5, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-08T01:14:00Z", "labels_to_apply": [ "judge/p0", "judge/codex-candidate" ], "piotr_fit": "high", "priority": "p0", "rationale_summary": "This is P0 Codex-ready security work because gate and secret warnings must fail closed instead of allowing projection writes by default.", "reach": 5, "recommended_next_action": "codex_candidate", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "issue", "number": 54, "repo": "pdurlej/kan-ductor" }, "target_snapshot": { "body_hash": "sha256:616a6bc8a32329848a6ccb6a9404d11f22b62db5e1a7e126b48668e18053807b", "commit_count": null, "evidence_hash": "sha256:32b5d83b152635b08b81c41b4ba5b2167f45df08eb06c86e108ec5f422944459", "head_sha": null, "labels": [ "3plus3-followup", "priority:p0", "security" ], "labels_hash": "sha256:108b6261a9fa1681b7fbb2dafb7d389589e1dd87303b23bbb3bebb919f917115", "state": "open", "title_hash": "sha256:fdb6a42d27addd92a050f38db30037ac3d7e4fb283e54cfece0dc9d5db624236", "updated_at": "2026-06-04T01:33:53+02:00" }, "top_caveat": "Require elevated audited override for allow-warnings and keep advisory warnings clearly separate from blockers." }

Iskra added the

judge/codex-candidate

judge/p0

labels

2026-06-08 03:14:34 +02:00

Iskra referenced this issue from pdurlej/judging-claw

2026-06-08 03:14:34 +02:00

[Judging Claw] codex_candidate for pdurlej/kan-ductor#54 (p0) #70