Codex Lead Engineer
87 lines
4.2 KiB
Markdown
87 lines
4.2 KiB
Markdown
# Threat Model
|
|
|
|
## Assets
|
|
|
|
- project instructions, decisions, results, reviews, and escalations;
|
|
- actor-role assignments and identity bindings;
|
|
- event ordering and audit integrity;
|
|
- bearer credentials;
|
|
- commit, artifact, and baseline references;
|
|
- service/database availability.
|
|
|
|
## Adversaries
|
|
|
|
- an unauthenticated network client;
|
|
- an authenticated actor exceeding their formal mandate;
|
|
- an implementer attempting self-review or self-acceptance;
|
|
- a compromised bearer token;
|
|
- a malicious artifact URI or oversized request;
|
|
- an operator or database account attempting audit-history mutation;
|
|
- concurrent clients exploiting check/write races.
|
|
|
|
## Implemented controls
|
|
|
|
| Threat | MVP control |
|
|
|---|---|
|
|
| Identity spoofing in tool args | no actor argument; identity comes from transport |
|
|
| Token timing comparison | SHA-256 digest and constant-time comparison |
|
|
| Unauthorized project access | active membership lookup per call |
|
|
| PA decision overreach | explicit decision/gate/baseline denial |
|
|
| Product decision overreach | PO-only product decisions |
|
|
| Self-review | reviewer role plus actor independence checks |
|
|
| Self-acceptance | PM/PO role and result-submitter identity check |
|
|
| Premature gate acceptance | independent APPROVE review required |
|
|
| Double claim / TOCTOU | `BEGIN IMMEDIATE` and conditional state update |
|
|
| Duplicate delivery | scoped request hash and idempotency record |
|
|
| Audit update/delete | SQLite triggers reject both operations |
|
|
| Cross-project reads | project filter plus membership resolution |
|
|
| Browser cross-origin request | exact configurable Origin allowlist |
|
|
| Oversized request | one MiB body limit |
|
|
| Excessive JSON nesting | pre-parse nesting limit plus guarded decoder |
|
|
| Slow/incomplete body | five-second application read timeout |
|
|
| MIME confusion/caching | strict JSON input, nosniff, no-store |
|
|
| SQL injection | parameterized SQL; one controlled placeholder expansion |
|
|
|
|
Artifact URIs and review evidence are recorded as untrusted data and are never
|
|
fetched or executed by the bus.
|
|
|
|
## Residual risks and production requirements
|
|
|
|
1. Static bearer credentials have no built-in expiry, rotation endpoint,
|
|
audience, issuer, or proof-of-possession. Replace the adapter with validated
|
|
OIDC/JWT or mTLS identities.
|
|
2. Plain HTTP is available. Use TLS and prohibit direct public access to the
|
|
application port.
|
|
3. SQLite append-only triggers do not protect against an operator replacing
|
|
the entire database file or disabling triggers. Use restricted DB roles,
|
|
PostgreSQL permissions, PITR, backups, and an external immutable audit
|
|
export for production assurance.
|
|
4. The event payload is not cryptographically chained or signed. Add hash
|
|
chaining/signatures only if the agreed threat model requires tamper
|
|
evidence against privileged database operators.
|
|
5. No application rate limiter or bounded worker pool exists. The application
|
|
closes incomplete request bodies after five seconds, but production ingress
|
|
must additionally enforce connection limits, header/body read deadlines,
|
|
per-identity limits, and request quotas.
|
|
6. The server emits access metadata but no security audit sink or metrics.
|
|
Integrate structured logs, alerts, and privacy-aware retention.
|
|
7. Membership deactivation and credential revocation are not exposed as MVP
|
|
tools. Operators must treat compromised tokens as an immediate
|
|
configuration/restart incident.
|
|
8. Role assignment is one role per actor/project. Shared human/agent accounts
|
|
undermine independence even when IDs differ and are prohibited operationally.
|
|
9. Evidence and artifact digests are caller assertions; the bus does not
|
|
verify repository ownership or retrieve content.
|
|
10. Dependency-free MCP handling reduces supply-chain surface but has not yet
|
|
been interoperability-tested against every intended client version.
|
|
|
|
## Security verification before activation
|
|
|
|
- run all tests and an independent code review;
|
|
- test the exact Claude Code and ChatGPT MCP clients;
|
|
- replace all example tokens and restrict origin/host exposure;
|
|
- confirm backup/restore and audit export;
|
|
- review log contents for sensitive project data;
|
|
- add abuse limits and operational monitoring;
|
|
- decide whether privileged-operator tamper evidence is required.
|