P1 release gate — prove container image secrets, listener policy, provenance, and capability placement #183

New issue

Open

opened 2026-08-22 21:58:21 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-22 21:58:21 +00:00

(Migrated from github.com)

Parent epic: #153
Depends on: #182, #161 where typed capability placement is available.

Goal

Run the final adversarial deployment/security gate for the published zara-server image and GHCR workflow.

Required matrix

inspect image config/history/layers/closure for private keys, provider credentials, repository test secrets, conversation/memory fixtures and unexpected user state;
wildcard/TCP/public bind without valid CURVE/ZAP configuration rejected;
enrolled client succeeds, wrong/revoked key fails, server pin mismatch fails;
health/readiness/logging remain content-free and bounded;
world-readable or wrong-owner mounted secrets rejected;
read-only root/non-root execution and only declared writable paths;
stale lock/socket and abrupt death/restart recovery;
persistent state migration and rollback/recovery fixture;
resource/rate pressure remains bounded according to daemon security contracts;
image is reproducibly associated with exact commit/version and immutable SHA tag;
GitHub Actions publish path cannot run package-write publishing for untrusted PR code;
server capability executes inside server provider boundary;
device capability such as open-app/clipboard/screenshot cannot execute in container and is routed/typed unavailable according to #150;
plugin mount cannot silently expand host authority.

Registry verification

Pull the exact GHCR candidate by immutable SHA tag/digest where possible and verify its metadata/entrypoint matches the locally gated Nix artifact. Convenience tags must resolve according to documented trusted-branch/release policy.

Automation

One deterministic release script/report combines image scan, listener/security fixtures, lifecycle/state tests and capability-placement assertions. No real secrets or external paid provider required.

Acceptance

The exact published candidate is traceable, secret-free, secure-by-default, least-privileged and preserves the brain/server vs device-action boundary. Any failure creates a focused blocker; do not weaken the gate.

Parent epic: #153 Depends on: #182, #161 where typed capability placement is available. ## Goal Run the final adversarial deployment/security gate for the published `zara-server` image and GHCR workflow. ## Required matrix - inspect image config/history/layers/closure for private keys, provider credentials, repository test secrets, conversation/memory fixtures and unexpected user state; - wildcard/TCP/public bind without valid CURVE/ZAP configuration rejected; - enrolled client succeeds, wrong/revoked key fails, server pin mismatch fails; - health/readiness/logging remain content-free and bounded; - world-readable or wrong-owner mounted secrets rejected; - read-only root/non-root execution and only declared writable paths; - stale lock/socket and abrupt death/restart recovery; - persistent state migration and rollback/recovery fixture; - resource/rate pressure remains bounded according to daemon security contracts; - image is reproducibly associated with exact commit/version and immutable SHA tag; - GitHub Actions publish path cannot run package-write publishing for untrusted PR code; - server capability executes inside server provider boundary; - device capability such as open-app/clipboard/screenshot cannot execute in container and is routed/typed unavailable according to #150; - plugin mount cannot silently expand host authority. ## Registry verification Pull the exact GHCR candidate by immutable SHA tag/digest where possible and verify its metadata/entrypoint matches the locally gated Nix artifact. Convenience tags must resolve according to documented trusted-branch/release policy. ## Automation One deterministic release script/report combines image scan, listener/security fixtures, lifecycle/state tests and capability-placement assertions. No real secrets or external paid provider required. ## Acceptance The exact published candidate is traceable, secret-free, secure-by-default, least-privileged and preserves the brain/server vs device-action boundary. Any failure creates a focused blocker; do not weaken the gate.