Adversarial review and fix (run c6c486)

.fleet/docs/DECISIONS.md

@@ -0,0 +1,33 @@
+# DECISIONS — adversarial-review-and-fix c6c486
+
+## Self-orientation
+
+| Field | Value |
+|-------|-------|
+| repo | `ravidsrk/autonomous-fleet` |
+| REPO_ROOT | `/workspace` |
+| MAINTAINER | Cursor Agent `<cursoragent@cursor.com>` |
+| BRANCH_PREFIX | `cursor/` |
+| BASE | `cursor/adversarial-review-base-256a` off `main`@e9e541b |
+| Adapter | `autonomous-fleet-adapter-grok` (same-vendor-instructed review) |
+| LEDGER_DIR | `.fleet/docs/` (docs-site Starlight probe) |
+| RUN_ID | `20260708T184204Z-adversarial-review-and-fix-c6c486` |
+| RUN_SHORT | `c6c486` |
+| SUBSTRATE | `/workspace/scripts` |
+| AUTHORSHIP_MODE | `attributed` |
+| reviewer_mode | `same-vendor-instructed` |
+
+## ASSUMPTIONS
+
+1. Scope = entire autonomous-fleet app (skills, scripts, substrate, CI, action, docs-site tooling).
+2. Fresh-run: ignore prior review docs; write `docs/adversarial-review-fresh.md`.
+3. Out of scope: BASE→main promotion, production deploy, secret rotation, load/prod verification.
+4. SCM: `gh` authenticated as `cursor`; PRs merge into BASE with `--merge` (never squash).
+5. Lane B findings open as draft `do-not-merge` PRs; never auto-merge.
+
+## Skeptic decisions
+
+- SEC-006 DO_NOT_FIX (version-tolerant auth probe).
+- SEC-005/009/004/010/ARCH-004/ARCH-005 → Lane B (ask / human-gate or draft-both).
+- OPS-001 narrowed: fatal only on real-run archive emit; dry-run cleanup stays non-fatal.
+- Wave 1 Lane A: SEC-001, SEC-002, SEC-003, ARCH-001, ARCH-002, BUG-001 (FOUNDATION first).

.fleet/docs/arch-build-progress.md

@@ -0,0 +1,82 @@
+# arch-build-progress — adversarial-review-and-fix
+
+RUN_ID: 20260708T184204Z-adversarial-review-and-fix-c6c486
+RUN_SHORT: c6c486
+BASE: cursor/adversarial-review-base-256a
+PHASE: FIXING
+LAST_UPDATE: wave1 SEC-001/002/003/008 merged into BASE
+ADAPTER: autonomous-fleet-adapter-grok
+REPO_ROOT: /workspace
+MAINTAINER: Cursor Agent <cursoragent@cursor.com>
+BRANCH_PREFIX: cursor/
+AUTHORSHIP_MODE: attributed
+SUBSTRATE: /workspace/scripts
+LEDGER_DIR: .fleet/docs
+reviewer_mode: same-vendor-instructed
+
+## Runtime goal
+
+Mission adversarial-review-and-fix DONE: `.fleet/docs/arch-build-progress.md` all task flags true,
+`.fleet/docs/arch-build-readiness.md` with fleet-outcome.status done and mission metrics satisfied,
+the readiness fleet-outcome validates, all PRs merged into BASE.
+
+LAST_UPDATE: BOOTSTRAP complete — 15 Lane A + 6 Lane B; SEC-006 DO_NOT_FIX
+
+## CLOSE-INDEX
+
+| ID | lane | state |
+|----|------|-------|
+| SEC-001 | A | CLOSED via #135 |
+| SEC-002 | A | CLOSED via #136 |
+| SEC-003 | A | CLOSED via #137 |
+| SEC-004 | B | OPEN |
+| ARCH-001 | A | CLOSED via #138 |
+| ARCH-002 | A | CLOSED via #139 |
+| BUG-001 | A | CLOSED via #140 |
+| SEC-005 | B | OPEN |
+| SEC-007 | A | CLOSED via #141 |
+| SEC-008 | A | CLOSED via #135 |
+| SEC-009 | B | OPEN |
+| BUG-002 | A | CLOSED via #139 |
+| BUG-003 | A | CLOSED via #142 |
+| BUG-004 | A | OPEN |
+| ARCH-003 | A | OPEN |
+| ARCH-004 | B | OPEN |
+| OPS-001 | A | OPEN |
+| OPS-002 | A | OPEN |
+| ARCH-005 | B | OPEN |
+| SEC-010 | B | OPEN |
+| SEC-011 | A | OPEN |
+| SEC-006 | — | DO_NOT_FIX |
+
+## Fix tasks
+
+| TASK | finding | wave | flags |
+|------|---------|------|-------|
+| TASK SEC-001 | SEC-001 | 1 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK SEC-002 | SEC-002 | 1 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK SEC-003 | SEC-003 | 1 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK ARCH-001 | ARCH-001 | 1 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK ARCH-002 | ARCH-002 | 1 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK BUG-001 | BUG-001 | 1 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK SEC-007 | SEC-007 | 2 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK SEC-008 | SEC-008 | 2 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK BUG-002 | BUG-002 | 2 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK BUG-003 | BUG-003 | 2 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK BUG-004 | BUG-004 | 2 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK ARCH-003 | ARCH-003 | 2 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK OPS-001 | OPS-001 | 2 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK OPS-002 | OPS-002 | 2 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+| TASK SEC-011 | SEC-011 | 2 | CODED=f EVID=f PR_OPEN=f REVIEWED=f MERGED=f ACCEPT=f WT_CLEAN=f |
+
+## Lane B (HUMAN_GATED — draft do-not-merge)
+
+SEC-004, SEC-005, SEC-009, ARCH-004, ARCH-005, SEC-010
+
+## OPS / VERIFY-AT-SCALE
+
+(none yet)
+
+## CONTEXT HANDOFF
+
+Wave 1 in flight next. Hot files: install-community.sh, run-sandboxed.sh, fleet_verify.py, run-campaign.sh, fleet_run.py.

SECURITY.md

@@ -58,9 +58,13 @@ outward-facing actions before exec:
 
 ```
   DENY (exit 2)  force-push, remote-branch delete, rm -rf of a critical/system path,
-                 git reset --hard to a remote ref, gh pr merge, gh repo delete
+                 git reset --hard to a remote ref, gh pr merge, gh repo delete,
+                 shred, dd of=/dev/*, chmod|chown|chgrp -R of an absolute system path,
+                 find <abs-system-path> with -delete / -exec / -ok
   ASK  (exit 3)  ordinary git push, gh release, rm -rf of a scoped path,
-                 terraform|tofu|kubectl|helm|databricks apply|deploy|destroy|delete
+                 terraform|tofu|kubectl|helm|databricks apply|deploy|destroy|delete,
+                 npm|pnpm|yarn|cargo publish, aws|gcloud destructive verbs,
+                 curl|wget piped into a shell
   ALLOW          everything else (reads, tests, edits, local git, and — by default —
                  any command the wrapper does not specifically inspect; see below)
 ```
@@ -103,15 +107,18 @@ Concretely, the framework does not protect you from:
   every defense above is something you chose to wave through.
 - Most destructive commands. The classifier is not an allowlist of safe commands — it is a small
   best-effort blocklist of the most common destructive ones, and **everything it does not specifically
-  recognize is ALLOW by default**. Today the wrapper inspects only `rm`, `git push`/`git reset`, `gh`,
-  and a handful of infra tools (`terraform`/`tofu`/`kubectl`/`helm`/`databricks`). Plainly-written
-  destructive commands outside that set pass straight through — for example `curl … | bash`,
-  `find / -delete`, `dd of=/dev/sda`, and `chmod -R 000 /` all classify as ALLOW today. (Work is
-  underway to add several of these to the blocklist, but that does not change the shape: it is a
-  best-effort blocklist of common destructive commands, **NOT** a security boundary. Rely on OS-level
-  sandboxing — `container-use`, a VM, or a restricted account — for the boundary.) And even within the
-  set it inspects, it is a static heuristic over tokens: a command constructed at shell runtime
-  (command substitution, `eval` of a built string, base64 payloads) can evade it.
+  recognize is ALLOW by default**. Today the wrapper inspects `rm`, `git push`/`git reset`, `gh`,
+  infra tools (`terraform`/`tofu`/`kubectl`/`helm`/`databricks`), plus the catastrophic / outward
+  heads covered by the DENY/ASK matrix above (`shred`, `dd` to a device, recursive
+  `chmod`/`chown`/`chgrp` on a system path, `find` with `-delete`/`-exec` on a system path,
+  package `publish`, `aws`/`gcloud` destructive verbs, and `curl`/`wget` piped into a shell). Those
+  plainly-written forms classify DENY or ASK (and are refused) — they are **not** residual ALLOW
+  examples. What still slips through is everything outside that inspected set, plus constructions
+  the static token heuristic cannot see: runtime command substitution (`$(...)` / backticks),
+  `eval` of a built string, base64-decoded payloads, and unknown or renamed binaries the wrapper
+  does not specifically inspect — those still classify as ALLOW today. The shape does not change:
+  it is a best-effort blocklist of common destructive commands, **NOT** a security boundary. Rely
+  on OS-level sandboxing — `container-use`, a VM, or a restricted account — for the boundary.
 - A compromised upstream agent CLI. The fleet drives Claude Code, Codex, Grok, and Orca. If one of
   those binaries is backdoored, it runs with your privileges and the wrapper cannot see inside it.
 - Supply-chain attacks on `npm` packages (the skills install path, your repo's own dependencies).