docs: consolidate security status
Jaime Fournier <jaimef@linbsd.org>
5bef2c8e6f08f24736e647542371a17c43530870
diff --git a/docs/kimi3-security-recommmendations.md b/docs/kimi3-security-recommmendations.md index 319356a..d1fb263 100644 --- a/docs/kimi3-security-recommmendations.md +++ b/docs/kimi3-security-recommmendations.md @@ -304,7 +304,7 @@ when" must be answerable from `dist/release-evidence/` in minutes. | Goal | Where we stand | The gap | |---|---|---| -| G1 shrink target | Managed core is memory-safe; parsers budgeted; safe prelude exists; FFI audit inventory, per-site provisional verdicts, FFI hazard scanner rules, and a gated `vendor/jsqlite` accepted-risk decision exist | FFI remediation remains: unsafe invariant comments and native export shrinking/justification | +| G1 shrink target | Managed core is memory-safe; parsers budgeted; safe prelude exists; FFI audit inventory, per-site provisional verdicts, FFI hazard scanner rules, a gated `vendor/jsqlite` accepted-risk decision, and a gated native export review exist | FFI remediation remains: unsafe invariant comments | | G2 cap blast radius | Capabilities, taint, kernel sandbox, egress policy objects, worker facade, memory rlimit pre-exec path, egress proxy env wiring, authenticated actor transport/envelopes, Ring HTTP source taint, and WebSocket/fiber WebSocket source taint all exist | **No native pre-exec worker backend yet for kernel sandbox controls before child input** | | G3 find it first | 13 harnesses, scanner w/ rule DB, lint | No corpora, no crash regression, no scheduled fuzzing, no standing AI-red-team, no exploit-shaped regression suite | | G4 fail closed | Raw-fork launchers retired correctly; `allow-degraded?` explicit | New controls must keep the invariant; degraded-mode warnings must be test-locked | @@ -1104,8 +1104,8 @@ Track these in `docs/status.md` per release: | Build balance clean | `pattern.ss` repaired 2026-07-27; `source-balance` in `make audit` | always clean | | Confined worker exists | facade, audit lifecycle, output caps, deadline, process-group kill, memory rlimit pre-exec path, explicit sandbox-axis refusal, and egress proxy env wiring landed 2026-07-27; native kernel sandbox installation pending | yes, tested (P0-02) | | Unclassified raw `read`/FASL/`load` sites | scanner-driven manifest classification gate closed 2026-07-27; trusted build, compiler, REPL/dev, and test surfaces are centrally justified by exact source line | 0 | -| FFI bindings audited | 0 / 91 files | 100% with verdicts | -| Un-annotated Rust `unsafe` blocks | unknown / 432 matches | 0 | +| FFI bindings audited | scanner inventory and provisional verdicts in [ffi-audit.md](ffi-audit.md); native exports gated and justified | 100% with final verdicts | +| Un-annotated Rust `unsafe` blocks | 433 unsafe review sites without nearby `SAFETY:` comments in [ffi-audit.md](ffi-audit.md) | 0 | | Fuzz corpora / crash regressions | 0 / 0 | per-parser corpora + every crash a test | | Exploit-shaped regression tests | ~0 | ≥ 1 per historical finding | | Sandboxed-by-default app entry | no | yes (P0-06) | @@ -1200,9 +1200,9 @@ fake confidence happens. - Secure memory has a checked `secure-bytevector` API; raw secure-region pointers remain for explicit FFI integration. - FFI audit phase 5 has a reproducible inventory, per-site provisional - verdicts, committed hazard scanner rules, and a `vendor/jsqlite` accepted-risk - decision gated by `make audit`; unsafe invariant comments and export - shrinking/justification remain open. + verdicts, committed hazard scanner rules, a `vendor/jsqlite` accepted-risk + decision gated by `make audit`, and a native export review gate; unsafe + invariant comments remain open. - No independent red-team evaluation yet (P2-04 starts the practice). - The confined exec worker facade exists as `(std security worker)`, with audit-log lifecycle events and native pre-exec memory rlimits on supported diff --git a/docs/status.md b/docs/status.md index d36fca1..1b23646 100644 --- a/docs/status.md +++ b/docs/status.md @@ -1,6 +1,6 @@ # Jerboa Production Status -Updated 2026-07-27. +Updated 2026-07-28. Jerboa is a Jerboa-first toolchain and standard library on top of a vendored Chez runtime. User code is `.ss`, public commands go through `jerboa`, and @@ -20,6 +20,16 @@ release artifacts are built as Jerboa multicall binaries with `jerboa`, | Build and release | `make binary` is the local non-Linux release build, `make docker-build` is the Linux release build, and `make release-evidence` collects audit evidence. | | MCP and LSP | Active tooling lives in this repo and is built through `jmcp` and `jlsp` targets. | +## Security Backlog Snapshot + +| Area | Current state | Remaining work | +|---|---|---| +| Kimi security handoff | [kimi3-security-recommmendations.md](kimi3-security-recommmendations.md) is the backlog. Dated evidence and review manifests live under [reviews/](reviews/). | Keep new security evidence in dated review records and summarize the current release state here. | +| FFI audit phase 5 | [ffi-audit.md](ffi-audit.md) records the scanner output, provisional Scheme binding verdicts, and native Rust export inventory. `make native-export-review-check` gates native export decisions. | Add `SAFETY:` invariant comments near Rust unsafe sites. | +| Native Rust exports | The native export review now has 190 exported functions: 183 tracked Scheme references and 7 retained standalone C/binary helpers. The previous 35 no-Scheme-reference removal candidates no longer have C ABI export markers. | Re-run `make native-export-review-check` whenever adding or removing native exports. | +| Confined worker | `(std security worker)` provides the facade, audit lifecycle, output caps, deadlines, process-group kill, memory rlimit pre-exec setup, explicit sandbox-axis refusal, and egress proxy env wiring. | Install native kernel sandboxes in the worker pre-exec path and keep Linux/macOS/FreeBSD parity tests current. | +| Safe surface | Direct scripts default to the safe prelude; raw access requires `--unsafe-prelude` or `(jerboa prelude unsafe)`. | Continue moving risky APIs behind explicit unsafe imports as new modules land. | + ## Compatibility Notes - Jerboa still uses Chez as the runtime and compiler substrate, but public docs