docs: clarify remaining security gaps
ober
f2792a7d20069837c15fd241edbb58efae0cf5a4
--- a/docs/kimi3-security-recommmendations.md +++ b/docs/kimi3-security-recommmendations.md @@ -308,8 +308,8 @@ Keep this section to baseline facts only. | Goal | Where we stand | The gap | |---|---|---| -| G1 shrink target | Managed core is memory-safe; parsers budgeted; safe prelude exists; FFI audit inventory, per-site provisional verdicts, FFI hazard scanner rules, a gated `vendor/jsqlite` accepted-risk decision, and a gated native export review exist | FFI remediation remains: unsafe invariant comments | -| G2 cap blast radius | Capabilities, taint, kernel sandbox, egress policy objects, worker facade, memory rlimit pre-exec path, egress proxy env wiring, authenticated actor transport/envelopes, Ring HTTP source taint, and WebSocket/fiber WebSocket source taint all exist | **No native pre-exec worker backend yet for kernel sandbox controls before child input** | +| G1 shrink target | Managed core is memory-safe; parsers budgeted; safe prelude exists; FFI audit inventory, per-site provisional verdicts, FFI hazard scanner rules, a gated `vendor/jsqlite` accepted-risk decision, native unsafe invariant comments, and a gated native export review exist | FFI remediation remains: Scheme per-binding safety review | +| G2 cap blast radius | Capabilities, taint, kernel sandbox, egress policy objects, worker facade, memory rlimit pre-exec path, egress proxy env wiring, Linux pre-exec seccomp/Landlock setup, authenticated actor transport/envelopes, Ring HTTP source taint, and WebSocket/fiber WebSocket source taint all exist | Native Seatbelt/Capsicum worker parity remains open | | G3 find it first | 13 harnesses, scanner w/ rule DB, lint | No corpora, no crash regression, no scheduled fuzzing, no standing AI-red-team, no exploit-shaped regression suite | | G4 fail closed | Raw-fork launchers retired correctly; `allow-degraded?` explicit | New controls must keep the invariant; degraded-mode warnings must be test-locked | | G5 recover fast | SBOM/repro/signing gates exist | TCB accounting manual; doc drift (stale tables, undocumented modules); independent-builder reproducibility not yet routine |