Add low-trust review containment (#7530)
## Thinking Path > - Paperclip is a control plane for AI-agent companies, so execution policy and trust boundaries are part of the product's safety contract. > - Low-trust review work needs narrower authority than normal same-company agents because hostile PRs, comments, attachments, and generated output can carry prompt-injection payloads. > - The current V1 shape gives trusted workers broad company context, which is useful for normal execution but too permissive for a reviewer assigned to hostile content. > - This branch adds a `low_trust_review` preset, source-trust tagging, route-level containment, and quarantine handling so low-trust output does not automatically flow into higher-trust wake context. > - The branch has been rebased onto current `origin/master`, and the low-trust migration was renumbered to `0097_low_trust_source_trust.sql` to avoid collisions with existing `0091` through `0096` migrations. > - Greptile feedback was addressed by tightening low-trust detection, preserving project-level trust policy checks, fixing issue-kind promotion lookup, removing duplicate post-lease isolation assertion, documenting fail-closed source-trust behavior, bounding ancestry checks, enforcing runtime issue context for CEOs, awaiting accepted-plan monitor authorization, and making low-trust issue source-trust tagging atomic. > - The benefit is a first production slice of deny-by-default review containment with regression coverage for the main control-plane pivot surfaces. Fixes #7531. ## What Changed - Added shared trust-policy types and validators, plus database/source-trust fields for issues, comments, documents, and work products. - Implemented server enforcement for low-trust issue scope, agent self-view redaction, secret/plugin/runtime denial paths, promotion checks, and quarantined continuation/wake context. - Added focused low-trust regression tests for resolver behavior, source trust, route authorization, heartbeat preflight ordering, runtime containment, and quarantine redaction. - Added board UI affordances for selecting/reviewing the low-trust preset and surfacing source-trust badges in relevant issue views. - Added `doc/LOW-TRUST-PRESETS.md`, updated `doc/SPEC-implementation.md`, and committed the low-trust review contract plan under `doc/plans/`. - Rebasing note: the original `0097_low_trust_source_trust.sql` migration was renamed to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied the old-numbered migration are not broken by the renumbered migration. ## Verification - Rebased branch onto current `origin/master` and force-pushed with lease to `origin/PAP-10211-low-trust-agent` at head `2719f31e3`. - Confirmed the PR diff does not include `pnpm-lock.yaml` or `.github/workflows` changes. - Resolved upstream UI/comment conflicts by preserving deleted-comment tombstone behavior and low-trust source-trust badges/metadata. - Renumbered the low-trust source-trust migration to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied an old-numbered copy are not broken. - `pnpm exec vitest run ui/src/lib/issue-chat-messages.test.ts server/src/__tests__/heartbeat-workspace-session.test.ts` - `pnpm exec vitest run server/src/__tests__/source-trust.test.ts server/src/__tests__/workspace-runtime-service-authz.test.ts ui/src/lib/trust-policy-ui.test.ts ui/src/components/TrustPresetSection.test.tsx` - `pnpm run typecheck:build-gaps` - `git diff --check` - GitHub checks pass on head `2719f31e3`: build, typecheck/release registry, general tests, serialized server suites, e2e, canary, verify, policy/review, Socket, and Snyk. - Greptile Review passes with Confidence Score 5/5 and zero unresolved Greptile review threads. - No design screenshots/images were added because the task explicitly says not to add them unless they are specifically part of the work. ## Risks - Medium risk: this touches shared trust-policy contracts, server authorization paths, heartbeat context generation, migration metadata, and UI preset controls. - Low-trust containment is intentionally deny-by-default; legitimate future review workflows may need explicit allowlisted exceptions. - Plugin/runtime/security surfaces are broad, so regression tests cover the current known routes but future integrations must route through the same containment layer. - The PR is ready for review; GitHub checks are green and Greptile is 5/5. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5 coding agent, tool-enabled shell and GitHub CLI workflow. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] UI changes are covered by focused tests; no screenshots were added per task instruction not to add design images unless specifically required - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Dotta
@@ -11,14 +11,18 @@ import {
|
||||
formatRuntimeWorkspaceWarningLog,
|
||||
mergeExecutionWorkspaceMetadataForPersistence,
|
||||
mergeCoalescedContextSnapshot,
|
||||
preflightLowTrustWorkspaceIsolation,
|
||||
prioritizeProjectWorkspaceCandidatesForRun,
|
||||
parseSessionCompactionPolicy,
|
||||
resolveNextSessionState,
|
||||
resolveWorkspaceAfterLowTrustPreflight,
|
||||
resolveRuntimeSessionParamsForWorkspace,
|
||||
stripHostWorkspaceProvisionForLowTrustSandbox,
|
||||
stripWorkspaceRuntimeFromExecutionRunConfig,
|
||||
shouldResetTaskSessionForWake,
|
||||
type ResolvedWorkspaceForRun,
|
||||
} from "../services/heartbeat.ts";
|
||||
import type { TrustPresetResolution } from "../services/trust-preset-resolver.ts";
|
||||
|
||||
function buildResolvedWorkspace(overrides: Partial<ResolvedWorkspaceForRun> = {}): ResolvedWorkspaceForRun {
|
||||
return {
|
||||
@@ -85,6 +89,214 @@ const truncatingHermesSessionCodec = {
|
||||
},
|
||||
};
|
||||
|
||||
function lowTrustResolution(): TrustPresetResolution {
|
||||
return {
|
||||
kind: "low_trust_review",
|
||||
preset: "low_trust_review",
|
||||
boundary: {
|
||||
mode: "low_trust_review",
|
||||
companyId: "company-1",
|
||||
rootIssueId: "issue-1",
|
||||
},
|
||||
sourcePresets: { agent: "low_trust_review" },
|
||||
};
|
||||
}
|
||||
|
||||
function standardTrustResolution(): TrustPresetResolution {
|
||||
return {
|
||||
kind: "standard",
|
||||
preset: "standard",
|
||||
boundary: null,
|
||||
sourcePresets: {},
|
||||
};
|
||||
}
|
||||
|
||||
function buildIssueAncestryDb(rows: Array<{ id: string; companyId: string; parentId: string | null }>) {
|
||||
const queue = [...rows];
|
||||
return {
|
||||
select: () => ({
|
||||
from: () => ({
|
||||
where: () => {
|
||||
const row = queue.shift();
|
||||
return Promise.resolve(row ? [row] : []);
|
||||
},
|
||||
}),
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
describe("stripHostWorkspaceProvisionForLowTrustSandbox", () => {
|
||||
it("removes only the host-side provision command for sandbox-backed low-trust runs", () => {
|
||||
const config = {
|
||||
workspaceStrategy: {
|
||||
type: "git_worktree",
|
||||
branchTemplate: "{{issue.identifier}}-{{slug}}",
|
||||
provisionCommand: "bash ./scripts/provision-worktree.sh",
|
||||
teardownCommand: "bash ./scripts/teardown-worktree.sh",
|
||||
},
|
||||
workspaceRuntime: {
|
||||
services: [{ name: "web" }],
|
||||
},
|
||||
};
|
||||
|
||||
const result = stripHostWorkspaceProvisionForLowTrustSandbox({
|
||||
config,
|
||||
trustPreset: lowTrustResolution(),
|
||||
selectedEnvironmentDriver: "sandbox",
|
||||
});
|
||||
|
||||
expect(result).not.toBe(config);
|
||||
expect(result.workspaceStrategy).toEqual({
|
||||
type: "git_worktree",
|
||||
branchTemplate: "{{issue.identifier}}-{{slug}}",
|
||||
teardownCommand: "bash ./scripts/teardown-worktree.sh",
|
||||
});
|
||||
expect(result.workspaceRuntime).toBe(config.workspaceRuntime);
|
||||
expect(config.workspaceStrategy.provisionCommand).toBe("bash ./scripts/provision-worktree.sh");
|
||||
});
|
||||
|
||||
it("preserves provision commands for standard-trust runs", () => {
|
||||
const config = {
|
||||
workspaceStrategy: {
|
||||
type: "git_worktree",
|
||||
provisionCommand: "bash ./scripts/provision-worktree.sh",
|
||||
},
|
||||
};
|
||||
|
||||
expect(stripHostWorkspaceProvisionForLowTrustSandbox({
|
||||
config,
|
||||
trustPreset: standardTrustResolution(),
|
||||
selectedEnvironmentDriver: "sandbox",
|
||||
})).toBe(config);
|
||||
});
|
||||
|
||||
it("preserves provision commands when a low-trust run is not sandbox-backed", () => {
|
||||
const config = {
|
||||
workspaceStrategy: {
|
||||
type: "git_worktree",
|
||||
provisionCommand: "bash ./scripts/provision-worktree.sh",
|
||||
},
|
||||
};
|
||||
|
||||
expect(stripHostWorkspaceProvisionForLowTrustSandbox({
|
||||
config,
|
||||
trustPreset: lowTrustResolution(),
|
||||
selectedEnvironmentDriver: "local",
|
||||
})).toBe(config);
|
||||
});
|
||||
});
|
||||
|
||||
describe("preflightLowTrustWorkspaceIsolation", () => {
|
||||
it("fails non-sandbox low-trust runs before the caller reaches host workspace side effects", async () => {
|
||||
let hostWorkspaceSideEffectReached = false;
|
||||
|
||||
await expect((async () => {
|
||||
await preflightLowTrustWorkspaceIsolation({
|
||||
trustPreset: lowTrustResolution(),
|
||||
isolatedWorkspacesEnabled: true,
|
||||
effectiveExecutionWorkspaceMode: "isolated_workspace",
|
||||
issue: {
|
||||
companyId: "company-1",
|
||||
id: "issue-1",
|
||||
projectId: "project-1",
|
||||
},
|
||||
resolveSelectedEnvironmentDriver: async () => "local",
|
||||
});
|
||||
hostWorkspaceSideEffectReached = true;
|
||||
})()).rejects.toMatchObject({
|
||||
status: 422,
|
||||
details: expect.objectContaining({
|
||||
code: "low_trust_requires_sandbox_environment",
|
||||
}),
|
||||
});
|
||||
|
||||
expect(hostWorkspaceSideEffectReached).toBe(false);
|
||||
});
|
||||
|
||||
it("returns the sandbox driver for sandbox-backed low-trust runs", async () => {
|
||||
await expect(preflightLowTrustWorkspaceIsolation({
|
||||
trustPreset: lowTrustResolution(),
|
||||
isolatedWorkspacesEnabled: true,
|
||||
effectiveExecutionWorkspaceMode: "isolated_workspace",
|
||||
issue: {
|
||||
companyId: "company-1",
|
||||
id: "issue-1",
|
||||
projectId: "project-1",
|
||||
},
|
||||
resolveSelectedEnvironmentDriver: async () => "sandbox",
|
||||
})).resolves.toBe("sandbox");
|
||||
});
|
||||
|
||||
it("allows child issues inside a rootIssueId low-trust boundary during workspace preflight", async () => {
|
||||
await expect(preflightLowTrustWorkspaceIsolation({
|
||||
db: buildIssueAncestryDb([
|
||||
{ id: "issue-child", companyId: "company-1", parentId: "issue-1" },
|
||||
{ id: "issue-1", companyId: "company-1", parentId: null },
|
||||
]) as any,
|
||||
trustPreset: lowTrustResolution(),
|
||||
isolatedWorkspacesEnabled: true,
|
||||
effectiveExecutionWorkspaceMode: "isolated_workspace",
|
||||
issue: {
|
||||
companyId: "company-1",
|
||||
id: "issue-child",
|
||||
projectId: null,
|
||||
},
|
||||
resolveSelectedEnvironmentDriver: async () => "sandbox",
|
||||
})).resolves.toBe("sandbox");
|
||||
});
|
||||
});
|
||||
|
||||
describe("resolveWorkspaceAfterLowTrustPreflight", () => {
|
||||
it("fails non-sandbox low-trust runs before resolving workspaces", async () => {
|
||||
let workspaceResolverReached = false;
|
||||
|
||||
await expect(resolveWorkspaceAfterLowTrustPreflight({
|
||||
trustPreset: lowTrustResolution(),
|
||||
isolatedWorkspacesEnabled: true,
|
||||
effectiveExecutionWorkspaceMode: "isolated_workspace",
|
||||
issue: {
|
||||
companyId: "company-1",
|
||||
id: "issue-1",
|
||||
projectId: "project-1",
|
||||
},
|
||||
resolveSelectedEnvironmentDriver: async () => "local",
|
||||
resolveWorkspace: async () => {
|
||||
workspaceResolverReached = true;
|
||||
return buildResolvedWorkspace();
|
||||
},
|
||||
})).rejects.toMatchObject({
|
||||
status: 422,
|
||||
details: expect.objectContaining({
|
||||
code: "low_trust_requires_sandbox_environment",
|
||||
}),
|
||||
});
|
||||
|
||||
expect(workspaceResolverReached).toBe(false);
|
||||
});
|
||||
|
||||
it("preserves standard-trust workspace resolution", async () => {
|
||||
const workspace = buildResolvedWorkspace({ cwd: "/tmp/standard-workspace" });
|
||||
|
||||
await expect(resolveWorkspaceAfterLowTrustPreflight({
|
||||
trustPreset: standardTrustResolution(),
|
||||
isolatedWorkspacesEnabled: false,
|
||||
effectiveExecutionWorkspaceMode: "shared_workspace",
|
||||
issue: {
|
||||
companyId: "company-1",
|
||||
id: "issue-1",
|
||||
projectId: "project-1",
|
||||
},
|
||||
resolveSelectedEnvironmentDriver: async () => {
|
||||
throw new Error("standard trust should not inspect the environment driver");
|
||||
},
|
||||
resolveWorkspace: async () => workspace,
|
||||
})).resolves.toEqual({
|
||||
selectedEnvironmentDriver: null,
|
||||
workspace,
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe("resolveRuntimeSessionParamsForWorkspace", () => {
|
||||
it("migrates fallback workspace sessions to project workspace when project cwd becomes available", () => {
|
||||
const agentId = "agent-123";
|
||||
|
||||
Reference in New Issue
Block a user