Add low-trust review containment (#7530)

## Thinking Path > - Paperclip is a control plane for AI-agent companies, so execution policy and trust boundaries are part of the product's safety contract. > - Low-trust review work needs narrower authority than normal same-company agents because hostile PRs, comments, attachments, and generated output can carry prompt-injection payloads. > - The current V1 shape gives trusted workers broad company context, which is useful for normal execution but too permissive for a reviewer assigned to hostile content. > - This branch adds a `low_trust_review` preset, source-trust tagging, route-level containment, and quarantine handling so low-trust output does not automatically flow into higher-trust wake context. > - The branch has been rebased onto current `origin/master`, and the low-trust migration was renumbered to `0097_low_trust_source_trust.sql` to avoid collisions with existing `0091` through `0096` migrations. > - Greptile feedback was addressed by tightening low-trust detection, preserving project-level trust policy checks, fixing issue-kind promotion lookup, removing duplicate post-lease isolation assertion, documenting fail-closed source-trust behavior, bounding ancestry checks, enforcing runtime issue context for CEOs, awaiting accepted-plan monitor authorization, and making low-trust issue source-trust tagging atomic. > - The benefit is a first production slice of deny-by-default review containment with regression coverage for the main control-plane pivot surfaces. Fixes #7531. ## What Changed - Added shared trust-policy types and validators, plus database/source-trust fields for issues, comments, documents, and work products. - Implemented server enforcement for low-trust issue scope, agent self-view redaction, secret/plugin/runtime denial paths, promotion checks, and quarantined continuation/wake context. - Added focused low-trust regression tests for resolver behavior, source trust, route authorization, heartbeat preflight ordering, runtime containment, and quarantine redaction. - Added board UI affordances for selecting/reviewing the low-trust preset and surfacing source-trust badges in relevant issue views. - Added `doc/LOW-TRUST-PRESETS.md`, updated `doc/SPEC-implementation.md`, and committed the low-trust review contract plan under `doc/plans/`. - Rebasing note: the original `0097_low_trust_source_trust.sql` migration was renamed to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied the old-numbered migration are not broken by the renumbered migration. ## Verification - Rebased branch onto current `origin/master` and force-pushed with lease to `origin/PAP-10211-low-trust-agent` at head `2719f31e3`. - Confirmed the PR diff does not include `pnpm-lock.yaml` or `.github/workflows` changes. - Resolved upstream UI/comment conflicts by preserving deleted-comment tombstone behavior and low-trust source-trust badges/metadata. - Renumbered the low-trust source-trust migration to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied an old-numbered copy are not broken. - `pnpm exec vitest run ui/src/lib/issue-chat-messages.test.ts server/src/__tests__/heartbeat-workspace-session.test.ts` - `pnpm exec vitest run server/src/__tests__/source-trust.test.ts server/src/__tests__/workspace-runtime-service-authz.test.ts ui/src/lib/trust-policy-ui.test.ts ui/src/components/TrustPresetSection.test.tsx` - `pnpm run typecheck:build-gaps` - `git diff --check` - GitHub checks pass on head `2719f31e3`: build, typecheck/release registry, general tests, serialized server suites, e2e, canary, verify, policy/review, Socket, and Snyk. - Greptile Review passes with Confidence Score 5/5 and zero unresolved Greptile review threads. - No design screenshots/images were added because the task explicitly says not to add them unless they are specifically part of the work. ## Risks - Medium risk: this touches shared trust-policy contracts, server authorization paths, heartbeat context generation, migration metadata, and UI preset controls. - Low-trust containment is intentionally deny-by-default; legitimate future review workflows may need explicit allowlisted exceptions. - Plugin/runtime/security surfaces are broad, so regression tests cover the current known routes but future integrations must route through the same containment layer. - The PR is ready for review; GitHub checks are green and Greptile is 5/5. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5 coding agent, tool-enabled shell and GitHub CLI workflow. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] UI changes are covered by focused tests; no screenshots were added per task instruction not to add design images unless specifically required - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-06-05 11:48:02 -10:00
parent b2a33d0184
commit dbebf30c89
87 changed files with 6522 additions and 121 deletions
@@ -0,0 +1,105 @@
+import { eq } from "drizzle-orm";
+import type { Db } from "@paperclipai/db";
+import { issues } from "@paperclipai/db";
+import { unprocessable } from "../errors.js";
+import type { TrustPresetResolution } from "./trust-preset-resolver.js";
+import {
+  LOW_TRUST_ISSUE_ANCESTRY_MAX_DEPTH,
+  isIssueWithinLowTrustBoundary,
+} from "./trust-preset-resolver.js";
+
+export const LOW_TRUST_RUNTIME_MANAGEMENT_TOOL_CLASS = "runtime.manage";
+
+export function isLowTrustRuntimeManagementAllowed(resolution: TrustPresetResolution) {
+  return resolution.kind === "low_trust_review" &&
+    (resolution.boundary.allowedToolClasses ?? []).includes(LOW_TRUST_RUNTIME_MANAGEMENT_TOOL_CLASS);
+}
+
+async function issueIdIsDescendantOf(db: Db, issueId: string, rootIssueId: string, companyId: string) {
+  let cursor: string | null = issueId;
+  // Keep the runtime preflight aligned with authorization while bounding DB work.
+  for (let depth = 0; cursor && depth < LOW_TRUST_ISSUE_ANCESTRY_MAX_DEPTH; depth += 1) {
+    if (cursor === rootIssueId) return true;
+    const row: { id: string; companyId: string; parentId: string | null } | null = await db
+      .select({ id: issues.id, companyId: issues.companyId, parentId: issues.parentId })
+      .from(issues)
+      .where(eq(issues.id, cursor))
+      .then((rows) => rows[0] ?? null);
+    if (!row || row.companyId !== companyId) return false;
+    cursor = row.parentId;
+  }
+  return false;
+}
+
+async function workspaceIssueWithinLowTrustBoundary(input: {
+  db?: Db;
+  boundary: Extract<TrustPresetResolution, { kind: "low_trust_review" }>["boundary"];
+  issue: { companyId: string; id?: string | null; projectId?: string | null };
+}) {
+  if (isIssueWithinLowTrustBoundary(input.boundary, input.issue)) return true;
+  if (!input.db || !input.issue.id || !input.boundary.rootIssueId) return false;
+  return issueIdIsDescendantOf(input.db, input.issue.id, input.boundary.rootIssueId, input.boundary.companyId);
+}
+
+export async function assertLowTrustWorkspaceIsolation(input: {
+  db?: Db;
+  resolution: TrustPresetResolution;
+  isolatedWorkspacesEnabled: boolean;
+  effectiveExecutionWorkspaceMode: string | null | undefined;
+  selectedEnvironmentDriver: string | null | undefined;
+  issue: { companyId: string; id?: string | null; projectId?: string | null } | null;
+}) {
+  if (input.resolution.kind === "denied") {
+    throw unprocessable(input.resolution.detail, {
+      code: input.resolution.reason,
+      source: input.resolution.source,
+    });
+  }
+  if (input.resolution.kind !== "low_trust_review") return;
+
+  if (!input.isolatedWorkspacesEnabled) {
+    throw unprocessable("Low-trust execution requires isolated workspaces to be enabled.", {
+      code: "low_trust_isolation_unavailable",
+    });
+  }
+  if (input.effectiveExecutionWorkspaceMode !== "isolated_workspace") {
+    throw unprocessable("Low-trust execution requires an isolated execution workspace.", {
+      code: "low_trust_requires_isolated_workspace",
+    });
+  }
+  if (
+    !input.issue ||
+    !(await workspaceIssueWithinLowTrustBoundary({
+      db: input.db,
+      boundary: input.resolution.boundary,
+      issue: input.issue,
+    }))
+  ) {
+    throw unprocessable("Low-trust execution issue is outside the active trust boundary.", {
+      code: "low_trust_boundary_mismatch",
+    });
+  }
+  if (input.selectedEnvironmentDriver !== "sandbox") {
+    throw unprocessable("Low-trust execution requires a sandbox environment driver.", {
+      code: "low_trust_requires_sandbox_environment",
+    });
+  }
+}
+
+export function assertLowTrustRuntimeServicesAllowed(input: {
+  resolution: TrustPresetResolution;
+  runtimeServiceCount: number;
+}) {
+  if (input.resolution.kind === "denied") {
+    throw unprocessable(input.resolution.detail, {
+      code: input.resolution.reason,
+      source: input.resolution.source,
+    });
+  }
+  if (input.resolution.kind !== "low_trust_review") return;
+  if (input.runtimeServiceCount === 0) return;
+  if (isLowTrustRuntimeManagementAllowed(input.resolution)) return;
+  throw unprocessable("Low-trust execution cannot start runtime services unless the boundary grants runtime.manage.", {
+    code: "low_trust_runtime_services_denied",
+  });
+}