Add low-trust review containment (#7530)
## Thinking Path > - Paperclip is a control plane for AI-agent companies, so execution policy and trust boundaries are part of the product's safety contract. > - Low-trust review work needs narrower authority than normal same-company agents because hostile PRs, comments, attachments, and generated output can carry prompt-injection payloads. > - The current V1 shape gives trusted workers broad company context, which is useful for normal execution but too permissive for a reviewer assigned to hostile content. > - This branch adds a `low_trust_review` preset, source-trust tagging, route-level containment, and quarantine handling so low-trust output does not automatically flow into higher-trust wake context. > - The branch has been rebased onto current `origin/master`, and the low-trust migration was renumbered to `0097_low_trust_source_trust.sql` to avoid collisions with existing `0091` through `0096` migrations. > - Greptile feedback was addressed by tightening low-trust detection, preserving project-level trust policy checks, fixing issue-kind promotion lookup, removing duplicate post-lease isolation assertion, documenting fail-closed source-trust behavior, bounding ancestry checks, enforcing runtime issue context for CEOs, awaiting accepted-plan monitor authorization, and making low-trust issue source-trust tagging atomic. > - The benefit is a first production slice of deny-by-default review containment with regression coverage for the main control-plane pivot surfaces. Fixes #7531. ## What Changed - Added shared trust-policy types and validators, plus database/source-trust fields for issues, comments, documents, and work products. - Implemented server enforcement for low-trust issue scope, agent self-view redaction, secret/plugin/runtime denial paths, promotion checks, and quarantined continuation/wake context. - Added focused low-trust regression tests for resolver behavior, source trust, route authorization, heartbeat preflight ordering, runtime containment, and quarantine redaction. - Added board UI affordances for selecting/reviewing the low-trust preset and surfacing source-trust badges in relevant issue views. - Added `doc/LOW-TRUST-PRESETS.md`, updated `doc/SPEC-implementation.md`, and committed the low-trust review contract plan under `doc/plans/`. - Rebasing note: the original `0097_low_trust_source_trust.sql` migration was renamed to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied the old-numbered migration are not broken by the renumbered migration. ## Verification - Rebased branch onto current `origin/master` and force-pushed with lease to `origin/PAP-10211-low-trust-agent` at head `2719f31e3`. - Confirmed the PR diff does not include `pnpm-lock.yaml` or `.github/workflows` changes. - Resolved upstream UI/comment conflicts by preserving deleted-comment tombstone behavior and low-trust source-trust badges/metadata. - Renumbered the low-trust source-trust migration to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied an old-numbered copy are not broken. - `pnpm exec vitest run ui/src/lib/issue-chat-messages.test.ts server/src/__tests__/heartbeat-workspace-session.test.ts` - `pnpm exec vitest run server/src/__tests__/source-trust.test.ts server/src/__tests__/workspace-runtime-service-authz.test.ts ui/src/lib/trust-policy-ui.test.ts ui/src/components/TrustPresetSection.test.tsx` - `pnpm run typecheck:build-gaps` - `git diff --check` - GitHub checks pass on head `2719f31e3`: build, typecheck/release registry, general tests, serialized server suites, e2e, canary, verify, policy/review, Socket, and Snyk. - Greptile Review passes with Confidence Score 5/5 and zero unresolved Greptile review threads. - No design screenshots/images were added because the task explicitly says not to add them unless they are specifically part of the work. ## Risks - Medium risk: this touches shared trust-policy contracts, server authorization paths, heartbeat context generation, migration metadata, and UI preset controls. - Low-trust containment is intentionally deny-by-default; legitimate future review workflows may need explicit allowlisted exceptions. - Plugin/runtime/security surfaces are broad, so regression tests cover the current known routes but future integrations must route through the same containment layer. - The PR is ready for review; GitHub checks are green and Greptile is 5/5. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5 coding agent, tool-enabled shell and GitHub CLI workflow. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] UI changes are covered by focused tests; no screenshots were added per task instruction not to add design images unless specifically required - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Dotta
@@ -0,0 +1,349 @@
|
||||
import {
|
||||
DEFAULT_TRUST_PRESET,
|
||||
LOW_TRUST_REVIEW_PRESET,
|
||||
type LowTrustBoundary,
|
||||
type TrustPreset,
|
||||
lowTrustBoundarySchema,
|
||||
lowTrustReviewPresetPolicySchema,
|
||||
trustAuthorizationPolicySchema,
|
||||
trustPresetSchema,
|
||||
} from "@paperclipai/shared";
|
||||
|
||||
type JsonRecord = Record<string, unknown>;
|
||||
|
||||
export const LOW_TRUST_ISSUE_ANCESTRY_MAX_DEPTH = 12;
|
||||
|
||||
export type TrustPresetPolicySource = "agent" | "project" | "issue" | "run";
|
||||
|
||||
export type ResolveCoreTrustPresetInput = {
|
||||
companyId: string;
|
||||
agent?: {
|
||||
companyId?: string | null;
|
||||
permissions?: unknown;
|
||||
} | null;
|
||||
project?: {
|
||||
companyId?: string | null;
|
||||
executionWorkspacePolicy?: unknown;
|
||||
} | null;
|
||||
issue?: {
|
||||
companyId?: string | null;
|
||||
executionPolicy?: unknown;
|
||||
} | null;
|
||||
run?: {
|
||||
companyId?: string | null;
|
||||
executionPolicy?: unknown;
|
||||
} | null;
|
||||
};
|
||||
|
||||
export type TrustPresetDenyReason =
|
||||
| "unsupported_trust_preset"
|
||||
| "invalid_authorization_policy"
|
||||
| "invalid_low_trust_boundary"
|
||||
| "cross_company_boundary"
|
||||
| "conflicting_low_trust_boundary"
|
||||
| "missing_low_trust_boundary_scope";
|
||||
|
||||
export type TrustPresetResolution =
|
||||
| {
|
||||
kind: "standard";
|
||||
preset: typeof DEFAULT_TRUST_PRESET;
|
||||
boundary: null;
|
||||
sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>>;
|
||||
}
|
||||
| {
|
||||
kind: "low_trust_review";
|
||||
preset: typeof LOW_TRUST_REVIEW_PRESET;
|
||||
boundary: LowTrustBoundary & { companyId: string };
|
||||
sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>>;
|
||||
}
|
||||
| {
|
||||
kind: "denied";
|
||||
reason: TrustPresetDenyReason;
|
||||
source: TrustPresetPolicySource | null;
|
||||
detail: string;
|
||||
sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>>;
|
||||
};
|
||||
|
||||
type ParsedPolicySource = {
|
||||
source: TrustPresetPolicySource;
|
||||
companyId: string | null;
|
||||
rawPolicy: JsonRecord | null;
|
||||
authorizationPolicy: JsonRecord | null;
|
||||
trustPreset: TrustPreset | null;
|
||||
boundary: LowTrustBoundary | null;
|
||||
impliesLowTrust: boolean;
|
||||
};
|
||||
|
||||
function asRecord(value: unknown): JsonRecord | null {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value)
|
||||
? value as JsonRecord
|
||||
: null;
|
||||
}
|
||||
|
||||
function deny(
|
||||
reason: TrustPresetDenyReason,
|
||||
source: TrustPresetPolicySource | null,
|
||||
detail: string,
|
||||
sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>>,
|
||||
): TrustPresetResolution {
|
||||
return { kind: "denied", reason, source, detail, sourcePresets };
|
||||
}
|
||||
|
||||
function isTrustPresetResolution(value: unknown): value is TrustPresetResolution {
|
||||
if (!value || typeof value !== "object") return false;
|
||||
const kind = (value as { kind?: unknown }).kind;
|
||||
return kind === "standard" || kind === "low_trust_review" || kind === "denied";
|
||||
}
|
||||
|
||||
function parsePreset(
|
||||
value: unknown,
|
||||
source: TrustPresetPolicySource,
|
||||
sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>>,
|
||||
): TrustPresetResolution | TrustPreset | null {
|
||||
if (value === undefined || value === null) return null;
|
||||
const parsed = trustPresetSchema.safeParse(value);
|
||||
if (!parsed.success) {
|
||||
return deny(
|
||||
"unsupported_trust_preset",
|
||||
source,
|
||||
`Unsupported trust preset in ${source} policy.`,
|
||||
sourcePresets,
|
||||
);
|
||||
}
|
||||
return parsed.data;
|
||||
}
|
||||
|
||||
function parseReviewPresetId(
|
||||
value: unknown,
|
||||
source: TrustPresetPolicySource,
|
||||
sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>>,
|
||||
): TrustPresetResolution | TrustPreset | null {
|
||||
if (value === undefined || value === null) return null;
|
||||
const parsed = lowTrustReviewPresetPolicySchema.safeParse(value);
|
||||
if (!parsed.success) {
|
||||
return deny(
|
||||
"unsupported_trust_preset",
|
||||
source,
|
||||
`Unsupported review preset in ${source} policy.`,
|
||||
sourcePresets,
|
||||
);
|
||||
}
|
||||
return parsed.data.id;
|
||||
}
|
||||
|
||||
function parseAuthorizationPolicy(
|
||||
value: unknown,
|
||||
source: TrustPresetPolicySource,
|
||||
sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>>,
|
||||
): TrustPresetResolution | JsonRecord | null {
|
||||
if (value === undefined || value === null) return null;
|
||||
const parsed = trustAuthorizationPolicySchema.safeParse(value);
|
||||
if (!parsed.success) {
|
||||
return deny(
|
||||
"invalid_authorization_policy",
|
||||
source,
|
||||
`Invalid authorization policy in ${source} policy.`,
|
||||
sourcePresets,
|
||||
);
|
||||
}
|
||||
return parsed.data as JsonRecord;
|
||||
}
|
||||
|
||||
function parseBoundary(
|
||||
value: unknown,
|
||||
source: TrustPresetPolicySource,
|
||||
sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>>,
|
||||
): TrustPresetResolution | LowTrustBoundary | null {
|
||||
if (value === undefined || value === null) return null;
|
||||
const parsed = lowTrustBoundarySchema.safeParse(value);
|
||||
if (!parsed.success) {
|
||||
return deny(
|
||||
"invalid_low_trust_boundary",
|
||||
source,
|
||||
`Invalid low-trust boundary in ${source} policy.`,
|
||||
sourcePresets,
|
||||
);
|
||||
}
|
||||
return parsed.data;
|
||||
}
|
||||
|
||||
function parseSource(
|
||||
source: TrustPresetPolicySource,
|
||||
companyId: string | null | undefined,
|
||||
rawPolicy: JsonRecord | null,
|
||||
authorizationPolicyInput: unknown,
|
||||
sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>>,
|
||||
): ParsedPolicySource | TrustPresetResolution {
|
||||
const topPreset = parsePreset(rawPolicy?.trustPreset, source, sourcePresets);
|
||||
if (isTrustPresetResolution(topPreset)) return topPreset;
|
||||
|
||||
const topReviewPreset = parseReviewPresetId(rawPolicy?.reviewPreset, source, sourcePresets);
|
||||
if (isTrustPresetResolution(topReviewPreset)) return topReviewPreset;
|
||||
|
||||
const authorizationPolicy = parseAuthorizationPolicy(authorizationPolicyInput, source, sourcePresets);
|
||||
if (isTrustPresetResolution(authorizationPolicy)) return authorizationPolicy;
|
||||
|
||||
const authPreset = parsePreset(authorizationPolicy?.trustPreset, source, sourcePresets);
|
||||
if (isTrustPresetResolution(authPreset)) return authPreset;
|
||||
|
||||
const authReviewPreset = parseReviewPresetId(authorizationPolicy?.reviewPreset, source, sourcePresets);
|
||||
if (isTrustPresetResolution(authReviewPreset)) return authReviewPreset;
|
||||
|
||||
const boundary = parseBoundary(authorizationPolicy?.trustBoundary, source, sourcePresets);
|
||||
if (isTrustPresetResolution(boundary)) return boundary;
|
||||
|
||||
const trustPreset = topPreset ?? topReviewPreset ?? authPreset ?? authReviewPreset;
|
||||
if (trustPreset) sourcePresets[source] = trustPreset;
|
||||
|
||||
return {
|
||||
source,
|
||||
companyId: companyId ?? null,
|
||||
rawPolicy,
|
||||
authorizationPolicy,
|
||||
trustPreset,
|
||||
boundary,
|
||||
impliesLowTrust: trustPreset === LOW_TRUST_REVIEW_PRESET || Boolean(boundary),
|
||||
};
|
||||
}
|
||||
|
||||
function normalizeSet(values: readonly string[] | undefined): string[] | undefined {
|
||||
if (values === undefined) return undefined;
|
||||
return [...new Set(values)].sort();
|
||||
}
|
||||
|
||||
function intersectSets(left: string[] | undefined, right: string[] | undefined): string[] | undefined {
|
||||
const normalizedRight = normalizeSet(right);
|
||||
if (normalizedRight === undefined) return left;
|
||||
const normalizedLeft = normalizeSet(left);
|
||||
if (normalizedLeft === undefined) return normalizedRight;
|
||||
const rightSet = new Set(normalizedRight);
|
||||
return normalizedLeft.filter((value) => rightSet.has(value));
|
||||
}
|
||||
|
||||
function mergeBoundary(
|
||||
current: (LowTrustBoundary & { companyId: string }) | null,
|
||||
next: LowTrustBoundary,
|
||||
companyId: string,
|
||||
source: TrustPresetPolicySource,
|
||||
sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>>,
|
||||
): (LowTrustBoundary & { companyId: string }) | TrustPresetResolution {
|
||||
if (next.companyId && next.companyId !== companyId) {
|
||||
return deny(
|
||||
"cross_company_boundary",
|
||||
source,
|
||||
"Low-trust boundary refers to a different company.",
|
||||
sourcePresets,
|
||||
);
|
||||
}
|
||||
|
||||
const base = current ?? { mode: LOW_TRUST_REVIEW_PRESET, companyId };
|
||||
if (base.rootIssueId && next.rootIssueId && base.rootIssueId !== next.rootIssueId) {
|
||||
return deny(
|
||||
"conflicting_low_trust_boundary",
|
||||
source,
|
||||
"Low-trust boundary root issue scopes do not overlap.",
|
||||
sourcePresets,
|
||||
);
|
||||
}
|
||||
|
||||
return {
|
||||
...base,
|
||||
projectIds: intersectSets(base.projectIds, next.projectIds),
|
||||
rootIssueId: base.rootIssueId ?? next.rootIssueId,
|
||||
issueIds: intersectSets(base.issueIds, next.issueIds),
|
||||
allowedAgentIds: intersectSets(base.allowedAgentIds, next.allowedAgentIds),
|
||||
allowedSecretBindingIds: intersectSets(base.allowedSecretBindingIds, next.allowedSecretBindingIds),
|
||||
allowedToolClasses: intersectSets(base.allowedToolClasses, next.allowedToolClasses),
|
||||
outputPromotionTarget: next.outputPromotionTarget ?? base.outputPromotionTarget,
|
||||
};
|
||||
}
|
||||
|
||||
function hasBoundaryScope(boundary: LowTrustBoundary): boolean {
|
||||
return Boolean(boundary.rootIssueId)
|
||||
|| Boolean(boundary.projectIds?.length)
|
||||
|| Boolean(boundary.issueIds?.length);
|
||||
}
|
||||
|
||||
export function resolveCoreTrustPreset(input: ResolveCoreTrustPresetInput): TrustPresetResolution {
|
||||
const sourcePresets: Partial<Record<TrustPresetPolicySource, TrustPreset>> = {};
|
||||
const sources: ParsedPolicySource[] = [];
|
||||
|
||||
const agentPermissions = asRecord(input.agent?.permissions);
|
||||
const agent = parseSource("agent", input.agent?.companyId, agentPermissions, agentPermissions?.authorizationPolicy, sourcePresets);
|
||||
if ("kind" in agent) return agent;
|
||||
sources.push(agent);
|
||||
|
||||
const projectPolicy = asRecord(input.project?.executionWorkspacePolicy);
|
||||
const project = parseSource("project", input.project?.companyId, projectPolicy, projectPolicy?.authorizationPolicy, sourcePresets);
|
||||
if ("kind" in project) return project;
|
||||
sources.push(project);
|
||||
|
||||
const issuePolicy = asRecord(input.issue?.executionPolicy);
|
||||
const issue = parseSource("issue", input.issue?.companyId, issuePolicy, issuePolicy?.authorizationPolicy, sourcePresets);
|
||||
if ("kind" in issue) return issue;
|
||||
sources.push(issue);
|
||||
|
||||
const runPolicy = asRecord(input.run?.executionPolicy);
|
||||
const run = parseSource("run", input.run?.companyId, runPolicy, runPolicy?.authorizationPolicy, sourcePresets);
|
||||
if ("kind" in run) return run;
|
||||
sources.push(run);
|
||||
|
||||
for (const source of sources) {
|
||||
if (source.companyId && source.companyId !== input.companyId) {
|
||||
return deny(
|
||||
"cross_company_boundary",
|
||||
source.source,
|
||||
"Policy source belongs to a different company.",
|
||||
sourcePresets,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
const effectivePreset = sources.some((source) => source.impliesLowTrust)
|
||||
? LOW_TRUST_REVIEW_PRESET
|
||||
: DEFAULT_TRUST_PRESET;
|
||||
|
||||
if (effectivePreset === DEFAULT_TRUST_PRESET) {
|
||||
return {
|
||||
kind: "standard",
|
||||
preset: DEFAULT_TRUST_PRESET,
|
||||
boundary: null,
|
||||
sourcePresets,
|
||||
};
|
||||
}
|
||||
|
||||
let boundary: (LowTrustBoundary & { companyId: string }) | null = null;
|
||||
for (const source of sources) {
|
||||
if (!source.boundary) continue;
|
||||
const merged = mergeBoundary(boundary, source.boundary, input.companyId, source.source, sourcePresets);
|
||||
if (isTrustPresetResolution(merged)) return merged;
|
||||
boundary = merged;
|
||||
}
|
||||
|
||||
if (!boundary || !hasBoundaryScope(boundary)) {
|
||||
return deny(
|
||||
"missing_low_trust_boundary_scope",
|
||||
null,
|
||||
"Low-trust review requires a concrete project, root issue, or issue-id boundary.",
|
||||
sourcePresets,
|
||||
);
|
||||
}
|
||||
|
||||
return {
|
||||
kind: "low_trust_review",
|
||||
preset: LOW_TRUST_REVIEW_PRESET,
|
||||
boundary,
|
||||
sourcePresets,
|
||||
};
|
||||
}
|
||||
|
||||
export function isIssueWithinLowTrustBoundary(
|
||||
boundary: LowTrustBoundary & { companyId: string },
|
||||
issue: { companyId: string; id?: string | null; projectId?: string | null },
|
||||
): boolean {
|
||||
if (issue.companyId !== boundary.companyId) return false;
|
||||
if (issue.id && issue.id === boundary.rootIssueId) return true;
|
||||
if (issue.id && boundary.issueIds?.includes(issue.id)) return true;
|
||||
if (issue.projectId && boundary.projectIds?.includes(issue.projectId)) return true;
|
||||
return false;
|
||||
}
|
||||
Reference in New Issue
Block a user