Add low-trust review containment (#7530)
## Thinking Path > - Paperclip is a control plane for AI-agent companies, so execution policy and trust boundaries are part of the product's safety contract. > - Low-trust review work needs narrower authority than normal same-company agents because hostile PRs, comments, attachments, and generated output can carry prompt-injection payloads. > - The current V1 shape gives trusted workers broad company context, which is useful for normal execution but too permissive for a reviewer assigned to hostile content. > - This branch adds a `low_trust_review` preset, source-trust tagging, route-level containment, and quarantine handling so low-trust output does not automatically flow into higher-trust wake context. > - The branch has been rebased onto current `origin/master`, and the low-trust migration was renumbered to `0097_low_trust_source_trust.sql` to avoid collisions with existing `0091` through `0096` migrations. > - Greptile feedback was addressed by tightening low-trust detection, preserving project-level trust policy checks, fixing issue-kind promotion lookup, removing duplicate post-lease isolation assertion, documenting fail-closed source-trust behavior, bounding ancestry checks, enforcing runtime issue context for CEOs, awaiting accepted-plan monitor authorization, and making low-trust issue source-trust tagging atomic. > - The benefit is a first production slice of deny-by-default review containment with regression coverage for the main control-plane pivot surfaces. Fixes #7531. ## What Changed - Added shared trust-policy types and validators, plus database/source-trust fields for issues, comments, documents, and work products. - Implemented server enforcement for low-trust issue scope, agent self-view redaction, secret/plugin/runtime denial paths, promotion checks, and quarantined continuation/wake context. - Added focused low-trust regression tests for resolver behavior, source trust, route authorization, heartbeat preflight ordering, runtime containment, and quarantine redaction. - Added board UI affordances for selecting/reviewing the low-trust preset and surfacing source-trust badges in relevant issue views. - Added `doc/LOW-TRUST-PRESETS.md`, updated `doc/SPEC-implementation.md`, and committed the low-trust review contract plan under `doc/plans/`. - Rebasing note: the original `0097_low_trust_source_trust.sql` migration was renamed to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied the old-numbered migration are not broken by the renumbered migration. ## Verification - Rebased branch onto current `origin/master` and force-pushed with lease to `origin/PAP-10211-low-trust-agent` at head `2719f31e3`. - Confirmed the PR diff does not include `pnpm-lock.yaml` or `.github/workflows` changes. - Resolved upstream UI/comment conflicts by preserving deleted-comment tombstone behavior and low-trust source-trust badges/metadata. - Renumbered the low-trust source-trust migration to `0097_low_trust_source_trust.sql`; the SQL uses `ADD COLUMN IF NOT EXISTS` so users who already applied an old-numbered copy are not broken. - `pnpm exec vitest run ui/src/lib/issue-chat-messages.test.ts server/src/__tests__/heartbeat-workspace-session.test.ts` - `pnpm exec vitest run server/src/__tests__/source-trust.test.ts server/src/__tests__/workspace-runtime-service-authz.test.ts ui/src/lib/trust-policy-ui.test.ts ui/src/components/TrustPresetSection.test.tsx` - `pnpm run typecheck:build-gaps` - `git diff --check` - GitHub checks pass on head `2719f31e3`: build, typecheck/release registry, general tests, serialized server suites, e2e, canary, verify, policy/review, Socket, and Snyk. - Greptile Review passes with Confidence Score 5/5 and zero unresolved Greptile review threads. - No design screenshots/images were added because the task explicitly says not to add them unless they are specifically part of the work. ## Risks - Medium risk: this touches shared trust-policy contracts, server authorization paths, heartbeat context generation, migration metadata, and UI preset controls. - Low-trust containment is intentionally deny-by-default; legitimate future review workflows may need explicit allowlisted exceptions. - Plugin/runtime/security surfaces are broad, so regression tests cover the current known routes but future integrations must route through the same containment layer. - The PR is ready for review; GitHub checks are green and Greptile is 5/5. > For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and discuss it in `#dev` before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See `CONTRIBUTING.md`. ## Model Used - OpenAI Codex, GPT-5 coding agent, tool-enabled shell and GitHub CLI workflow. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] UI changes are covered by focused tests; no screenshots were added per task instruction not to add design images unless specifically required - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [x] I will address all Greptile and reviewer comments before requesting merge --------- Co-authored-by: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Dotta
@@ -53,6 +53,7 @@ function createComment(overrides: Partial<IssueChatComment> = {}): IssueChatComm
|
||||
authorType: authorAgentId ? "agent" : "user",
|
||||
presentation: null,
|
||||
metadata: null,
|
||||
sourceTrust: null,
|
||||
createdAt: new Date("2026-04-06T12:00:00.000Z"),
|
||||
updatedAt: new Date("2026-04-06T12:00:00.000Z"),
|
||||
...overrides,
|
||||
@@ -350,6 +351,32 @@ describe("buildIssueChatMessages", () => {
|
||||
expect(JSON.stringify(messages[0])).not.toContain("Sensitive deleted body");
|
||||
});
|
||||
|
||||
it("preserves low-trust source metadata on comment messages", () => {
|
||||
const messages = buildIssueChatMessages({
|
||||
comments: [
|
||||
createComment({
|
||||
authorAgentId: "agent-1",
|
||||
authorUserId: null,
|
||||
sourceTrust: {
|
||||
preset: "low_trust_review",
|
||||
disposition: "quarantined",
|
||||
sourceAgentId: "agent-1",
|
||||
},
|
||||
}),
|
||||
],
|
||||
timelineEvents: [],
|
||||
linkedRuns: [],
|
||||
liveRuns: [],
|
||||
agentMap: new Map([["agent-1", createAgent("agent-1", "Low Trust Reviewer")]]),
|
||||
});
|
||||
|
||||
expect(messages[0]?.metadata.custom.sourceTrust).toMatchObject({
|
||||
preset: "low_trust_review",
|
||||
disposition: "quarantined",
|
||||
sourceAgentId: "agent-1",
|
||||
});
|
||||
});
|
||||
|
||||
it("prefers derived agent attribution when a board-authored comment is proven to come from a run", () => {
|
||||
const agentMap = new Map<string, Agent>([["agent-1", createAgent("agent-1", "Claude")]]);
|
||||
const messages = buildIssueChatMessages({
|
||||
|
||||
@@ -413,6 +413,7 @@ function createCommentMessage(args: {
|
||||
deletedByAgentId: comment.deletedByAgentId ?? null,
|
||||
deletedByUserId: comment.deletedByUserId ?? null,
|
||||
deletedByRunId: comment.deletedByRunId ?? null,
|
||||
sourceTrust: comment.sourceTrust ?? null,
|
||||
};
|
||||
const contentText = comment.deletedAt ? "" : comment.body;
|
||||
|
||||
|
||||
@@ -41,4 +41,53 @@ describe("buildNewAgentHirePayload", () => {
|
||||
defaultEnvironmentId: null,
|
||||
});
|
||||
});
|
||||
|
||||
it("includes core trust preset permissions when provided", () => {
|
||||
expect(
|
||||
buildNewAgentHirePayload({
|
||||
name: "PR Reviewer",
|
||||
effectiveRole: "engineer",
|
||||
configValues: {
|
||||
...defaultCreateValues,
|
||||
adapterType: "codex_local",
|
||||
},
|
||||
adapterConfig: {},
|
||||
permissions: {
|
||||
canCreateAgents: false,
|
||||
trustPreset: "low_trust_review",
|
||||
authorizationPolicy: {
|
||||
trustPreset: "low_trust_review",
|
||||
reviewPreset: {
|
||||
id: "low_trust_review",
|
||||
version: 1,
|
||||
rawOutputDisposition: "quarantine",
|
||||
},
|
||||
trustBoundary: {
|
||||
mode: "low_trust_review",
|
||||
companyId: "company-1",
|
||||
rootIssueId: "issue-root",
|
||||
},
|
||||
},
|
||||
},
|
||||
}),
|
||||
).toMatchObject({
|
||||
permissions: {
|
||||
canCreateAgents: false,
|
||||
trustPreset: "low_trust_review",
|
||||
authorizationPolicy: {
|
||||
trustPreset: "low_trust_review",
|
||||
reviewPreset: {
|
||||
id: "low_trust_review",
|
||||
version: 1,
|
||||
rawOutputDisposition: "quarantine",
|
||||
},
|
||||
trustBoundary: {
|
||||
mode: "low_trust_review",
|
||||
companyId: "company-1",
|
||||
rootIssueId: "issue-root",
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
import type { CreateConfigValues } from "../components/AgentConfigForm";
|
||||
import { buildNewAgentRuntimeConfig } from "./new-agent-runtime-config";
|
||||
import type { AgentPermissions } from "@paperclipai/shared";
|
||||
|
||||
export function buildNewAgentHirePayload(input: {
|
||||
name: string;
|
||||
@@ -9,6 +10,7 @@ export function buildNewAgentHirePayload(input: {
|
||||
selectedSkillKeys?: string[];
|
||||
configValues: CreateConfigValues;
|
||||
adapterConfig: Record<string, unknown>;
|
||||
permissions?: Partial<AgentPermissions>;
|
||||
}) {
|
||||
const {
|
||||
name,
|
||||
@@ -18,6 +20,7 @@ export function buildNewAgentHirePayload(input: {
|
||||
selectedSkillKeys = [],
|
||||
configValues,
|
||||
adapterConfig,
|
||||
permissions,
|
||||
} = input;
|
||||
|
||||
return {
|
||||
@@ -36,5 +39,6 @@ export function buildNewAgentHirePayload(input: {
|
||||
cheapModelEnabled: configValues.cheapModelEnabled,
|
||||
}),
|
||||
budgetMonthlyCents: 0,
|
||||
...(permissions ? { permissions } : {}),
|
||||
};
|
||||
}
|
||||
|
||||
@@ -0,0 +1,117 @@
|
||||
// @vitest-environment node
|
||||
import { describe, expect, it } from "vitest";
|
||||
import {
|
||||
clearSingleLowTrustBoundaryTarget,
|
||||
getLowTrustBoundary,
|
||||
getSingleLowTrustBoundaryTarget,
|
||||
isCeLowTrustBoundaryEditable,
|
||||
setSingleLowTrustBoundaryTarget,
|
||||
summarizeLowTrustBoundaryTarget,
|
||||
} from "./trust-policy-ui";
|
||||
|
||||
describe("trust-policy-ui low-trust boundary helpers", () => {
|
||||
it("writes one project boundary with mode and company id", () => {
|
||||
const permissions = setSingleLowTrustBoundaryTarget(null, "company-1", {
|
||||
type: "project",
|
||||
id: "project-1",
|
||||
});
|
||||
|
||||
expect(permissions).toMatchObject({
|
||||
trustPreset: "low_trust_review",
|
||||
authorizationPolicy: {
|
||||
trustPreset: "low_trust_review",
|
||||
reviewPreset: {
|
||||
id: "low_trust_review",
|
||||
version: 1,
|
||||
rawOutputDisposition: "quarantine",
|
||||
},
|
||||
trustBoundary: {
|
||||
mode: "low_trust_review",
|
||||
companyId: "company-1",
|
||||
projectIds: ["project-1"],
|
||||
},
|
||||
},
|
||||
});
|
||||
});
|
||||
|
||||
it("clears other scope fields while preserving non-scope policy fields", () => {
|
||||
const permissions = setSingleLowTrustBoundaryTarget(
|
||||
{
|
||||
trustPreset: "low_trust_review",
|
||||
authorizationPolicy: {
|
||||
customEeField: { mode: "preserved" },
|
||||
trustBoundary: {
|
||||
mode: "low_trust_review",
|
||||
companyId: "company-1",
|
||||
projectIds: ["project-1"],
|
||||
rootIssueId: "root-1",
|
||||
issueIds: ["issue-1"],
|
||||
allowedToolClasses: ["git.read"],
|
||||
},
|
||||
},
|
||||
},
|
||||
"company-2",
|
||||
{ type: "issue", id: "issue-2" },
|
||||
);
|
||||
|
||||
expect(permissions.authorizationPolicy).toMatchObject({
|
||||
customEeField: { mode: "preserved" },
|
||||
trustBoundary: {
|
||||
mode: "low_trust_review",
|
||||
companyId: "company-2",
|
||||
issueIds: ["issue-2"],
|
||||
allowedToolClasses: ["git.read"],
|
||||
},
|
||||
});
|
||||
expect(permissions.authorizationPolicy?.trustBoundary?.projectIds).toBeUndefined();
|
||||
expect(permissions.authorizationPolicy?.trustBoundary?.rootIssueId).toBeUndefined();
|
||||
});
|
||||
|
||||
it("hydrates one existing root issue boundary", () => {
|
||||
const boundary = getLowTrustBoundary({
|
||||
trustPreset: "low_trust_review",
|
||||
authorizationPolicy: {
|
||||
trustBoundary: {
|
||||
mode: "low_trust_review",
|
||||
companyId: "company-1",
|
||||
rootIssueId: "issue-root",
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
expect(getSingleLowTrustBoundaryTarget(boundary)).toEqual({ type: "root_issue", id: "issue-root" });
|
||||
expect(summarizeLowTrustBoundaryTarget(boundary)).toBe("Root issue issue-ro");
|
||||
});
|
||||
|
||||
it("marks multi-boundary policies read-only for CE", () => {
|
||||
const boundary = {
|
||||
mode: "low_trust_review" as const,
|
||||
companyId: "company-1",
|
||||
projectIds: ["project-1", "project-2"],
|
||||
};
|
||||
|
||||
expect(isCeLowTrustBoundaryEditable(boundary)).toBe(false);
|
||||
expect(getSingleLowTrustBoundaryTarget(boundary)).toBeNull();
|
||||
expect(summarizeLowTrustBoundaryTarget(boundary)).toBe("2 boundaries");
|
||||
});
|
||||
|
||||
it("clears the CE boundary without removing non-scope fields", () => {
|
||||
const permissions = clearSingleLowTrustBoundaryTarget({
|
||||
trustPreset: "low_trust_review",
|
||||
authorizationPolicy: {
|
||||
trustBoundary: {
|
||||
mode: "low_trust_review",
|
||||
companyId: "company-1",
|
||||
issueIds: ["issue-1"],
|
||||
allowedSecretBindingIds: ["binding-1"],
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
expect(permissions.authorizationPolicy?.trustBoundary).toEqual({
|
||||
mode: "low_trust_review",
|
||||
companyId: "company-1",
|
||||
allowedSecretBindingIds: ["binding-1"],
|
||||
});
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,177 @@
|
||||
import {
|
||||
DEFAULT_TRUST_PRESET,
|
||||
LOW_TRUST_REVIEW_PRESET,
|
||||
LOW_TRUST_REVIEW_PRESET_VERSION,
|
||||
LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION,
|
||||
type AgentPermissions,
|
||||
type LowTrustBoundary,
|
||||
type SourceTrustMetadata,
|
||||
type TrustAuthorizationPolicy,
|
||||
type TrustPreset,
|
||||
} from "@paperclipai/shared";
|
||||
|
||||
export type LowTrustBoundaryTarget =
|
||||
| { type: "project"; id: string }
|
||||
| { type: "root_issue"; id: string }
|
||||
| { type: "issue"; id: string };
|
||||
|
||||
export const TRUST_PRESET_LABELS: Record<TrustPreset, string> = {
|
||||
standard: "Standard",
|
||||
low_trust_review: "Low-trust review",
|
||||
};
|
||||
|
||||
export const TRUST_PRESET_DESCRIPTIONS: Record<TrustPreset, string> = {
|
||||
standard: "Company-visible collaboration. This is the default for normal work.",
|
||||
low_trust_review:
|
||||
"Contained for hostile or untrusted input. Narrow Paperclip API, quarantined output. Use for PR review and external-content triage.",
|
||||
};
|
||||
|
||||
export function getTrustPreset(permissions: Partial<AgentPermissions> | null | undefined): TrustPreset {
|
||||
return permissions?.trustPreset === LOW_TRUST_REVIEW_PRESET ? LOW_TRUST_REVIEW_PRESET : DEFAULT_TRUST_PRESET;
|
||||
}
|
||||
|
||||
export function buildLowTrustReviewPolicy(
|
||||
existing: TrustAuthorizationPolicy | null | undefined,
|
||||
): TrustAuthorizationPolicy {
|
||||
return {
|
||||
...(existing ?? {}),
|
||||
trustPreset: LOW_TRUST_REVIEW_PRESET,
|
||||
reviewPreset: {
|
||||
id: LOW_TRUST_REVIEW_PRESET,
|
||||
version: LOW_TRUST_REVIEW_PRESET_VERSION,
|
||||
rawOutputDisposition: LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
export function buildPermissionsForTrustPreset(
|
||||
permissions: Partial<AgentPermissions> | null | undefined,
|
||||
preset: TrustPreset,
|
||||
): Partial<AgentPermissions> {
|
||||
const current = permissions ?? {};
|
||||
if (preset === LOW_TRUST_REVIEW_PRESET) {
|
||||
return {
|
||||
...current,
|
||||
trustPreset: LOW_TRUST_REVIEW_PRESET,
|
||||
authorizationPolicy: buildLowTrustReviewPolicy(current.authorizationPolicy),
|
||||
};
|
||||
}
|
||||
|
||||
const nextPolicy = { ...(current.authorizationPolicy ?? {}) } as TrustAuthorizationPolicy;
|
||||
delete nextPolicy.trustPreset;
|
||||
delete nextPolicy.reviewPreset;
|
||||
delete nextPolicy.trustBoundary;
|
||||
|
||||
return {
|
||||
...current,
|
||||
trustPreset: DEFAULT_TRUST_PRESET,
|
||||
...(Object.keys(nextPolicy).length > 0
|
||||
? { authorizationPolicy: nextPolicy }
|
||||
: { authorizationPolicy: undefined }),
|
||||
};
|
||||
}
|
||||
|
||||
export function getLowTrustBoundary(
|
||||
permissions: Partial<AgentPermissions> | null | undefined,
|
||||
): LowTrustBoundary | null {
|
||||
const boundary = permissions?.authorizationPolicy?.trustBoundary;
|
||||
return boundary?.mode === LOW_TRUST_REVIEW_PRESET ? boundary : null;
|
||||
}
|
||||
|
||||
function countBoundaryTargets(boundary: LowTrustBoundary | null | undefined) {
|
||||
return (
|
||||
(boundary?.projectIds?.length ?? 0) +
|
||||
(boundary?.rootIssueId ? 1 : 0) +
|
||||
(boundary?.issueIds?.length ?? 0)
|
||||
);
|
||||
}
|
||||
|
||||
export function getSingleLowTrustBoundaryTarget(
|
||||
boundary: LowTrustBoundary | null | undefined,
|
||||
): LowTrustBoundaryTarget | null {
|
||||
if (!boundary || countBoundaryTargets(boundary) !== 1) return null;
|
||||
const projectId = boundary.projectIds?.[0];
|
||||
if (projectId) return { type: "project", id: projectId };
|
||||
if (boundary.rootIssueId) return { type: "root_issue", id: boundary.rootIssueId };
|
||||
const issueId = boundary.issueIds?.[0];
|
||||
if (issueId) return { type: "issue", id: issueId };
|
||||
return null;
|
||||
}
|
||||
|
||||
export function isCeLowTrustBoundaryEditable(boundary: LowTrustBoundary | null | undefined) {
|
||||
return countBoundaryTargets(boundary) <= 1;
|
||||
}
|
||||
|
||||
export function setSingleLowTrustBoundaryTarget(
|
||||
permissions: Partial<AgentPermissions> | null | undefined,
|
||||
companyId: string,
|
||||
target: LowTrustBoundaryTarget,
|
||||
): Partial<AgentPermissions> {
|
||||
const current = buildPermissionsForTrustPreset(permissions, LOW_TRUST_REVIEW_PRESET);
|
||||
const currentPolicy = current.authorizationPolicy ?? {};
|
||||
const existingBoundary = currentPolicy.trustBoundary ?? { mode: LOW_TRUST_REVIEW_PRESET };
|
||||
const { projectIds: _projectIds, rootIssueId: _rootIssueId, issueIds: _issueIds, ...nonScopeBoundary } = existingBoundary;
|
||||
const trustBoundary: LowTrustBoundary = {
|
||||
...nonScopeBoundary,
|
||||
mode: LOW_TRUST_REVIEW_PRESET,
|
||||
companyId,
|
||||
...(target.type === "project" ? { projectIds: [target.id] } : {}),
|
||||
...(target.type === "root_issue" ? { rootIssueId: target.id } : {}),
|
||||
...(target.type === "issue" ? { issueIds: [target.id] } : {}),
|
||||
};
|
||||
|
||||
return {
|
||||
...current,
|
||||
authorizationPolicy: {
|
||||
...currentPolicy,
|
||||
trustPreset: LOW_TRUST_REVIEW_PRESET,
|
||||
reviewPreset: {
|
||||
id: LOW_TRUST_REVIEW_PRESET,
|
||||
version: LOW_TRUST_REVIEW_PRESET_VERSION,
|
||||
rawOutputDisposition: LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION,
|
||||
},
|
||||
trustBoundary,
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
export function clearSingleLowTrustBoundaryTarget(
|
||||
permissions: Partial<AgentPermissions> | null | undefined,
|
||||
): Partial<AgentPermissions> {
|
||||
const current = buildPermissionsForTrustPreset(permissions, LOW_TRUST_REVIEW_PRESET);
|
||||
const currentPolicy = current.authorizationPolicy ?? {};
|
||||
const boundary = currentPolicy.trustBoundary;
|
||||
if (!boundary) return current;
|
||||
const { projectIds: _projectIds, rootIssueId: _rootIssueId, issueIds: _issueIds, ...nonScopeBoundary } = boundary;
|
||||
return {
|
||||
...current,
|
||||
authorizationPolicy: {
|
||||
...currentPolicy,
|
||||
trustBoundary: {
|
||||
...nonScopeBoundary,
|
||||
mode: LOW_TRUST_REVIEW_PRESET,
|
||||
},
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
export function summarizeLowTrustBoundaryTarget(
|
||||
boundary: LowTrustBoundary | null | undefined,
|
||||
) {
|
||||
const target = getSingleLowTrustBoundaryTarget(boundary);
|
||||
if (target?.type === "project") return `Project ${target.id.slice(0, 8)}`;
|
||||
if (target?.type === "root_issue") return `Root issue ${target.id.slice(0, 8)}`;
|
||||
if (target?.type === "issue") return `Issue ${target.id.slice(0, 8)}`;
|
||||
if (!boundary || countBoundaryTargets(boundary) === 0) return "No boundary selected";
|
||||
return `${countBoundaryTargets(boundary)} boundaries`;
|
||||
}
|
||||
|
||||
export function lowTrustBoundaryHasScope(boundary: LowTrustBoundary | null | undefined) {
|
||||
return countBoundaryTargets(boundary) > 0;
|
||||
}
|
||||
|
||||
export function sourceTrustLabel(sourceTrust: SourceTrustMetadata | null | undefined) {
|
||||
if (!sourceTrust || sourceTrust.preset !== LOW_TRUST_REVIEW_PRESET) return null;
|
||||
if (sourceTrust.disposition === "promoted") return "Promoted from low-trust";
|
||||
return "Low-trust source";
|
||||
}
|
||||
Reference in New Issue
Block a user