From a8f45b32d1c4870b99004662b1f84e89bc8d556f Mon Sep 17 00:00:00 2001 From: Natoshi-moto Date: Sat, 25 Jul 2026 08:52:34 +0100 Subject: [PATCH 1/8] Record T-01 reconfirmation receipts on fix branch Carries forward Grok's 2026-07-25 CARD-04 re-run (session 3) and the Fable fix-draft handoff so the evidence this fix responds to travels with the fix itself. status_authority: NONE --- ...NDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md | 345 ++++++++++++++++++ .../BREAK_SESSION_20260725/CARD-04.md | 80 ++++ .../BREAK_SESSION_20260725/CARD-RESULTS.md | 26 ++ .../receipts/BREAK_SESSION_20260725/NEXT.md | 36 ++ .../BREAK_SESSION_20260725/SESSION.md | 85 +++++ .../BREAK_SESSION_20260725/card04_raw.json | 71 ++++ 6 files changed, 643 insertions(+) create mode 100644 operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md create mode 100644 operations/receipts/BREAK_SESSION_20260725/CARD-04.md create mode 100644 operations/receipts/BREAK_SESSION_20260725/CARD-RESULTS.md create mode 100644 operations/receipts/BREAK_SESSION_20260725/NEXT.md create mode 100644 operations/receipts/BREAK_SESSION_20260725/SESSION.md create mode 100644 operations/receipts/BREAK_SESSION_20260725/card04_raw.json diff --git a/operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md b/operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md new file mode 100644 index 0000000..ed18494 --- /dev/null +++ b/operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md @@ -0,0 +1,345 @@ +# Can the Agent chat window (iframe) read or write Noted's browser storage **without** going through the bridge? + +**Document kind:** report + Fable audit/fix brief · **draft for ChatGPT check** +**status_authority:** `NONE` — proposal / working draft until operator merges +**Date filed:** 2026-07-25 +**Filed by seat:** xAI Grok +**For seat (implement/audit):** Fable (Claude Code / Claude family) +**For seat (check/review):** ChatGPT +**Operator:** human, non-coder — Ring-0 only; one decision at a time +**Repo:** `https://github.com/Natoshi-moto/Lab` · local path often `/home/anon/Lab` +**Tracker:** https://github.com/Natoshi-moto/Lab/issues/63 (ORCH-001 / BREAK) +**Threat ID:** **T-01** · Gate: **G-01** · Probe cards: **CARD-04**, ODS-SEC-001/002 + +> **One-line answer (today):** **Yes.** On current `main`, the Agent iframe can read and write host storage directly. That is a **FAIL** against the safe invariant. Two independent-date EXECUTED probes agree. This is **not** a security certificate and **not** independent multi-party audit just because two model families ran probes. + +--- + +## 0) Who should do what with this file + +| Audience | Job | +|----------|-----| +| **Operator** | Read §1–§2 in plain English. Decide: park, authorize Fable fix, or only ChatGPT check first. | +| **Fable** | Audit the claim, attack any weak evidence, then (only if operator says `AUTHORIZE_FIX: T-01`) design + implement the smallest honest fix and re-run the same probe. | +| **ChatGPT** | Check this draft for: false certainty, missing steps, scope creep, unearned “fixed” language, wrong file paths, and whether the re-probe bar is real. Do **not** implement code unless operator separately assigns you. | + +### Operator paste packet (copy whole block) + +```text +Report title: +Can the Agent chat window (iframe) read or write Noted's browser storage **without** going through the bridge? + +File: +operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_FIX_DRAFT_FOR_CHATGPT_CHECK.md + +Seat A — Fable: audit this report; if GO, propose minimal T-01 fix; do not merge without operator. +Seat B — ChatGPT: check this draft only (accuracy, honesty, re-probe bar). No product code unless separately authorized. + +status_authority: NONE +Synthetic only. No real keys or notes. +``` + +--- + +## 1) Plain English (for the operator) + +### The question + +Noted shows the Agent as a chat panel. That panel is a **web page inside a box** (an iframe). +Noted also has a **door** (the “bridge”) for approved messages between host and Agent. + +The security question is: + +> If bad or compromised code runs **inside** the Agent box, can it still open host notes/storage **without** using that door? + +### The answer on today’s code + +**Yes, it can.** The box is painted as “sandboxed,” but two settings cancel the protection: + +1. The Agent page is loaded from the **same website address** as Noted (relative path `./nexus/...`). +2. The sandbox includes **`allow-same-origin`**, which gives the box its real website identity back. + +So parent and child share one browser storage bucket. The bridge is optional for theft; storage is already co-tenant. + +### What “FAIL” means here + +- **FAIL** = the **safe** rule is broken (“Agent cannot reach host storage”). +- Finding a hole is **honest progress**, not a product launch. +- **No fix is authorized** by BREAK alone. Fix only after you say so. + +### What we are *not* saying + +- That the product is hopeless forever +- That any AI “certified” security +- That T-02 (CDN) or T-03 (proxy) are fixed (they are still open amplifiers) +- That removing `allow-same-origin` is free (Agent may lose its own storage unless redesigned) + +--- + +## 2) Verdict table + +| Item | Value | +|------|--------| +| Safe invariant | Agent iframe **cannot** reach host `localStorage` / `IndexedDB` without the bridge | +| Observed | Agent iframe **can** read + write host storage with **no** bridge use | +| Result | **FAIL** | +| Evidence labels | **EXECUTED** (live probe) + **SOURCE_TRACED** (sandbox + src) | +| Severity | Highest on Wave A (T-01 enables worse outcomes if iframe JS is hostile) | +| Gate | **G-01 RED** until ODS-SEC-001/002 pass on shipped build or waiver | +| Fix authorized? | **No** unless operator issues `AUTHORIZE_FIX: T-01` | + +--- + +## 3) Evidence package (load-bearing) + +### 3.1 SOURCE_TRACED — mechanism on current main + +**SHA (session 3):** `46498a96c709a96e86297c09abe0e65efb1100f8` + +| Fact | Location | +|------|----------| +| Agent src same-origin relative | `products/noted-host/src/studios/nexusAgent/NexusAgentStudio.tsx:13` — `NEXUS_AGENT_SRC = './nexus/nexus-agent-v0.14-scrubbed.html'` | +| iframe uses that src | same file ~L114 `src={NEXUS_AGENT_SRC}` | +| sandbox includes `allow-same-origin` | same file L125: `sandbox="allow-scripts allow-forms allow-modals allow-popups allow-downloads allow-same-origin"` | +| Bridge only filters postMessage | L31–33: `event.source !== iframeRef.current?.contentWindow` + shape check — **does not** block `window.parent.localStorage` | + +**Why this is enough for “without the bridge”:** +Any code in the iframe that runs `window.parent.localStorage.*` or `window.parent.indexedDB.open(...)` never touches `nexusHostBridge.ts`. + +### 3.2 EXECUTED — session 2 (first live FAIL) + +| Field | Value | +|-------|--------| +| Receipt | `operations/receipts/BREAK_SESSION_20260722/CARD-04.md` | +| Seat / family | Claude Opus 4.8 · **Anthropic** | +| Date | 2026-07-22 | +| main SHA | `5070688faee289524990a9b756d956ba651d5c54` | +| Method | Playwright clean context; synthetic canaries; probe inside iframe | +| Observed | Read parent canary; enumerate 32 LS keys; write host key; open `nexus-kernel` / `kv`; crypto key material strings readable by name | + +### 3.3 EXECUTED — session 3 (reconfirm on newer main) + +| Field | Value | +|-------|--------| +| Receipt | `operations/receipts/BREAK_SESSION_20260725/CARD-04.md` | +| Raw JSON | `operations/receipts/BREAK_SESSION_20260725/card04_raw.json` | +| Seat / family | xAI Grok · **xAI** | +| Date | 2026-07-25 ~07:36 UTC | +| main SHA | `46498a96c709a96e86297c09abe0e65efb1100f8` | +| Method | Playwright headless Chromium; clean context; synthetic only; Vite `http://127.0.0.1:5174` | +| Observed | Same class of FAIL (see JSON excerpt below) | + +```json +{ + "sandbox_attr": "allow-scripts allow-forms allow-modals allow-popups allow-downloads allow-same-origin", + "iframe_src": "./nexus/nexus-agent-v0.14-scrubbed.html", + "frame_origin": "http://127.0.0.1:5174", + "parent_origin": "http://127.0.0.1:5174", + "parent_secret": "SYNTHETIC-PARENT-SECRET-DO-NOT-USE-20260725", + "parent_ls_keys_count": 32, + "parent_write": "SUCCEEDED", + "host_readback_of_iframe_write": "IFRAME-WAS-HERE-20260725", + "parent_idb_databases": ["nexus-kernel", "verse-studio"], + "parent_idb_open": { "ok": true, "stores": ["kv"] }, + "result": "FAIL" +} +``` + +Keys enumerated from the child included `nx:crypto:keypair` and `nx:crypto:meta` (names/presence; full secret dumps avoided). + +### 3.4 Independence honesty (mandatory for ChatGPT + Fable) + +| Claim | Honest status | +|-------|----------------| +| Two dates, two SHAs | **Yes** — Jul 22 and Jul 25; code still broken after governance merges | +| Two model families | **Yes** — Anthropic then xAI | +| Independent third-party lab audit | **No** — same operator machine, same product tree, correlated process | +| Multi-AI agreement = proof | **No** — Lab rule; agreement is weak | + +### 3.5 Related open amplifiers (not this report’s fix scope unless operator expands) + +| ID | Status (SOURCE_TRACED on same main) | +|----|-------------------------------------| +| T-02 unpinned CDN | `cdn.tailwindcss.com` in Agent HTML (no SRI) | +| T-03 default proxy | `DEFAULT_PROXY = https://corsproxy.io/?` | +| CARD-05 postMessage `*` | still in host bridge receipt path | +| CARD-11 plaintext keys | session-2 EXECUTED FAIL (pre-activation) — amplify if T-01 open | +| CARD-12 dist parity | **UNKNOWN** — probes used **dev server**, not production `dist/` | + +--- + +## 4) Canon pointers (read order for Fable / ChatGPT) + +1. This file +2. `operations/receipts/BREAK_SESSION_20260725/CARD-04.md` + `card04_raw.json` +3. `operations/receipts/BREAK_SESSION_20260722/CARD-04.md` +4. `operations/break-prep/ORCH_001_BREAK_RUNBOOK.md` (CARD-04 steps) +5. `operations/proposals/NOTED_SOVEREIGNTY_ASSAULT_001/THREAT_MODEL.md` §T-01 +6. `operations/proposals/NOTED_SOVEREIGNTY_ASSAULT_001/ODS_SECURITY_CASES.md` (ODS-SEC-001/002) +7. `operations/proposals/NOTED_SOVEREIGNTY_ASSAULT_001/TENSION_MAP.md` (options A/B/C) +8. `operations/proposals/NOTED_STOP_THE_LINE_001/HARD_GATES.md` §G-01 +9. `products/noted-host/src/studios/nexusAgent/NexusAgentStudio.tsx` +10. `products/noted-host/src/bridges/nexusHostBridge.ts` (what the bridge *does* protect) +11. `WHY_NOT_TO_TRUST_THIS_PROJECT.md` + +--- + +## 5) Instructions for **Fable** (audit → optional fix) + +### 5.1 Always (audit), even without fix authorization + +1. Re-read this report and both CARD-04 receipts. +2. On clean `main`, re-verify SOURCE_TRACED lines (file may have moved; quote new L#). +3. Re-run **one** synthetic CARD-04 / ODS-SEC-001 style probe if tooling allows; else mark `UNKNOWN` with reason. +4. Attack **this report**: + - Did Grok/Claude overclaim? + - Is dev-server-only a material caveat? + - Could a different route embed Agent without `allow-same-origin`? + - Does standalone “Open tab” / pop-out change the threat? +5. Write response under: + + `operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_FABLE_RESPONSE.md` + + Include: confirm / partial / reject, residual risks, recommended option (A/B/C or hybrid), **no soft-pedal**. + +### 5.2 Only if operator pastes authorization + +```text +AUTHORIZE_FIX: T-01 +SEAT: Fable +SCOPE: restore storage boundary between host and Agent iframe +REPROBE: CARD-04 / ODS-SEC-001 and ODS-SEC-002 must FAIL→PASS (or product removes embed) +NONGOALS: T-02 CDN, T-03 proxy, CARD-11 crypto redesign, Phase 3 broker, real-money stories +``` + +Then Fable may implement a **minimal** path. Preferred menu (from tension map — pick one, do not mix silently): + +| Option | Mechanism | Pros | Cons | +|--------|-----------|------|------| +| **C (preferred for T-01)** | Remove `allow-same-origin` **or** serve Agent **cross-origin** so parent storage is unreachable | Directly kills T-01 storage co-tenancy | Agent may lose its own LS/IDB unless redesigned (e.g. bridge-mediated storage, opaque origin + explicit host API) | +| **Embed removal** | Stop embedding Agent; open only as separate origin/tab with loud non-claims | Strong separation | UX change; still need policy for keys/notes | +| **A (disclose only)** | No code fix; banner + docs that boundary does not exist | Honest | G-01 stays RED; no “safe journal” claims | + +**Hard rules for any fix PR:** + +- Synthetic re-probe **before** claiming green +- Receipt folder: `operations/receipts/T01_FIX_/` +- Evidence labels mandatory +- Do not claim G-01 GREEN without ODS-SEC-001 **and** ODS-SEC-002 on the **shipped** path you care about (dev and/or build — state which) +- Do not “fix” by hiding the iframe test; do not rename keys; no real keys +- `status_authority: NONE` until operator merges +- Prefer branch: `fable/t01-storage-boundary-001` + +### 5.3 Suggested minimal technical sketch (not mandatory design) + +Fable should validate and improve this sketch rather than copy blindly: + +1. **Drop `allow-same-origin`** from the studio iframe sandbox **if** Agent can run without parent storage; **or** +2. Serve Agent from a **null/opaque or distinct origin** (e.g. blob/srcdoc only if policy-safe; or dedicated origin path) so `window.parent.localStorage` throws; **and** +3. Keep **all** host mutations on the **bridge** (`postMessage` + approval) for notes/prompts; +4. For Agent-private state (sessions, keys): either + - accept loss until a deliberate storage API is designed, or + - provide a **narrow, audited** host-mediated storage channel (not free parent access); +5. Add **automated** ODS-SEC-001/002 (Playwright) so G-01 cannot rot; +6. Document that T-02/T-03 remain open amplifiers until separate work. + +--- + +## 6) Instructions for **ChatGPT** (check this draft) + +You are the **checker**, not the implementer (unless operator reassigns). + +### 6.1 Check list (answer each as PASS / FAIL / UNABLE_TO_VERIFY) + +| # | Check | +|---|--------| +| C1 | Title matches the actual claim tested | +| C2 | “Without the bridge” is evidenced (probe did not use postMessage for storage) | +| C3 | File paths and sandbox string still match repo (or note drift) | +| C4 | Session-2 and session-3 receipts exist and agree on FAIL class | +| C5 | Independence claims are not overstated | +| C6 | Dev-server vs `dist` caveat is explicit | +| C7 | Fix menu does not smuggle T-02/T-03 as “done” if only T-01 is fixed | +| C8 | Operator-facing language is plain enough for a non-coder | +| C9 | Forbidden work (real keys, third-party attacks, silent merge) is clear | +| C10 | Re-probe bar for “fixed” is falsifiable (ODS-SEC-001/002 or equivalent) | + +### 6.2 ChatGPT response path + +Write: + +`operations/handoffs/T01_IFRAME_STORAGE_BOUNDARY_CHATGPT_CHECK.md` + +Structure: + +```text +## Verdict on draft +## Checklist C1–C10 +## Errors / soft-pedals found +## Required edits before Fable implements +## Residual risks if operator authorizes Option C +## Non-claims +``` + +### 6.3 ChatGPT must not + +- Call the product secure +- Approve launch language while G-01 RED +- Expand scope into money/tokens/BGEN +- Replace receipts with vibes + +--- + +## 7) Re-probe bar (definition of done for a future fix) + +A future fix may only claim T-01 progress if **all** of the following hold: + +1. **ODS-SEC-001:** From inside Agent frame, parent `localStorage` synthetic canary is **unreachable** (throw or null with no path to value). +2. **ODS-SEC-002:** From inside Agent frame, parent `indexedDB` open/read of host DBs fails closed. +3. Same probes on the **target surface** you claim to ship (state: `vite dev` / `vite preview` / Electron if any). +4. Receipt with label **EXECUTED**, SHA, date, seat, model family. +5. Explicit list of **what still fails** (e.g. T-02/T-03 still open). + +Until then: title answer remains **Yes (FAIL)**. + +--- + +## 8) Operator decisions (pick one) + +| ID | Decision | +|----|----------| +| **D1** | ChatGPT checks this draft only; no code | +| **D2** | Fable audits only; no code | +| **D3** | ChatGPT check **then** Fable audit (recommended before code) | +| **D4** | `AUTHORIZE_FIX: T-01` to Fable after D1 or D3 | +| **D5** | Park — leave FAIL on record; no work | + +Default if silent: **do nothing further** (FAIL stays documented). + +--- + +## 9) Non-claims (tattoo) + +- This report has **no** status authority. +- EXECUTED FAIL ≠ permission to ship a half-fix. +- Bridge window-identity checks (CARD-06) do **not** mitigate T-01 storage co-tenancy. +- Multi-seat agreement is not a lab audit. +- Permanent distrust register still applies: `WHY_NOT_TO_TRUST_THIS_PROJECT.md`. + +--- + +## 10) Continuity block (fill when a seat starts) + +```text +SEAT_NAME: +MODEL_FAMILY: +ROLE: Fable-audit | Fable-fix | ChatGPT-check +MAIN_SHA_AT_START: +DIRTY_TREE: yes/no +DATE_UTC: +AUTHORIZE_FIX_SEEN: yes/no +``` + +--- + +*End of report. Title is the question. Answer today: **yes, without the bridge**. Next move is operator choice D1–D5.* diff --git a/operations/receipts/BREAK_SESSION_20260725/CARD-04.md b/operations/receipts/BREAK_SESSION_20260725/CARD-04.md new file mode 100644 index 0000000..889dcd1 --- /dev/null +++ b/operations/receipts/BREAK_SESSION_20260725/CARD-04.md @@ -0,0 +1,80 @@ +# CARD-04 result — BREAK_SESSION_20260725 (session 3 re-probe) + +- Card: CARD-04 · T-01 same-origin storage reach +- Threat links: T-01 (highest severity on the spine), G-01 +- Seat: xAI Grok — `status_authority: NONE` +- Model family: xAI +- Date/time run (UTC): 2026-07-25 ~07:36 +- main SHA at start: `46498a96c709a96e86297c09abe0e65efb1100f8` (clean tree, on `main`) +- Result: **FAIL** (against the safe invariant "the Agent iframe cannot reach host storage") +- Evidence label: **EXECUTED** (live Playwright probe this session) + **SOURCE_TRACED** (sandbox flag) +- Prior EXECUTED FAIL (session 2, Anthropic, SHA `5070688`): still valid historical receipt; this is a **reconfirmation on new main**, not independent multi-party audit + +## What was tested (layman) + +Can the Agent chat window (iframe) read or write Noted's browser storage **without** going through the bridge? + +## How it was run (synthetic only) + +- Fresh throwaway Playwright Chromium context (empty storage — no real notes/keys). +- Noted host Vite dev server: `http://127.0.0.1:5174`. +- Seeded synthetic parent localStorage canary: + `verse-studio:CARD04-canary-20260725 = "SYNTHETIC-PARENT-SECRET-DO-NOT-USE-20260725"`. +- Navigated to `#/nexus-agent`, took the real Agent iframe content frame, ran probe **inside the iframe**. +- Probe script (throwaway, not product code): `/tmp/break-session-20260725/card04_probe.mjs` +- Raw machine output: `card04_raw.json` in this folder. + +## SOURCE_TRACED preconditions (re-verified at SHA `46498a9`) + +- `products/noted-host/src/studios/nexusAgent/NexusAgentStudio.tsx:125` + `sandbox="allow-scripts allow-forms allow-modals allow-popups allow-downloads allow-same-origin"` +- `NexusAgentStudio.tsx:13` `NEXUS_AGENT_SRC = './nexus/nexus-agent-v0.14-scrubbed.html'` + → relative path = **same origin** as host. +- Same-origin serve + `allow-same-origin` ⇒ sandbox imposes **no origin boundary** for storage. + +## EXECUTED evidence (observed live, from inside the iframe) + +```json +{ + "sandbox_attr": "allow-scripts allow-forms allow-modals allow-popups allow-downloads allow-same-origin", + "iframe_src": "./nexus/nexus-agent-v0.14-scrubbed.html", + "frame_origin": "http://127.0.0.1:5174", + "parent_origin": "http://127.0.0.1:5174", + "parent_secret (synthetic canary, read from child)": "SYNTHETIC-PARENT-SECRET-DO-NOT-USE-20260725", + "parent_ls_keys enumerated from child": 32, + "parent_idb_databases enumerated from child": ["nexus-kernel", "verse-studio"], + "parent_write from child": "SUCCEEDED", + "host readback of iframe write": "IFRAME-WAS-HERE-20260725", + "nexus-kernel object stores from child open": ["kv"] +} +``` + +Key sample from child enumeration included `nx:crypto:keypair` and `nx:crypto:meta` (presence/names only; full key bytes not dumped this session). + +## What this proves (again) + +From inside the Agent iframe, with **no bridge involved**: + +1. **Read** host `localStorage` (synthetic canary). +2. **Enumerate** host localStorage keys (32 keys). +3. **Write** host `localStorage` (host read back `IFRAME-WAS-HERE-20260725`). +4. **Enumerate/open** host IndexedDB (`nexus-kernel` / `verse-studio`, store `kv`). + +T-01 remains the enabling primitive under bridge “if iframe is compromised” caveats. + +## Residual risk + +**High, EXECUTED-confirmed on current main.** Session-2 finding has **not** been closed by the Jul 23–24 governance merges. + +## Non-claims + +- `status_authority: NONE` +- Not independent of prior seats for product truth; this is a **second-date re-run** +- Not a crypto audit (T-07 deferred) +- Dev server only, not `dist/` (CARD-12 still UNKNOWN unless re-run) +- No fix implemented + +## Baseline notes from same session + +- T-06 quarantine check: **PASS** +- `./nexus doctor`: **FAIL** on `node_modules` symlinks/JSON (tooling; separate from T-01) diff --git a/operations/receipts/BREAK_SESSION_20260725/CARD-RESULTS.md b/operations/receipts/BREAK_SESSION_20260725/CARD-RESULTS.md new file mode 100644 index 0000000..acd855b --- /dev/null +++ b/operations/receipts/BREAK_SESSION_20260725/CARD-RESULTS.md @@ -0,0 +1,26 @@ +# Card results — BREAK_SESSION_20260725 + +## CARD-04 · T-01 same-origin storage reach + +- Result: **FAIL** +- Label: **EXECUTED** +- Method: Playwright headless Chromium, clean context, synthetic canaries only +- Dev server: `http://127.0.0.1:5174` +- main SHA: `46498a96c709a96e86297c09abe0e65efb1100f8` +- Summary: iframe read parent canary, wrote host key, opened `nexus-kernel` IDB `kv` +- Detail: `CARD-04.md`, raw: `card04_raw.json` + +## Not re-run this session + +Session 2 receipts still authoritative for: + +| Card | Prior result | +|------|----------------| +| CARD-06 | CONTRADICTED (window-identity ≠ origin isolation) | +| CARD-07 | race / null-target notes | +| CARD-08 | no replay / size limit | +| CARD-09 | forgeable plain receipts | +| CARD-11 | FAIL plaintext provider key pre-activation | +| CARD-13 | CSP absence | + +Re-run only if operator orders it. diff --git a/operations/receipts/BREAK_SESSION_20260725/NEXT.md b/operations/receipts/BREAK_SESSION_20260725/NEXT.md new file mode 100644 index 0000000..b622e9b --- /dev/null +++ b/operations/receipts/BREAK_SESSION_20260725/NEXT.md @@ -0,0 +1,36 @@ +# What’s next after BREAK session 3 + +## Where we are + +- Session 1 easy cards: done (2026-07-22) +- Session 2 hard cards: done; T-01 and CARD-11 **FAIL** on record +- Session 3: **CARD-04 reconfirmed FAIL** on main `46498a9` (2026-07-25) + +## Operator choices (pick one) + +### A — Stop / document only +Merge this receipt folder when you want other seats to see it. No product change. + +### B — Re-probe CARD-11 on current main +Synthetic key only. Confirms plaintext-at-rest still true after recent merges. + +### C — Authorize a fix (separate from BREAK) +BREAK alone does **not** authorize code changes. If you want fixes, say explicitly, e.g.: + +```text +AUTHORIZE_FIX: T-01 +SCOPE: remove allow-same-origin OR cross-origin serve for Agent iframe +REPROBE: CARD-04 after merge +``` + +Similar for T-02 (CDN pin/vendor) or T-03 (kill default corsproxy). + +### Parked unless you say so + +- Money / token / real-value work +- NWC / GITBRAID productization +- Claiming launch readiness while G-01 red + +## Operator one-liner + +**The chat window can still walk around the door. That has not changed on today’s main.** diff --git a/operations/receipts/BREAK_SESSION_20260725/SESSION.md b/operations/receipts/BREAK_SESSION_20260725/SESSION.md new file mode 100644 index 0000000..dc43864 --- /dev/null +++ b/operations/receipts/BREAK_SESSION_20260725/SESSION.md @@ -0,0 +1,85 @@ +# BREAK session 3 — plain-language record + +**Date:** 2026-07-25 +**Tracking:** https://github.com/Natoshi-moto/Lab/issues/63 +**Seat:** xAI Grok +**Model family:** xAI (not independent of prior xAI seats; **not** independent of session-2 Anthropic receipts either) +**status_authority:** `NONE` +**Research only / synthetic-safe checks** +**main SHA at start:** `46498a96c709a96e86297c09abe0e65efb1100f8` (clean tree, on `main`) + +--- + +## What this session was + +Operator said **BREAK**. Sessions 1 and 2 already lived on `main` with hard FAILs. +This session re-checked baseline on current `main` and **re-executed CARD-04 (T-01)** +to see whether the storage hole still exists after recent governance merges. + +Not a security certificate. +Not a fix. +Not about real money or attacking other systems. + +--- + +## Continuity fields + +```text +SEAT_NAME: xAI Grok +MODEL_FAMILY: xAI +MAIN_SHA_AT_START: 46498a96c709a96e86297c09abe0e65efb1100f8 +DIRTY_TREE: no (clean main) +DATE_UTC: 2026-07-25T07:34:08Z (session open) +``` + +--- + +## Baseline + +| Check | Result | Notes | +|-------|--------|-------| +| `git pull origin main` | up to date | | +| Runbook + session 1/2 receipts present | OK | | +| `npm run t06:quarantine-check` | **PASS** | v0.12 absent; live target v0.14-scrubbed | +| `./nexus doctor` | **FAIL** | Symlinks + JSON under `products/noted-host/node_modules` — tooling noise, not product security evidence | +| SOURCE_TRACED T-01 sandbox | still `allow-same-origin` + same-origin agent path | `NexusAgentStudio.tsx:13,125` | +| SOURCE_TRACED T-02 CDN | still `cdn.tailwindcss.com` | Agent HTML L27 / L6309 | +| SOURCE_TRACED T-03 proxy | still `DEFAULT_PROXY = corsproxy.io` | Agent HTML L2215+ | +| SOURCE_TRACED CARD-05 | still `postMessage(..., '*')` | `nexusHostBridge.ts` | + +--- + +## Cards run this session + +| Card | Result | Label | +|------|--------|-------| +| CARD-04 · T-01 same-origin storage reach | **FAIL** (reconfirmed) | **EXECUTED** | + +Session-2 cards (04/06/07/08/09/11/13) remain historical EXECUTED evidence under +`operations/receipts/BREAK_SESSION_20260722/`. This session did not re-run them live. + +--- + +## Session outcome in one line + +**Three days later, on a new main tip, the Agent iframe can still read and write host storage.** + +--- + +## Non-claims + +- Product is not certified secure +- FAIL ≠ fix authorized +- Multi-AI agreement ≠ independent proof +- Doctor FAIL on `node_modules` ≠ T-01 evidence (separate tooling issue) +- Dev-server probe only; build/`dist` parity still CARD-12 / UNKNOWN unless separately run + +--- + +## Next (operator chooses) + +1. Stop (honest reds already on record), or +2. Re-run CARD-11 (plaintext key at rest) on current main, or +3. **Separately authorize** a fix task (T-01 / T-02 / T-03) — not implied by BREAK alone + +See `CARD-04.md` in this folder. diff --git a/operations/receipts/BREAK_SESSION_20260725/card04_raw.json b/operations/receipts/BREAK_SESSION_20260725/card04_raw.json new file mode 100644 index 0000000..540c14f --- /dev/null +++ b/operations/receipts/BREAK_SESSION_20260725/card04_raw.json @@ -0,0 +1,71 @@ +{ + "card": "CARD-04", + "session": "BREAK_SESSION_20260725", + "seat": "xAI Grok", + "model_family": "xAI", + "date_utc": "2026-07-25T07:36:54.099Z", + "base_url": "http://127.0.0.1:5174", + "evidence_label": "EXECUTED", + "status_authority": "NONE", + "main_sha": "46498a96c709a96e86297c09abe0e65efb1100f8", + "frame_url": "http://127.0.0.1:5174/nexus/nexus-agent-v0.14-scrubbed.html", + "sandbox_attr": "allow-scripts allow-forms allow-modals allow-popups allow-downloads allow-same-origin", + "iframe_src": "./nexus/nexus-agent-v0.14-scrubbed.html", + "probe": { + "frame_origin": "http://127.0.0.1:5174", + "frame_href": "http://127.0.0.1:5174/nexus/nexus-agent-v0.14-scrubbed.html", + "parent_origin": "http://127.0.0.1:5174", + "parent_secret": "SYNTHETIC-PARENT-SECRET-DO-NOT-USE-20260725", + "parent_ls_keys_count": 32, + "parent_ls_key_sample": [ + "verse-studio:sidebar:collapsed", + "verse-studio:canonical-canvas:seeded", + "nx:modules:drift-monitor:manifest", + "nx:modules:nexus-tag-browser:manifest", + "nx:crypto:meta", + "nx:modules:pipeline-receipt:manifest", + "nx:modules:nexus-palette:manifest", + "nx:ui-mode", + "verse-studio:theme", + "nx:modules:nexus-agent-creator:manifest", + "nx:crypto:keypair", + "nx:modules:nexus-vitals:manifest", + "nx:modules:nexus-onboard-teach:manifest", + "verse-studio:scratch-drawer:height", + "verse-studio:canvas:lastProject", + "verse-studio:CARD04-canary-20260725", + "nx:modules:combo-schema-validator:manifest", + "nx:modules:nexus-crypto:manifest", + "nx:modules:nexus-agent-library:manifest", + "verse-studio:canvas:canonicalProject", + "verse-studio:scratch-drawer:tab", + "nx:modules:nexus-admin-diagnostics:manifest", + "nx:reasoning:stickyOpen", + "nx:modules:nexus-inspector:manifest", + "nx:modules:verification-drilldown:manifest", + "verse-studio:nexus-panel:default-open-applied", + "verse-studio:canvas:positions:seed:project:meridian", + "verse-studio:nexus-panel:open", + "nx:modules:nexus-monitor:manifest", + "verse-studio:canvas:positions:ms022zyi-cxm1cem0", + "nx:modules:nexus-launcher:manifest", + "nx:modules:nexus-evolve-lockdown:manifest" + ], + "parent_write": "SUCCEEDED", + "parent_idb_databases": [ + "nexus-kernel", + "verse-studio" + ], + "parent_idb_open": { + "ok": true, + "stores": [ + "kv" + ] + }, + "errors": [] + }, + "host_readback_of_iframe_write": "IFRAME-WAS-HERE-20260725", + "result": "FAIL", + "safe_invariant": "Agent iframe cannot reach host storage", + "observed": "Agent iframe CAN read and write host storage" +} From d59c15e9a3e084c9d1fbe32d99c7e37842b60dd7 Mon Sep 17 00:00:00 2001 From: Natoshi-moto Date: Sat, 25 Jul 2026 08:58:11 +0100 Subject: [PATCH 2/8] Fix T-01: drop allow-same-origin from Agent iframe sandbox MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Agent iframe was served from a same-origin relative path AND sandboxed with allow-same-origin, so the sandbox provided no real storage boundary: script inside the iframe could read/write the host's localStorage and open its IndexedDB directly, with no bridge involved. EXECUTED-confirmed twice (BREAK_SESSION_20260722 CARD-04, Anthropic; BREAK_SESSION_20260725 CARD-04, xAI). Fix: remove allow-same-origin so the iframe gets an opaque origin. Verified live that this closes the hole (ODS-SEC-001/002, new permanent regression test at scripts/ods-sec-001-t01-storage-boundary.mjs, npm run ods:sec001). This makes the Agent's own storage calls throw too, so four call sites in nexus-agent-v0.14-scrubbed.html that read/wrote localStorage/sessionStorage without a try/catch are now guarded — matching the storage layer's existing degrade-to-memory design instead of crashing. The runAuthGate() sessionStorage recovery check was the critical one: unguarded, it would have failed auth on every boot, not just recovery attempts. Synced products/nexus-blocks' canonical copy to match (README: noted-host serves a byte-identical mirror); registry verify still passes. Verified: existing agent:prompt-smoke and bridge:smoke both pass with zero console/page errors, typecheck clean, new ods:sec001 passes. python3 -m unittest discover -s tests: 189/190 pass, the 1 failure is pre-existing node_modules symlink/JSON tooling noise unrelated to this change (same class already flagged in BREAK_SESSION_20260725). Scope: T-01 storage boundary only. T-02 (unpinned CDN), T-03 (default proxy), CARD-11 (crypto), and the production/dist second-origin question (CARD-12 dist parity) are untouched and remain open. status_authority: NONE — proposal/fix branch, not merged to main. --- .../nexus-agent-v0.14-scrubbed.html | 22 ++-- products/noted-host/package.json | 1 + .../nexus/nexus-agent-v0.14-scrubbed.html | 22 ++-- .../ods-sec-001-t01-storage-boundary.mjs | 114 ++++++++++++++++++ .../studios/nexusAgent/NexusAgentStudio.tsx | 9 +- 5 files changed, 153 insertions(+), 15 deletions(-) create mode 100644 products/noted-host/scripts/ods-sec-001-t01-storage-boundary.mjs diff --git a/products/nexus-blocks/blocks/nexus-agent/nexus-agent-v0.14-scrubbed.html b/products/nexus-blocks/blocks/nexus-agent/nexus-agent-v0.14-scrubbed.html index 65b4556..a5d41a9 100644 --- a/products/nexus-blocks/blocks/nexus-agent/nexus-agent-v0.14-scrubbed.html +++ b/products/nexus-blocks/blocks/nexus-agent/nexus-agent-v0.14-scrubbed.html @@ -990,7 +990,7 @@