[senamakel]

Summary

Migrates OpenHuman security decisions and enforcement to the TinySecurity native module. The host keeps its adapters, approvals, sandbox composition and execution lifecycle; authorization, redaction, egress and audit decisions come from TinySecurity. When the module is unavailable, untrusted or unable to answer, the host fails closed.

This is a substantial but incomplete part of OpenHuman #7328. It does not close the epic.

Current state

The latest branch head includes the OpenHuman security-bus integration and its merged mainline updates. TinySecurity is pinned to its published v0.17.1 release. TinyComputer PR #158 is merged to main at 02f9aacab0039791c141812d166ae688468a3b53; it adds a real Chromium exact-socket pinning test.

The PR remains a draft while owner-module changes and host acceptance are unfinished. TinyBox still needs its canonical release/checksum pin, TinyWallet PR #115 has not merged, and TinyComputer #111 still needs DNS-rebinding and native process/network confinement evidence. The host fixture loads the real TinyComputer cdylib beside TinySecurity and proves Chromium navigation to a loopback listener is denied before the listener receives a connection. This is useful private-address evidence, but it does not satisfy the remaining #111 acceptance.

Validation

• OpenHuman push preflight passed formatting, app lint, TypeScript compile, Rust Clippy and UI token checks.
• The focused native browser-egress fixture passed both the TinySecurity callback test and the real TinyComputer plus Chromium loopback-denial test.
• The focused Rust security audit tests passed (8/8).
• The full scripts suite has known unrelated failures in module-pin attestations and mock cron routes in this checkout; that run is not claimed as passing.

The PR intentionally has no closing keyword for #7328 because the epic remains incomplete.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[senamakel]

TinySecurity is now vendored, and the filesystem validators route through immutable native policy scopes under security-module. The latest OpenHuman head is 16b44cf387; upstream scope implementation is in tinyhumansai/tinysecurity#3 at 5e90937. Earlier TinySecurity #2 and TinyBox #28 prerequisites have merged.

Fresh verification: 144 upstream Linux tests plus a compile-fail API regression, Clippy, native admission verification and every source file above 90% coverage pass. An independent host verifier passed 13 adapter/config/native tests, five translation tests and the public missing-module regression. The real native fixture also passes from Cargo’s crate working directory, with p99 0.571 ms against the 50 ms budget. Dependency, forwarding and layout checks pass. The encrypted RPC fixture, 158 hosted tests, all three embed integration targets and all 2,427 storage-domain tests pass. The final scope-constructor patch also passes the host’s real-loader fixture at p99 0.740 ms.

The release-URL parser regression is fixed. All six published-artifact staging jobs now correctly fail on TinySecurity’s absent release URL. This remains a dependency draft until the upstream change merges and releases, its published tag and all 11 checksum entries are pinned, and positive public-validator parity plus the three-OS released-artifact matrix pass. Locally hashed test fixtures do not populate production pins. This PR implements filesystem migration preparation; the remaining phases of #7328 are still open.

Hosted candidate-source three-OS native jobs are still running. Markdown CI encountered 205 GitHub HTTP 503 responses; the final push triggers another run. CodeRabbit skipped the draft OpenHuman PR and rate-limited upstream, so its status is not evidence of a completed review.

Final follow-up native checks reject unresolved paths, preserve directory reads while rejecting filename-less parent writes, normalize Windows trailing-dot/space denial aliases, and fail closed for unresolved grant roots. Native 144-test workspace, compile-fail API, Clippy, coverage and rebuilt host fixture pass.

Windows follow-up also rejects drive-relative/rooted ambiguous inputs before action-directory joining and normalizes alternate-data-stream denial aliases without broadening grants. Native Windows regressions are in the upstream matrix; Unix colon filenames remain valid. The rebuilt module passes the OpenHuman loader fixture.

Final metadata checks treat only NotFound as a prospective target. The latest upstream snapshot has zero unresolved threads; four historical changes-requested reviews await re-review, with no dismissals. All local verification passes; hosted matrices and published-release pins remain outstanding.

[senamakel]

Note for anyone continuing this branch: with security-module on by default, tests must run the native path check that ships. Twice now (dd298be, cc672c4) path_checks.rs was gated on cfg(any(test, not(feature = "security-module"))) so tests compiled the legacy evaluator instead; both are reverted (bb9ce83, d3301ed). All 217 security::policy tests pass against the native code; denied_outside_workspace in policy_trusted_roots_tests.rs accepts the module's uniform policy-blocked denial. Don't gate production code on cfg(test) to match legacy error text.

[senamakel]

tinysecurity follow-ups for the four blockers are merged and released.

• PR: Scoped policy follow-ups: audited members, cacheability, forbidden paths, command scope widening tinysecurity#11 (merge 45971412b1ec72a3b27335ab1bc23056edb8d7d0)
• Release: v0.5.0 (checksum.toml published), bus contract 1.13

Per item:

1. Required audit: new members EvaluateScopedAudited (names::methods::EVALUATE_SCOPED_AUDITED) and CheckScopedAudited (CHECK_SCOPED_AUDITED). Requests: EvaluateScopedAuditedRequest = AuditedRequest2<ScopedEvaluateRequest>, CheckScopedAuditedRequest = AuditedRequest2<ScopedCheckRequest>. Responses: EvaluateScopedAuditedResponse = AuditedResponse2<ScopedDecision>, CheckScopedAuditedResponse = AuditedResponse2<ScopedCheckResponse>. Same semantics as *Audited2 (audit.generation must equal the module generation; lost or stale audit denies; the audit row omits the PolicyId). Use these instead of EvaluateScoped/CheckScoped when audit is required.
2. Cacheable: the unscoped engine never sets cacheable, so scoped now defines its own rule. LocalDiagnostic and Path checks and tool-rule denials are cacheable. Command, policy-change and unknown checks, foreign or retired callers, and all audited members are not. A call is cacheable only if every check is. Cache key = full ScopedDecision.fingerprint + policy_generation + module generation. See MODULE.md and docs/specs/scoped-policies.md.
3. forbidden_paths: you can send the defaults now. ~ expands against the path scope home_dir (else the command scope home_dir; none means invalid_arguments). Relative entries resolve against policy.action_dir. Floor entries are dropped as no-ops. Empty, NUL, .. and ~user entries are rejected with invalid_arguments.
4. command_policy_id: changing only the id is no longer a widening. It is one only when the new scope grants more (autonomy, budget, allowlist, context, approvals, enforcement), and the Widening subject names what grew. The command_ledger subject is gone.

[senamakel]

Finding while checking phase 8 (keyring consent through the module), for the remaining-work list:

modules/security_crypto.rs::handle_keyring_consent answers the module's KeyringConsent2 callback with keyring_consent::policy::check_secret_access(). That function returns Proceed whenever the host's secret store is available (OS keyring, or a storage backend), before it ever looks at the recorded consent. So the answer describes the host's backend, not the backend the module is about to use. With CryptoConfig2.keyring set to the module's encrypted-file backend, a user who recorded "declined" still gets the secret written to the module's encrypted file whenever the host's OS keyring probes as available.

Repro: restore the case removed in 06710b2 (declined consent, then keyring_set through the native fixture) and run it with OPENHUMAN_TEST_SECURITY_RELEASE_HOST=ubuntu-24.04-x86_64 cargo test -p openhuman --lib -- --ignored declined_keyring against v0.7.0: the store succeeds. That is why the case was dropped; I've not re-added it because it fails.

Not live yet: production module_config doesn't set CryptoConfig2, so no caller goes through the module keyring today. It has to be fixed when that wiring lands (phase 8, remaining item 1). The consent answer should be derived from the requested backend in KeyringConsentRequest2 (an encrypted-file store needs local_encrypted consent; declined refuses it), and the end-to-end declined test should come back as the regression test.

[senamakel]

CI follow-up correction (2026-10-21): TinySecurity #39 rerun 39664578072 has now completed successfully, including Rust (windows-latest). The earlier Windows failure did not reproduce on rerun; TinySecurity #39 is approved, clean, and all reported checks pass. It remains open pending its owner merge. OpenHuman run 39675920174 is still running: Ubuntu native policy passed; macOS, Windows, and release latency remain in progress.

[senamakel]

Windows native-policy follow-up (2026-10-21): run 39675920174 showed two assertions incorrectly applying POSIX heredoc semantics to the CMD policy dialect. The POSIX characterization now runs on Unix; Windows has an explicit credential-floor control for POSIX-shaped input. That run also overflowed the small Windows test thread in production_client_gates_shell_and_network_on_the_released_archive; the integration test now runs on an explicit 8 MiB thread. These changes are on head 875105e. Local no-default-feature test target compilation passed, and the voice live-harness regression suite passed 9/9. The fresh Windows native result is pending in run 39680259911; the older run 39675920174 remains live for macOS and release latency.