feat(security): vendor TinySecurity and migrate filesystem authorization

.github/workflows/ci-full.yml

@@ -127,6 +127,9 @@ jobs:
           touch .env
           touch app/.env
 
+      - name: Exercise attested native security adapter and latency budget
+        shell: bash
+        run: bash scripts/ci/security-native-fixture.sh
       - name: Install checksum-pinned native test modules
         run: |
           # Keep fixtures in a trusted tree and resolve their verified releases

.github/workflows/pr-quality.yml

@@ -62,6 +62,9 @@ jobs:
         id: link-check
         continue-on-error: true
         uses: lycheeverse/lychee-action@v2
+        env:
+          # Use authenticated API checks instead of anonymous GitHub page requests.
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           output: target/link-check/report.md
           # Product Hunt denies GitHub-hosted runners (403) for the translated

.github/workflows/security-browser-egress.yml

@@ -0,0 +1,47 @@
+name: Security Browser Egress (Epic)
+
+on:
+  pull_request:
+    branches: [epic/7328-security-bus]
+    paths:
+      - .github/workflows/security-browser-egress.yml
+      - .gitmodules
+      - vendor/tinysecurity
+      - vendor/tinycomputer
+      - crates/openhuman-core/src/modules/browser_egress_host.rs
+      - crates/openhuman-core/src/modules/browser_egress_host_tests.rs
+      - crates/openhuman-core/src/modules/security_egress.rs
+      - scripts/ci/security-browser-egress-fixture.sh
+      - Cargo.lock
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-browser-egress-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  native-callback-fixture:
+    name: TinySecurity browser callbacks (Linux)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    env:
+      CARGO_BUILD_JOBS: "2"
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install native dependencies
+        run: sudo apt-get update && sudo apt-get install -y libasound2-dev pkg-config
+      - uses: dtolnay/rust-toolchain@1.99.1
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            . -> target
+            vendor/tinysecurity -> vendor/tinysecurity/target
+          key: security-browser-egress-${{ runner.os }}
+      - name: Exercise authenticated host callbacks against TinySecurity
+        shell: bash
+        run: bash scripts/ci/security-browser-egress-fixture.sh

.github/workflows/security-native.yml

@@ -0,0 +1,96 @@
+# Released-artifact integration checks: the fixture loads the published
+# archive through the compiled registry digest (see security-native-fixture.sh).
+name: Security Native
+
+on:
+  pull_request:
+    branches: [main, release]
+    paths:
+      - .github/workflows/security-native.yml
+      - .gitmodules
+      - vendor/tinysecurity
+      - crates/openhuman-core/src/modules/security*.rs
+      - crates/openhuman-core/src/modules/registry/records_security.rs
+      - crates/openhuman-core/src/security/policy/**
+      - scripts/ci/security-native-fixture.sh
+      - Cargo.lock
+  workflow_dispatch: {}
+
+permissions:
+  actions: read
+  contents: read
+
+concurrency:
+  group: security-native-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  native:
+    name: Native policy (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-15, windows-2025]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    env:
+      CARGO_BUILD_JOBS: "2"
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      # The TinyFlows fixture tree contains paths beyond MAX_PATH. Configure
+      # Git before checkout so recursive submodule checkout can create them.
+      - name: Enable long Git paths
+        if: runner.os == 'Windows'
+        run: git config --global core.longpaths true
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install Linux inference prerequisites
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libasound2-dev pkg-config
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: . -> target
+          key: security-native-${{ runner.os }}
+      - name: Exercise attested adapter and latency budget
+        shell: bash
+        run: bash scripts/ci/security-native-fixture.sh
+
+  latency-budget:
+    name: Release latency budget
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    env:
+      CARGO_BUILD_JOBS: "2"
+      GH_TOKEN: ${{ github.token }}
+      OPENHUMAN_SECURITY_PERF_BUDGET: "1"
+      OPENHUMAN_SECURITY_PERF_OUT: ${{ github.workspace }}/target/security-perf.json
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+          submodules: recursive
+      - name: Install Linux inference prerequisites
+        run: sudo apt-get update && sudo apt-get install -y libasound2-dev pkg-config
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: . -> target
+          key: security-native-latency-${{ runner.os }}
+      - name: Fail when native p50/p99 exceed the committed budget
+        shell: bash
+        run: bash scripts/ci/security-native-fixture.sh
+      - name: Record measured latency and calls per turn
+        if: always()
+        shell: bash
+        run: |
+          if [ -f "$OPENHUMAN_SECURITY_PERF_OUT" ]; then
+            cat "$OPENHUMAN_SECURITY_PERF_OUT"
+            { echo '### Native security latency'; echo '```json'; cat "$OPENHUMAN_SECURITY_PERF_OUT"; echo; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
+          fi
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: security-perf
+          path: target/security-perf.json
+          if-no-files-found: ignore

.github/workflows/test-reusable.yml

@@ -373,6 +373,44 @@ jobs:
             hosting::test::released_artifact_serves_providers_and_confidential_local_preparation \
             -- --exact --ignored --test-threads=1
 
+  security-characterization:
+    if: inputs.run_rust_core
+    name: Security characterization (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-15, windows-2025]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    env:
+      CARGO_BUILD_JOBS: "2"
+      CARGO_PROFILE_DEV_DEBUG: line-tables-only
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref }}
+          persist-credentials: false
+          submodules: recursive
+      - name: Install Linux inference test prerequisites
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libasound2-dev pkg-config
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: . -> target
+          key: security-characterization-${{ runner.os }}
+      - name: Pin current security wire and redaction behavior
+        shell: bash
+        run: bash scripts/ci-cancel-aware.sh cargo test -p openhuman-cli --no-default-features --test security_characterization_e2e
+      - name: Exercise private redactors with the shared corpus
+        shell: bash
+        run: bash scripts/ci-cancel-aware.sh cargo test -p openhuman --no-default-features --features inference,web3,modules shared_security -- --nocapture
+      - name: Exercise attested native security adapter and latency budget
+        shell: bash
+        run: bash scripts/ci/security-native-fixture.sh
+      - name: Record existing in-process latency baseline
+        shell: bash
+        run: bash scripts/ci-cancel-aware.sh cargo test -p openhuman-cli --no-default-features --test security_characterization_e2e in_process_policy_latency_baseline -- --nocapture
+
   rust-core-tests-windows:
     if: inputs.run_rust_core
     name: Rust Core Tests (Windows — secrets ACL)

.gitmodules

@@ -60,6 +60,9 @@
 [submodule "vendor/tinymemes"]
 	path = vendor/tinymemes
 	url = https://github.com/tinyhumansai/tinymemes.git
+[submodule "vendor/tinysecurity"]
+	path = vendor/tinysecurity
+	url = https://github.com/tinyhumansai/tinysecurity
 [submodule "vendor/tinystoragedrivers"]
 	path = vendor/tinystoragedrivers
 	url = https://github.com/tinyhumansai/tinystoragedrivers.git

.sdd-approval-task.md

@@ -0,0 +1,24 @@
+# Owner Task7 — durable approvals and exact scoped grants
+Dispatch after controller marks Task6 full review+gates clean. Own vendor/tinysecurity existing security-complete-7328 ONLY, ONE cumulative PR5. Record actual BASE before edits. Read ownerAGENTS, owner security-module spec approvals, HOST .sdd-approval-audit-acceptance.md and Task6 final public V2 contracts/nativefixture. Do not read wholeplan. Not alone preserve checkpoints/others; no nestedworktree/push/newPR/release/rootpins/reset/amend/squash. Controller finalreview/release follows allremainingengines.
+
+New internal tinysecurity-approval crate focused state/store/grants/reply, siblingtests; bus approval.rs promote real implemented contracts keeping reserved strictpayload compatibility via explicit additive V2 shapes/interfaces where required; module actual dispatch/manifest/init/approvalintercept/nativefixture; workspace/internalumbrella/CI. Host normaldeps only tinysecurity-bus, bus serde+thiserror no I/O/runtime/transport/crypto/TinyTools. No hostengine or parkingfuture copiedinto owner. Mutable approvals not cacheable.
+
+Reuse completed Task6 typed exact scoped CAS/load receipt validators plus redactor/audit/trustedpeer gate; implement the bounded authenticated ApprovalStoreClient load/CAS transport now (Task6 module currently has AuditClient only, no implemented store client). Persist pending durably BEFORE RequireApproval; every transition records exact scope/policygeneration/fingerprint/origin and returns only after confirmedCAS/audit phase. Failed callback/timeout/malformed/wrongpeer/wrongreceipt unavailable denies beforeexecution. Timeout indeterminate, retry SAME mutationidentity/reconcile persistedstate, no false rollback/repeatedwrite. No locks across callback await, reentrant Decide and concurrent waits must progress.
+
+Full subject is verified user/workspace/agent ceiling from trusted host init + peer/contextadapter, not invocationJSON human/tenant/tier. Unique brokerconnection != authenticated human. Decide requires explicit trustedhost-authenticated human authority bound to exactowner/pendingrow/currentpolicy/origin. ModelParseReply parses intent ONLY never grants; none/unknown/unverifiedauthority deny. Legacy omitted agent_id processRPC projection remains hostcompatibility at authenticated boundary, never crossagentprivileges insideengine. Changed/disconnected peers cannot replace trustedidentity using wellknownname.
+
+Record stable random requestid, exact ORIGINAL canonical callfingerprint (not redacted equivalent), immutable subject/policyid+generation, tool/class/argsfingerprint/origin/thread/flow/agent, created/expiry ms, lifecycle+attribution+terminaloutcome. Redacted args/summary/source correlation persisted/logged; no original secrets Debug/errors/events. Safe oldrecordimport: preserve history but never revive legacybroad grants lacking exact bindings. Do not advertise fullycomposedPolicyId until Task2; use strict currentimmutable scopes and later mechanicalcomposition hook, never pretend partialscope complete.
+
+State pending→humanapproved/denied/expired/cancelled→execution terminal only for exactapproved action. CAS firstwinner, repeatedidenticaldecide receipt idempotent, conflictingdecision reject, terminalfirstwinner, cannot execute denied/expired/pending or alteredfingerprint. Restart reload durablerows/grants but orphan rows never execute in new hostsession automatically. TTL600default,180copilot/subagent calleronlyshortens; exactboundary denies; injectedclock rollbackfailclosed. Durable scope captured before cancellation to prevent ambienttenantmixing.
+
+Allowonce singleexecutionreservation/consume; alwaysfortool persistent EXACTreviewedtool/class/fingerprint/scope/origin/currentpolicy ceiling; flowgrants exactreviewedfingerprints+flow and policygeneration. No wildcard argument escalation. Bounded preauthorizeflow validation legacy max100tools (typedfingerprints new), duplicategrant idempotent. Policygenerationchanges invalidate affectedgrants, no selfwideningactivation/humanreviewstub. Later Task2 generationactivation consumes actual approvalunderOLDpolicy.
+
+Origin Cron readonly only externaldeny BEFORE ANYshortcut, including auto-all; SaaS uses real authenticatedper-userpromptcallback/no unconditionalbypass, missingprompt denies. Off-default judge nextTask8, do not add fakeRequireApproval without realpendingstore/prompt. Host owns parked futures/cancellation/ApprovalRequested+Decided eventrouting; owner stateTTLlog. Preserve legacy request/source/tool_call_id/agent_id optionalomissions; no publicsession_id; terminallegacy success/failure/aborted explicittranslation to new succeeded/failed/cancelled, not silent serdechange.
+
+TDD actualbehavior RED→GREEN beforefix with logs: pending→decide→executed/rejectedwrongfingerprint, expiry600/180exactboundaries+clockrollback, restart/noorphanexecution, CAS concurrenthuman decisions/idempotence/conflictingreplay/terminalfirstwinner, wrongtenant/agent/origin/policygen grantsdeny, argumentschangeddeny, callbackfailure/malformedreceipt/scope, parsingnotauthority, Cronautoallowcannotbypass, SaaSmissingperuserpromptdeny, reentrantcallback no deadlock, nativecancel/expired eventsprojection. Real loadedcdylib hostcallbacks restart-surviving approvalroundtrip exactpersist/audit receipts; malicioussecondpeer and no-provenance oldhost denies. No thirdpartynet/timingflakes/operatorcredentials.
+
+Sibling *_tests.rs start use super::*; declaration cfg/path; noinline/legacyfilename. Nativefixtureexplicit pipeline no silentlyignoredacceptance. Docs accurate implementedavailability. Selfreview stableatomiccheckpoint then FULL actualBASE..HEAD diff FILE HOST .sdd-evidence/task7-full.diff early for independentSPEC+QUALITY; subsequentfixrefresh entireoriginalrange. ALLfreshfmt/+1.99strictclippy/default+allworkspace/alltargetbuild/+1.88check/-Dwarningdocs/deny/actualperfile90/nativeLinuxworkspace+alternatecwd and realnative3OSCIwiring. Longcommands HOSTscripts/ci-cancel-aware.sh no CARGO_TARGET_DIR/tmpbuildoutput; evidence HOST/OWNER .sdd-evidence nottarget. Exact BASE/HEAD/commands/exits/REDGREENlimitations. RemainingTask8/9/10/2/wholeownerreview+release/hostmigration NOTcompletionclaimed.
+
+Read HOST .sdd-evidence/full-policy-composition-preflight.md exact Task7-specific caveats: existing audited-permission digest hashes [request,decision] and arguments_json is a string, not stable canonical original-call identity. Add separate call-only domain, parse/sort bounded actual argument JSON, preserve significant array/header/shell ordering; include exact verified scope/policygen/origin/thread/flow/execution instance. Do not reuse old digest unchanged or globally dedup identical text. Single-row CAS does not make approval consume plus later policy activation a multi-store transaction; define reconciliation hooks for Task2 exact old-policy activation, no fake atomic promise.
+
+Additional required read: HOST .sdd-evidence/task7-approval-interface-preflight.md exact current callback fingerprint validator requires32hex whereas existing audit digest64hex +decision. Use an explicitly versioned full-digest row or preserve32hex correlation with full cryptographic callbinding inside validated typed row; never silently truncate authority fingerprint. Human authority requires exact host-authenticated decision verification/ticket consumption bound to pendingrequest/scope/gen/origin, not uniquepeer or invocationJSON human field. Store CAS retries must recover original durable mutation receipt even after later row versions, not treat timeout asrollback. Real native persistent-store restart fixture required, current MemoryBus rows alone insufficient.

.sdd-audit-manifest-fix.md

@@ -0,0 +1,5 @@
+# Task6 fresh review batch: native manifest completeness
+Work only /home/enamakel/work/openhuman/worktrees/security-bus-7328/vendor/tinysecurity on existing security-complete-7328. Role tdd-implementer. One cumulative PR5; no new PR/push/release/gitlink changes. You are not alone; preserve all others/checkpoints. No reset/amend/squash. Source ownership begins only after root confirms prior writer release. Record BASE actual HEAD; full Task6 ORIGINAL BASE87d909f6eaaa5500838efc3afc0470052baaff46.
+Read owner AGENTS, HOST .sdd-evidence/task6-review-99f78737.md Important1 and .sdd-approval-audit-acceptance.md binding manifest requirement. Fix complete ONE review batch: exported module manifest omits implemented EvaluateAudited2 and CheckAudited2 although dispatch/names/PolicyInfo advertise them; optional inventory omits implemented AuditSink2 dependency. Advertise only implemented callback forwarding, not unfinished approval/store/prompt capabilities. Verify exact contract name/version/min-version against actual SDK metadata and existing implemented callbacks/forwarding interface.
+Write genuine regression first: inspect actual loaded native artifact manifest and assert served method inventory agrees with real audited permission APIs and actual optional callback dependency. Confirm fails against unchanged source before minimal manifest-only behavior fix; no test just mirrors a hand-copied manifest list without testing loaded artifact. Existing actual loaded cdylib fixture should be used. Preserve immutable artifact hashes/actual runtime bind checks. Native Linux loaded fixture BOTH working directories via HOST scripts/ci-cancel-aware.sh; no temp build output/CARGO_TARGET_DIR. Sibling *_tests.rs no inline tests. All logs/evidence .sdd-evidence not target.
+Do not touch current foreign account helper/Windows ACL/other audit source except regression placement needed. Current c494 encoding fix nativeCI pending; root will HOLD later pushes until exactc494 evidence captured. Root handles PR. Finish fresh fmt/strict clippy/relevant native tests/docs/deny/MSRV1.88 and provide direct exit evidence; do not infer gate from shell chained last exit. Provide exact BASE..HEAD narrow diff FILE .sdd-evidence/task6-manifest-fix.diff and refresh full ORIGINAL87..final FILE task6-full.diff; self-review, clean exact checkpoint, no pending commands, SOURCEOWNERSHIP RELEASE. Independent SPEC+QUALITY reviewer follows and genuine native3OS on combined final branch before Task6DONE. Remaining approvals/judge/sandbox/crypto/fullpolicy/host migration still required.