autonomy(check-security-binding): static credential-root + egress-target validation cannot converge without a configured allowlist

[kyle-sexton]

Root cause (surfaced by PR #377 review loop)

plugins/autonomy/skills/setup/scripts/check-security-binding.mjs validates two open-ended input classes with static structural recognition and no configured allowlist:

1. Credential probe paths (isCredentialTarget, ~L100-186) — must recognize whether a probed path is a real host credential location.
2. Egress targets (isNonExternalEgressHost, ~L631-678) — must recognize whether a probed host is a provably external address (vs. a non-globally-routable / special-use address whose failed connection proves nothing).

Neither can be decided statically. A static checker with no config source can only pattern-match structure, so for each class the reviewer (chatgpt-codex-connector) can always construct a fresh input that is structurally plausible but semantically meaningless:

• Credential side: an invented home-base path such as /home/definitely-not-a-host-user/.ssh passes (home is a home-base segment) while the real host credentials remain elsewhere and readable.
• Egress side: each IANA/RFC special-use range must be denied one at a time. The bot has walked the registry across ~29 review cycles (loopback encodings, ::/96, IPv4-compat, 192.88.99.0/24 6to4, fec0::/10 site-local, 192.0.0.0/24 protocol-assignment, and now 100::/64 discard-only per RFC 6666), and unenumerated blocks remain (e.g. 64:ff9b::/96 NAT64, 3fff::/20 documentation).

This is not point-fixable. Each landed denial predictably spawns the next variant in the same class — an adversarial enumeration of an open-ended space, not a converging bug list. 42 findings across 28+ Codex review cycles on PR #377 are all instances of these two root causes.

Convergent fix (needs a human architecture decision)

Replace open-ended structural recognition with deny-by-default + configured allowlists, which the code comments and prior review replies already name as the deferred seam ("org-specific names belong to the future configured allow-list"):

• Credential roots: accept a probe path as evidence only if it resolves under an operator-configured trusted credential root (e.g. a --credential-roots / config list). No configured root then no static acceptance.
• Egress targets: accept a target as external-egress evidence only if it is on an operator-configured --egress-hosts allowlist (deny-by-default), rather than trying to enumerate every non-global range to reject.

Under a configured allowlist, both point-denial enumerations become superseded/throwaway, and the validator converges by construction.

Why this is filed rather than fixed inline

PR #377's babysit worker hit the non-convergence fix-round cap (~29 cycles, no realistic path to convergence via point-fixes). The two current-head P1 threads (commit 931771d, check-security-binding.mjs L184 credential path and L659 IPv6 discard-only) are left open and unresolved — they are valid but resolve to this single architectural decision, which a human must make. This issue captures that decision so the threads/PR are not point-fixed into a 30th cycle.

References

• PR: feat(autonomy): guardrail matrix, security binding, setup slice (WP5) #377 (branch feat/autonomy-guardrails)
• Current-head Codex review: commit 931771d, two P1 findings (L184, L659)
• Related: autonomy pipeline: no dedicated security-review pass — automated code review only #509 (no dedicated security-review pass), babysit-prs: codify the decide-and-defer non-convergence resolution playbook (own-once, no duplication of safety.md) #375 (codify decide-and-defer non-convergence playbook)

---

Reference: Boris Cherny, "Steps of AI Adoption" (Google Doc)

[kyle-sexton]

This was generated by AI during triage. · Category: security-architecture (non-convergence root cause) · Priority: priority: high (unblocks PR #377 stuck at 28+ non-converging Codex cycles / 42 findings; security-correctness — the validator currently accepts structurally-plausible but semantically-meaningless evidence). Routed needs-human + wayfind: design.

Why needs-human

Author-flagged as a security-architecture decision, correctly: check-security-binding.mjs validates two open-ended input classes (credential probe paths; egress targets) with static structural recognition and no configured allowlist — which cannot converge by construction. The reviewer can always craft a fresh structurally-plausible input (invented home-base credential path; the next un-enumerated IANA special-use range). 42 findings / 28+ cycles are all instances of these two root causes — an adversarial enumeration of an open-ended space, not a bug list. Not point-fixable.

Well-grounded convergent fix (for ratification — the code already names this seam)

Replace open-ended structural recognition with deny-by-default + operator-configured allowlists (the code comments + prior review replies already call this the deferred seam — "org-specific names belong to the future configured allow-list"):

• Credential roots: accept a probe path as evidence only if it resolves under an operator-configured trusted credential root (--credential-roots/config). No configured root → no static acceptance.
• Egress targets: accept a target as external-egress evidence only if on an operator-configured --egress-hosts allowlist (deny-by-default) — rather than enumerating every non-global range to reject.

Under configured allowlists both point-denial enumerations become throwaway and the validator converges by construction.

The design (what the human decides)

The config surface (flag vs config-file; where the allowlist lives; secret/binding classification; defaults when unconfigured — deny-all vs warn), and confirmation that deny-by-default is the accepted posture. This is genuine security-architecture + config design, and it directly unblocks PR #377.

Handling the stuck PR

PR #377's two current-head P1 threads (931771d, L184 credential path + L659 IPv6 discard-only) are valid but resolve to this one architectural decision — leave them open (do NOT point-fix into a 30th cycle). This issue is the decide-and-defer carrier per #375. Related: #509 (dedicated security-review pass), #375 (non-convergence playbook).

[kyle-sexton]

This was generated by AI (needs-human decision-brief pass).

Decision brief (2-minute read)

Prepared by an AI agent from the checkout at main 93013be, reading the PR branch feat/autonomy-guardrails @ 9e409d4879. Distinct from the triage routing note already on this issue; it does not supersede the wayfind: design / needs-human routing.

Problem. check-security-binding.mjs validates credential-probe paths and egress targets with static structural recognition and no configured allowlist, so the reviewer can always craft a fresh structurally-plausible input and the validator never converges (42 findings / 28+ Codex cycles on PR #377). The fix everyone already names is deny-by-default + operator-configured allowlists; the human decision is where that config lives and its unconfigured default.

Today (verified — one premise in the issue is now stale). The file exists only on the open PR branch feat/autonomy-guardrails @ 9e409d4879 (PR #377 OPEN), not on main — the issue cites 931771d, so the branch has advanced.

• Egress side: the allowlist seam is ALREADY landed. The script parses --egress-hosts <host,host,...> (arg parser L1412; usage L11) as "the configured/trusted probe-target seam." A special-use/reserved host not in that list fails deny-by-default (L947-962: "not in the configured egress-probe allow-list"). So egress is no longer open-ended structural rejection — the issue's "both classes are unbuilt" framing is out of date for egress.
• Credential side: still open-ended, no allowlist flag. The arg parser handles only --evidence, --probe-evidence-root, --egress-hosts — there is no --credential-roots. isCredentialTarget still uses structural anchor-matching, with comments explicitly deferring the fix: "org-specific mounts belong in the future configured allow-list" (L125), "org-specific names belong to the future configured allow-list" (L178, L193). This is the true residual non-convergence surface.
• Config home is ephemeral. --egress-hosts is a per-invocation CLI flag — nothing durably stores the allowlist (no repo-committed config, no userConfig binding). So even the landed egress seam leaves the durable home question open.

Options.

• A — RECOMMENDED. Ratify deny-by-default; extend the existing --egress-hosts pattern to a --credential-roots flag, then bind both to a durable config home. Mirror the seam that already works for egress: add --credential-roots so isCredentialTarget accepts a probe path only under an operator-configured root, and give both allowlists a durable home (see the config-home sub-decision below). Tradeoffs: converges by construction (kills the enumeration for both classes); credential change is net-new code but structurally identical to landed egress. Reversibility: high — additive flag + config read; unconfigured falls back to current behavior or hard-deny per the default you pick. Rationale: re-derived from verified state — half the proposed fix already shipped this shape, so consistency + lowest-surprise favor matching it rather than inventing a second mechanism.
  • Config-home sub-decision (the actual design fork): (i) repo-committed file (e.g. .claude/ config) — reviewable, shared, versioned, but org paths in git; (ii) userConfig / machine binding — per-operator, keeps host paths out of the repo, but not shared/reviewable; (iii) CLI-flag only (status quo for egress) — simplest, but ephemeral and easy to omit. Recommend (i) for the allowlist shape + (ii) for anything host-secret-sensitive per the secret-binding classification; confirm before build.
  • Default-when-unconfigured: deny-all vs warn-only. Recommend deny-all (the issue's stated posture); note source-control: no read/consume-only posture — "safe" babysit tier and pull-request monitor write to GitHub autonomously #440's decided report-only default is the precedent for choosing a non-blocking default if the operator prefers warn-first rollout.
• B — Land --credential-roots as a CLI flag only, defer the durable config home. Tradeoffs: fastest to unblock PR feat(autonomy): guardrail matrix, security binding, setup slice (WP5) #377, matches current egress exactly; leaves both allowlists ephemeral (must be passed every run), so operational drift risk. Reversibility: high. Weaker on durability but unblocks now.
• C — Keep point-fixing the two current-head P1 threads (L184 credential, L659 IPv6). Tradeoffs: none real — this is the 30th-cycle trap the issue exists to stop; rejected.

Cross-links.

• PR feat(autonomy): guardrail matrix, security binding, setup slice (WP5) #377 (OPEN, branch feat/autonomy-guardrails @ 9e409d4879) — the two current-head P1 threads resolve to this one decision; leave them open, do not point-fix.
• babysit-prs: codify the decide-and-defer non-convergence resolution playbook (own-once, no duplication of safety.md) #375 — decide-and-defer non-convergence playbook; this issue is the carrier that discharges it.
• autonomy pipeline: no dedicated security-review pass — automated code review only #509 — no dedicated security-review pass (why these surfaced only via the general reviewer).
• source-control: no read/consume-only posture — "safe" babysit tier and pull-request monitor write to GitHub autonomously #440 — decided outward_write_mode: report-only|write (default report-only): the precedent if you want a non-blocking warn default rather than deny-all when the allowlist is unconfigured.

Decision asked: Accept Option A (ratify deny-by-default, add --credential-roots mirroring --egress-hosts, durable home = repo-committed file, default = deny-all) — yes, or modify which sub-choice?

[kyle-sexton]

Operator decision (2026-07-19, decision-session batch 3; relayed).

ACCEPTED — the decision brief's RECOMMENDED option verbatim.

Re-intake: removing needs-human, adding priority: needs-triage for routing.

[kyle-sexton]

This was generated by AI during triage.

Routing status: ready per ratified decision. Operator ACCEPTED Option A verbatim: ratify deny-by-default; extend the already-landed --egress-hosts allowlist pattern to a new --credential-roots flag (mirrors the existing seam — isCredentialTarget currently structural-matches with explicit "future allow-list" deferral comments); bind both allowlists to a durable config home — repo-committed file for the allowlist shape (reviewable, versioned) plus userConfig/machine binding for anything host-secret-sensitive per the secret-binding classification; unconfigured default = deny-all. Applies against the live PR #377 (feat/autonomy-guardrails) — leave its current P1 threads open, do not point-fix past this decision per #375's decide-and-defer playbook.

Priority: not in the explicit scaling-chain list — downgraded from priority: high to priority: medium. wayfind: design removed (design settled).