check-security-binding: directory --credential-roots accept a directory-read failure as credential-absence evidence

[kyle-sexton]

Lane: merge-drive (deferred finding from PR #947, branch fix/549-credential-roots-allowlist).

Source. Codex P2 thread "Require credential probes below directory roots" on plugins/autonomy/skills/setup/scripts/check-security-binding.mjs — pathUnderConfiguredRoot equality case plus the credentials_absent grading (~L1340-1370).

Finding. When an operator configures a directory as a --credential-roots entry (e.g. /home/runner/.aws), a transcript whose probed path/host_expanded equals that directory passes containment via the equality case (normCandidate === normRoot). A directory reliably satisfies every downstream check: the outer existence probe succeeds (outer_exit_code "0"), the inner file-read fails with a directory-read error (non-zero exit_code, transport_outcome "read-denied"). The checker therefore grants L2 credential-absence even though real credential files beneath the directory (e.g. /home/runner/.aws/credentials) remain readable and were never probed.

Classification. Over-permissive edge in the deny-by-default credential allowlist (accepts non-probative evidence, feeding an autonomy-binding grant). Not the vacuous-root class already fixed on-branch for POSIX / and bare drive roots: a directory root still genuinely constrains the allowlist and requires the operator to have configured that exact directory, so this is a narrower hardening refinement, not a fail-open that makes the allowlist vacuous. Deferred rather than point-fixed, consistent with #549's ratified anti-enumeration posture (operator-configured roots are the convergence mechanism; do not re-enter open-ended structural recognition).

Why not point-fixed on-branch. The static transcript checker cannot stat the probing host, and the transcript records no errno/file-type — transport_outcome is coarse ("read-denied") and cannot distinguish an EISDIR directory-read from a credential-file read failure. So no clean generic fix exists: (a) structural file-vs-directory heuristics on the path string are exactly the open-ended structural recognition #549 closed; (b) dropping the equality case would deny the legitimate config where an operator configures an exact credential file as a root and the probe targets that file, with regression-test blast radius.

Fix direction (for #549 follow-up design). Decide whether directory roots should require strict-descendant containment (equality reserved for exact credential-file roots), and add a file-type/errno signal to the probe transcript contract (templates/isolation-probe.md) so a directory-read (EISDIR) is rejected as non-probative. Both are contract/design changes, not point-fixes.

Related. #549 (ratified Option A — deny-by-default --credential-roots), PR #947.

[kyle-sexton]

This was generated by AI (decide lane — decision-brief pass).

Problem

In check-security-binding.mjs, when an operator configures a directory as a --credential-roots entry (e.g. /home/runner/.aws), a transcript whose probed credential path equals that directory passes containment via the equality case, and every downstream credentials_absent check then passes — the directory exists (outer probe exit "0"), the inner read fails with a directory-read error, and the checker grants L2 credential-absence. This is non-probative: real credential files beneath the directory (e.g. /home/runner/.aws/credentials) were never probed and remain readable, yet a deny-by-default control accepted a directory-read failure as absence evidence.

What the code does today

Containment — pathUnderConfiguredRoot(candidate, roots) (plugins/autonomy/skills/setup/scripts/check-security-binding.mjs:223-239). After a vacuous-root guard rejecting bare roots (normRoot === "/" or /^[a-z]:\/$/, L235), it accepts a candidate two ways: the equality case normCandidate === normRoot (L236) and the strict-descendant case normCandidate.startsWith(${normRoot}/) (L237). A directory configured as a root satisfies the equality case when the probed path is that exact directory. credentialEntryProblem (L257-283) calls this at L278 as the sole membership test for a filesystem credential entry.

credentials_absent grading loop (check-security-binding.mjs:1341-1363). Per probed path it requires: entry passes credentialEntryProblem (L1345); non-zero inner exit_code (L1349, a directory read reliably yields this); for a non-URL entry, transport_outcome === "read-denied" (L1356-1358) — accepted unconditionally, no distinction between a directory-read error and a credential-file read failure; and outer_exit_code === "0" (L1360-1362), which a directory satisfies because the outer existence check is a readability test that succeeds on a directory. All four pass for a directory probed at itself → L2 granted.

Probe transcript contract (plugins/autonomy/skills/setup/templates/isolation-probe.md). The credentials_absent object records path, host_expanded, exit_code, outer_exit_code, transport_outcome, outcome (L115; multi-entry pairing L121-123). transport_outcome is coarse — only connect-failed | read-denied (L76-77) — and the outer existence check is explicitly "readability only, never content" (L68-70), so test -r <dir> succeeds on a directory. Confirmed: the contract records no file-type or errno field; there is no signal to distinguish EISDIR from a credential-file read failure.

#549 anti-enumeration posture (ratified). #549 closed as Option A — deny-by-default --credential-roots (ratification comments; landed in PR #947). The ratified mechanism is that operator-configured roots are the convergence device; the checker must not re-enter open-ended structural recognition (string-based inference about a path). Any fix that guesses file-vs-directory from the path string is exactly what #549 closed, and is out of bounds.

Verified test-coverage facts (blast radius inputs). Every valid --credential-roots fixture configures a directory root and probes a file strictly beneath it — e.g. ssh-id-rsa-valid.json sets root /home/runner, probed host_expanded /home/runner/.ssh/id_rsa (strict-descendant). No fixture exercises the equality case with an exact credential-FILE root, and no fixture exercises the bug (probe path == directory root). So the equality case has zero positive coverage today, and the over-permissive edge is untested.

Options

(A) File-type/errno signal in the probe transcript contract + checker rejects a directory-typed probe as non-probative — cross-cutting (contract + checker). Add a per-entry file-type/errno field (e.g. records EISDIR / regular-file) to isolation-probe.md; the checker requires a filesystem credential probe to evidence a regular file and rejects a directory-typed read. This reserves the equality case for exact credential-file roots at the evidence layer (equality-on-a-file accepted, equality-on-a-directory rejected) without the checker statting the host or parsing the path. Reversibility: medium — a required contract field is sticky (all ~30 existing L2 credential transcripts must record it; make it optional-with-strict-default or they regress). Blast radius: need a new positive fixture (directory root, file probed beneath, file-type present) and a new negative fixture (probe == directory root, EISDIR → rejected); existing fixtures need the field backfilled. Note: the "strict-descendant containment in pathUnderConfiguredRoot" half floated in the finding is not independently sound — the checker cannot tell a directory root from a file root without statting, so it would also break the legitimate exact-file-root config; the file-type signal is the load-bearing half and subsumes it.

(B) Status quo — documented known-limitation — docs-only, checker untouched. Operator guidance: configure exact credential files as roots and probe those files, never a bare directory. Reversibility: trivial. Blast radius: none. Cost: leaves a deny-by-default control accepting non-probative evidence, contingent on operator discipline the checker does not enforce.

(C) Drop the equality case entirely (check-security-binding.mjs:236) — checker-only. Require strict-descendant containment for all roots. Reversibility: high (one-line revert). Blast radius: no existing fixture regresses (none exercises the equality case), but it silently removes support for the legitimate exact-credential-file-root config (operator configures /run/secrets/token, probes that exact file) — a real config with no guarding test, so the breakage is silent, not caught. Does not touch the contract, and does not fix a directory root probed at a file beneath it via a directory-read — it only removes the equality path.

Cross-cutting flag: only (A) touches the isolation-probe.md contract (every operator's probe recipe + all stored transcripts). (B) and (C) are docs-only / checker-only respectively.

Recommendation

RECOMMENDED — Option A (file-type/errno signal variant), retaining the equality case. Rationale: the defect is a probativeness failure, not a containment failure — the equality case correctly answers "is this path within a trusted root"; what is broken is that a directory-read failure is accepted as file-absence evidence at credentials_absent (L1356-1358). Deny-by-default demands non-probative evidence be rejected at the evidence layer, and the only sound way to distinguish a directory-read from a credential-file read without statting the host is to have the probe report the file-type/errno — evidence-based, not the open-ended structural path-string recognition #549 closed. This is why the finding was deferred rather than point-fixed: no checker-only fix is sound, so a real fix necessarily touches the transcript contract, which is what makes A cross-cutting and B tempting — but B leaves the ratified deny-by-default posture accepting non-probative evidence, which breaks the tie toward A. Reject the strict-descendant-containment half as unsound in isolation. This is a security-posture design decision the operator owns: it changes the transcript contract and redefines what counts as valid credential-absence evidence.

Cross-links: #549 (ratified Option A — deny-by-default --credential-roots), PR #947 (merged), #949 (sibling check-security-binding diagnostic — concrete dot-segment coherence).

RECOMMENDED: Option A (file-type/errno signal in the probe transcript contract; checker rejects a directory-typed probe as non-probative; equality case retained) — the defect is non-probative evidence accepted by a deny-by-default control, and only an evidence-layer file-type signal fixes it without statting the host or re-entering the structural path recognition #549 closed.

[kyle-sexton]

Frontier disposition (drain session)

Ruling: Close as not planned.

check-security-binding credential-root read-failure permissiveness is a minor hardening note without active exploit path.