diff --git a/0030/SESSION-0030.0-TRANSCRIPT-2026-05-28T16-12--2026-05-28T17-39.md b/0030/SESSION-0030.0-TRANSCRIPT-2026-05-28T16-12--2026-05-28T17-39.md new file mode 100644 index 0000000..e7406b1 --- /dev/null +++ b/0030/SESSION-0030.0-TRANSCRIPT-2026-05-28T16-12--2026-05-28T17-39.md @@ -0,0 +1,211 @@ +# Session 0030.0 — Transcript + +> Date: 2026-05-28 +> Start: 2026-05-28T16-12 (PST implied) +> End: 2026-05-28T17-39 (PST implied) +> Subject: Security-audit-0026 remediation — flotilla-owned fixes + live GCP/VM hardening +> Status: **FINALIZED.** + +> Sanitization note: this transcript is published to the public +> `wiggleverse/ohm-session-history`. Because several audit findings were +> still **live and unpatched** on production at session end (they belong to +> a parallel, not-yet-deployed branch — see "Coordination" below), this +> record deliberately references findings by **ID and general category +> only** and contains **no exploit sketches or step-by-step reproduction**. +> The full-detail audit (`SECURITY-AUDIT-0026-2026-05-28.md`) lives locally +> in `~/git/ohm-infra`, which is not a git repository, and was never +> published. No secret bytes appear here (§3 invariant 1). + +--- + +## Launch prompt + +> full remediation of security report at ~/git/ohm-infra + +The "security report" is `SECURITY-AUDIT-0026-2026-05-28.md` (produced by +the parallel audit session 0026): 1 Critical, 1 High, 5 Medium, 9 Low, +6 Info findings spanning three surfaces — the **rfc-app** codebase, the +**flotilla** CLI (this repo), and the **live GCP/VM** deployment. + +--- + +## What this session settled + +Session 0030 took the **flotilla-owned findings** and the **live GCP/VM +findings that live in no repo**, applied + verified them, and merged + +deployed the flotilla changes. The rfc-app/nginx/systemd findings were +left to a parallel in-flight session (see Coordination). Net for OHM: +the VM is materially hardened and the operator CLI has three defense-in- +depth improvements; the application-layer findings remain pending that +other session's release. + +## The "did we leak the audit?" scare (resolved: NO) + +Mid-session the operator flagged that a transcript containing the audit +might have been pushed to the public repo before an internet drop. I +froze remediation and verified the **entire git history** of +`wiggleverse/ohm-session-history` (fresh clone, all branches, +`git log -S` for audit-unique strings): + +- Audit session 0026 published **only its 454-byte placeholder** — its + full transcript was never pushed (the publish push is atomic; it failed + on the internet drop, leaving only the start-gesture placeholder). +- **Zero** audit-unique strings appear in any commit, ever. +- The audit file itself lives only in local `~/git/ohm-infra` (not a git + repo) — never committed anywhere. + +Verdict: nothing leaked. The real containment for the audit's value (an +exploit roadmap) is shipping the fixes, which is what the session then +continued doing. + +## Coordination — the rfc-app remediation is owned elsewhere + +On inspecting `/Users/benstull/git/rfc-app` I found branch +`feature/v0.25.0-security-hardening` already checked out with a large +**uncommitted** remediation (a parallel live session, 0027 or 0029). +It covers the rfc-app application findings, the nginx server block, and +the systemd unit. Editing rfc-app would have clobbered another session's +live work, so — with the operator — Session 0030 explicitly scoped to: + +- **flotilla repo** fixes (no overlap), and +- **live GCP/VM ops** that exist in no repo. + +The operator chose this division (and chose to perform the live ops this +session, and to defer SSH-scoping to a proper IAP rollout). + +## Work performed + +### Flotilla repo (PR #1 — merged) + +Branch `session-0030/flotilla-security-hardening` → **PR #1**, merged to +`main` (merge commit `7b32a46`). 161 tests pass. + +- **L1** — the live secret redactor is threaded into `_PhaseRunner` and + now scrubs **both** the success and failure phase-`detail` paths before + they are persisted to `deploys.phases` / surfaced to the operator + (previously only the separate `error_summary` was scrubbed). Test + extended to assert no secret survives in any persisted phase detail. + (This fix was already present in the working tree at session start; + Session 0030 verified, tested, and landed it.) +- **I6** — `redact_live` now matches several decodings of the same secret + bytes (utf-8/replace, surrogateescape, latin-1) so a non-ASCII secret + that surfaced via a different decode path than the needle still + redacts. Match only ever redacts more, never less. Residual byte- + boundary limitation documented honestly (moot for ASCII/UTF-8 secrets). +- **L9** — `ssh.py` no longer leans on `--quiet`'s blanket first-connect + host-key accept; it adds `StrictHostKeyChecking=accept-new`, which still + connects to genuinely-new hosts non-interactively but **refuses a + changed key**. Full first-connect TOFU removal remains the §19.2 IAP + item. +- **I5** — `overlay set` warns (does not block) when a key name carries an + unambiguous secret word, nudging toward `secret bind`/`secret set`. + Deliberately does not match generic `*_KEY`/`*_API_KEY`, so public site + keys don't train the operator to ignore the warning. + +After merge, a clean idempotent redeploy of the current pin (v0.26.0) +exercised the hardened flotilla code end-to-end: **`deploys.id=35`**, all +9 phases ok, health verified in 5.0s. + +### Live GCP/VM ops (project `wiggleverse-ohm`, VM `ohm-rfc-app`) + +- **M3** — the SQLite data directory was world-traversable and the DB + (plus its WAL/SHM sidecars) world-readable. Tightened the **directory to + `750`** (the robust containment — closes world access regardless of + per-file mode regression) and the files to **`640`**. Verified to + survive both a full VM reboot and a deploy-triggered service restart + (sqlite preserves the main DB's mode on its sidecars). Also discovered + and **secured** (but did not delete) a set of orphaned `ohm-app.db\r*` + files — stale copies left by the historical CRLF path bug; flagged to + the operator for deletion after confirmation. +- **L5** — deleted the dead `default-allow-rdp` firewall rule (3389 is + unused surface on Linux). SSH-from-anywhere left in place by operator + decision; the right fix is an IAP rollout (§19.2), not fragile IP + scoping. +- **L6** — created a dedicated least-privilege runtime service account + (`ohm-rfc-app-vm@…`) with logging+monitoring writer only (the app reads + its config from `.env` at deploy time, so **no** Secret Manager access + is needed on the VM), and swapped the VM off the default compute SA. +- **L7** — enabled Shielded-VM **Secure Boot** (boot disk confirmed + UEFI-compatible first; vTPM + integrity monitoring were already on). + +L6 + L7 were applied in a single VM stop/start window (~15s of downtime), +after confirming no deploy was in flight. All four verified intact after +the later deploy. + +### Config verification (audit action item 5) + +Read the live `.env` **variable names** only (no values): +- `TURNSTILE_REQUIRED="true"` — confirmed (mitigates the OTC abuse Low). +- `GITEA_WEBHOOK_SECRET` — present (Gitea webhook authenticated). +- **`WEBHOOK_EMAIL_BOUNCE_SECRET` — absent.** This confirms M5 as a live + config gap (the bounce webhook is currently unauthenticated). Handed to + the operator with an operator-run secret gesture (never request/echo + secret bytes in-conversation — §3 conversation-layer corollary). The + operator will bind it and redeploy as a follow-up. + +## Friction / dead-ends (kept honest) + +- The first `chmod 640 …/data/*` failed: having just set the directory to + `750`, the non-root SSH login user could no longer list it to expand the + glob. Re-ran the file chmod under `sudo sh -c` so root expanded it. +- After merging PR #1, `git checkout main && git pull` did **not** + fast-forward (local `main` had no upstream tracking), so the working + tree briefly reverted to pre-fix code. Recovered with + `git fetch && git merge --ff-only origin/main` and set the upstream. + No work lost (the fixes were safe in the merge commit). + +## Findings status at session end + +| Owner | Findings | Status | +| --- | --- | --- | +| **0030 (flotilla)** | L1, I6, L9, I5 | **Done** — merged (PR #1) + deployed | +| **0030 (live VM/GCP)** | M3, L5(RDP), L6, L7 | **Done** — applied + verified | +| **Operator follow-up** | M5 (config bind), `*.db\r` cleanup, systemd `UMask=0077` | Flagged with gestures | +| **Deferred** | L5 (SSH 0.0.0.0/0 → IAP §19.2) | By operator decision | +| **Parallel v0.25.0 branch** | C1, H1, M1, M2, M4, L2, L3, L4, L8, I1, I3, I4 | **Pending** — uncommitted, **not yet deployed** (still live on prod) | + +## Cross-references + +- flotilla PR #1 (`wiggleverse/ohm-rfc-app-flotilla`), merge `7b32a46`. +- OHM deploy `deploys.id=35`, v0.26.0 (idempotent redeploy exercising the + hardened flotilla). +- GCP: VM `ohm-rfc-app` / `us-central1-a` / `wiggleverse-ohm`; new SA + `ohm-rfc-app-vm@wiggleverse-ohm.iam.gserviceaccount.com`; deleted + firewall rule `default-allow-rdp`. +- Source audit: `~/git/ohm-infra/SECURITY-AUDIT-0026-2026-05-28.md` + (local only — never published). + +--- + +## Operating instructions for the next session + +The application-layer security work is the open thread. Concretely: + +1. **Ship v0.25.0.** The `feature/v0.25.0-security-hardening` branch in + rfc-app holds the application + nginx + systemd remediation (C1 XSS + sanitizer, the auth-verify rate-limit/lockout, the device-trust lookup + fix, security headers, cookie hardening, the bounce-webhook + `_required` guard, etc.). It is **uncommitted and undeployed**, which + means the audit's **Critical (C1)** and other findings are **still live + on production**. This is the highest priority: confirm/finish the + branch, commit, release as v0.25.0, bump `ohm-rfc/.rfc-app-version`, + and deploy via flotilla. Coordinate with whichever session owns that + branch (was 0027/0029) before touching it. +2. **M5 config** — the operator intends to bind `WEBHOOK_EMAIL_BOUNCE_SECRET` + (Secret Manager + `flotilla secret bind` + provider-side config) and + redeploy. The code-side `_required` guard rides along in v0.25.0. +3. **systemd `UMask=0077`** — add to rfc-app's `deploy/systemd/rfc-app.service` + (belt-and-suspenders on top of the `750` data dir). +4. **Orphaned `ohm-app.db\r*` files** on the VM — secured to `640`; delete + once confirmed orphaned. +5. **L5 SSH / IAP (§19.2)** — the deferred item: IAP-only SSH (firewall + + tunnel role + flip flotilla's deploy path to `--tunnel-through-iap`), + which also retires the L9 first-connect TOFU residue. + +Suggested next-session launch prompt: + +> Ship rfc-app v0.25.0-security-hardening (finish/commit the existing +> branch, release, bump the OHM pin, deploy) — this lands the still-live +> audit-0026 application findings incl. the Critical XSS. Coordinate with +> the session that owns the branch first. Then help the operator bind +> WEBHOOK_EMAIL_BOUNCE_SECRET (M5) and add systemd UMask=0077. diff --git a/0030/SESSION-0030.0-TRANSCRIPT-2026-05-28T16-12--INPROGRESS.md b/0030/SESSION-0030.0-TRANSCRIPT-2026-05-28T16-12--INPROGRESS.md deleted file mode 100644 index 2f9bf90..0000000 --- a/0030/SESSION-0030.0-TRANSCRIPT-2026-05-28T16-12--INPROGRESS.md +++ /dev/null @@ -1,15 +0,0 @@ -# Session 0030.0 — Transcript - -> Date: 2026-05-28 -> Start: 2026-05-28T16-12 (PST implied) -> Status: **PLACEHOLDER — claimed at session start; finalized at session end.** -> -> This file reserves session ID 0030. The driver replaces this body -> with the full transcript before publishing, and renames the file to -> its final SESSION-0030.0-TRANSCRIPT-2026-05-28T16-12--.md form. - ---- - -## Launch prompt - -_(launch prompt not captured at claim time)_