d65c06f27b
Per-agent file ownership with Unix permission enforcement: - Agent directories owned by agent ID (UID), group 'agent' (GID) - Private files (plan, ctl, fifo): mode 0600 - owner only - Group-readable (chat, log): mode 0440 - owner + agent group - World-readable (state, id): mode 0444 - observable by all - Prompt: mode 0220 - CLI and owner can write virtfs: fix UID/GID inheritance through nested paths - Added findChildWithInheritance() to accumulate inherited UID/GID - Stat now correctly shows agent ID as owner for nested files server: admin bypass for server owner - serverAdmin variable captures the Unix user running olliesrv - Admin bypass includes empty uname, 'admin', or server owner Documentation updates: - fs/doc.go: 'The Namespace IS the Security Model' - registry/doc.go: capability-based tool access - peer.go: capability-based peer access - lessons-learned.md: 'Model compliance is not a security boundary' - architecture-9p.md: per-agent file ownership section Security evaluation: - Added experiments/security-eval/ with NERV attack corpus adaptation - Test scripts for Landlock sandbox validation - RESULTS.md documenting 0% ASR on hostile operations This implements the NERV thesis: 'An agent can only access resources explicitly bound into its namespace.' Enforcement is structural via file permissions, not behavioral via model compliance. |
||
|---|---|---|
| .. | ||
| internal | ||
| test | ||
| .gitignore | ||
| main.go | ||
| p9.go | ||