Security hardening for #46 deployed but issue never formally closed #251

New issue

Closed

opened 2026-07-22 18:17:13 +00:00 by Mark · 1 comment

Mark commented

2026-07-22 18:17:13 +00:00

Owner

Finding from post-deploy probe of mesh-seed #46

Description

The security hardening for mesh-seed #46 ("[SECURITY][HIGH] Investigate deployment-skill attack surface") was completed and deployed — commits 7109410 (multi-wave security hardening) and d50eb05 (memory scrubbing + production policy) were verified present in the running container. All 28 security tests in tests/security/test_deploy_skill_attack_surface.py pass. 283/283 relevant tests pass overall.

However, issue #46 was never formally closed. Its state remains open, closed_at: null, and the 7 checklist items in the issue body are all unchecked.

Fix deployed (verified by probe)

secrets_manager.py at /app/runtime/secrets_manager.py ✓
skill_executor.py imports and uses secrets_manager for resolution, redaction, policy enforcement ✓
Key files: runtime/secrets_manager.py, config/secrets_policies.yaml, tools/mesh_node_deployer/tool.py, tools/mesh_ssh_bootstrap/tool.py ✓
Secret policies: skills/node_deploy/secrets_policy.yaml, skills/ssh_deploy/secrets_policy.yaml ✓
Docs: docs/reference/SECRETS_MANAGEMENT.md, docs/reference/SKILLS_USAGE.md ✓

Security tests (28/28 pass)

Command injection probes ✓
Champion gate bypass prevention ✓
Secret ref enforcement ✓
Input validation (path traversal, special chars) ✓
Legacy skill deprecation ✓
Bootstrap script integrity (SHA-256) ✓
SSH host key policy (strict by default) ✓
Production security policy forces known_hosts, source pin, secret policy ✓

Suggested action

Review the checklist in issue #46 against the verified deployed state and close the issue if all items are confirmed satisfied.

References

Original issue: #46
Kanban card: t_40cc380d (QA board)

## Finding from post-deploy probe of mesh-seed #46 ### Description The security hardening for mesh-seed #46 ("[SECURITY][HIGH] Investigate deployment-skill attack surface") was completed and deployed — commits `7109410` (multi-wave security hardening) and `d50eb05` (memory scrubbing + production policy) were verified present in the running container. All 28 security tests in `tests/security/test_deploy_skill_attack_surface.py` pass. 283/283 relevant tests pass overall. **However, issue #46 was never formally closed.** Its state remains `open`, `closed_at: null`, and the 7 checklist items in the issue body are all unchecked. ### Fix deployed (verified by probe) - `secrets_manager.py` at `/app/runtime/secrets_manager.py` ✓ - `skill_executor.py` imports and uses `secrets_manager` for resolution, redaction, policy enforcement ✓ - Key files: `runtime/secrets_manager.py`, `config/secrets_policies.yaml`, `tools/mesh_node_deployer/tool.py`, `tools/mesh_ssh_bootstrap/tool.py` ✓ - Secret policies: `skills/node_deploy/secrets_policy.yaml`, `skills/ssh_deploy/secrets_policy.yaml` ✓ - Docs: `docs/reference/SECRETS_MANAGEMENT.md`, `docs/reference/SKILLS_USAGE.md` ✓ ### Security tests (28/28 pass) - Command injection probes ✓ - Champion gate bypass prevention ✓ - Secret ref enforcement ✓ - Input validation (path traversal, special chars) ✓ - Legacy skill deprecation ✓ - Bootstrap script integrity (SHA-256) ✓ - SSH host key policy (strict by default) ✓ - Production security policy forces known_hosts, source pin, secret policy ✓ ### Suggested action Review the checklist in issue #46 against the verified deployed state and close the issue if all items are confirmed satisfied. ### References - Original issue: #46 - Kanban card: `t_40cc380d` (QA board)