Fimeg/SouveraineOS
Watch
1
0
Fork
You've already forked SouveraineOS
 0
Code Releases Activity

saf: fence schedules from authority

Browse source 
The watcher path, tool path, trigger files, and declared config do not meet. Record the traversal and prompt-injection boundaries before schedules wake an agent.
This commit is contained in:
Fimeg 2026-08-20 13:38:00 -04:00
commit 575604abc6
2 changed files with 32 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

27
saf/nervous/01-eventbus.md
View file

@ -39,4 +39,29 @@ One type, not an enum per event, so a listener filters on `event_type` and ignor
A `SensorConfig` says how a sensor takes part: which domain (`Cron`, `Filesystem`, `FilesystemWatch`, `GitDiff`, `Memory`, `Process`, `Federation`), whether it pushes on its own or waits to be asked, when it fires (once, on change, or on an interval), and how eagerly.
A sensor marked as a nerve ending fires onto the bus uncalled. Right now the schedule is the only one that does. The other domains are named and waiting; nothing drives them yet. Tracked in `docs/tasks/firehose-subconscious-subscription.md`.
A sensor marked as a nerve ending fires onto the bus uncalled. The schedule is
the first intended nerve ending, but it is not operational for agent-created
schedules in the current source.
## Schedule boundary — observed 2026-08-20
- `LocalBackend` spawns `CronSensor` against
`agents/<id>/schedules/`, while the CLI and schedule tool write
`agents/<id>/memory/schedules/`. Those files are therefore not watched.
- `schedule run` and the tool's `trigger` action create `.trigger-*` files;
`CronSensor` never consumes them.
- `[schedules].enabled` and `schedules_dir` are declared in config but ignored
by the `LocalBackend` wiring.
- Schedule names are interpolated into a path without validation. Do not treat
the tool as a safe authority boundary until traversal is rejected and file
ownership is explicit.
- A due schedule injects its prompt as a background user turn. Schedule text is
therefore untrusted input, not an authorization token for shell, Git,
deployment, publication, or credential use.
The intended repair is one canonical directory, validated names, working
manual triggers, honoured configuration, and a capability-limited wake path.
For the Gitea watcher, schedules may later wake Ani to inspect already
reconciled read-only state; they must not replace signed webhooks, API
reconciliation, or CI authority. The other sensor domains remain named and
waiting. Tracked in `docs/tasks/firehose-subconscious-subscription.md`.

7
saf/state.md
View file

@ -7,7 +7,7 @@ Everything else belongs to its owning section and is reached from the index.
Keep it honest: when component state moves, move it here. Dated history goes
to `archive/` — it never returns as news.
Last reconciled: 2026-08-18 (cadences + memory tool tree selector landed).
Last reconciled: 2026-08-20 (schedule authority boundary audited).
## Deployed
@ -41,6 +41,11 @@ Last reconciled: 2026-08-18 (cadences + memory tool tree selector landed).
owning work record.
- **Memory sync**: per-instance branches and `resolve_remote` are in; merge
policy and auto-fetch are next (FEDERATION.md step 3).
- **Schedules are wired across the bus but miss their own files.** The sensor
watches `agents/<id>/schedules`; the CLI/tool write under
`agents/<id>/memory/schedules`, manual triggers are not consumed, config is
ignored, and names need traversal rejection. Do not use schedules as CI or
deployment authority. `nervous/01-eventbus.md` owns the boundary.
## The substrate, one line