|
| 1 | +# Reflective-Risk Report: SEC-08 Skill Routing Hardening |
| 2 | + |
| 3 | +Date: 2026-07-01. Action ID: S-P2-10. |
| 4 | +Security surface: skill/subagent isolation routing and `directory-snapshot` compatibility mode. |
| 5 | + |
| 6 | +## Goal |
| 7 | + |
| 8 | +Reduce SEC-08 automatic exposure by removing silent auto-selection of |
| 9 | +`directory-snapshot` for skill isolation. `directory-snapshot` is a workspace file |
| 10 | +copy only; it does not provide OS/process isolation. It remains available only as |
| 11 | +an explicit compatibility mode, and actual subagent preparation still requires |
| 12 | +`acknowledge_no_os_isolation=True`. |
| 13 | + |
| 14 | +## Stakeholders |
| 15 | + |
| 16 | +Owner-operator, skill authors, subagent users, and maintainers of the skill |
| 17 | +execution/routing contract. |
| 18 | + |
| 19 | +## Assets at Risk |
| 20 | + |
| 21 | +Host process namespace, host filesystem outside the workspace (`~/.ssh`, `/etc`, |
| 22 | +`/proc`), environment variables, and operator trust in the term "sandbox". |
| 23 | + |
| 24 | +## Threat Model |
| 25 | + |
| 26 | +A skill or subagent path is auto-routed to `directory-snapshot`; the operator sees |
| 27 | +an isolation-like label but the code runs as a host process and can read host |
| 28 | +paths. Prior warning/ack gates protected direct subagent preparation, but |
| 29 | +`SkillRouter` still used `directory-snapshot` as the low-risk/default/WASM-fallback |
| 30 | +auto choice. |
| 31 | + |
| 32 | +## Assumption Audit |
| 33 | + |
| 34 | +- ASSUMPTION: `prepare_subagent_isolation` already blocks direct |
| 35 | + `directory-snapshot` use without an explicit ack. VERIFIED at |
| 36 | + `_isolation.py:288-298` and by `test_directory_snapshot_without_acknowledgment_is_rejected`. |
| 37 | +- ASSUMPTION: auto skill routing was the remaining silent directory-snapshot path. |
| 38 | + VERIFIED by `skill_router.py` and tests that previously asserted low-risk skills |
| 39 | + used directory-snapshot. |
| 40 | +- ASSUMPTION: using Docker for auto routing preserves local LOW-risk usability on |
| 41 | + machines without Docker. VERIFIED by `execute_skill`: LOW-risk Docker |
| 42 | + unavailability keeps the existing `docker_fallback_subprocess` backend, but the |
| 43 | + routing no longer labels the run as directory-snapshot isolation. Non-low-risk |
| 44 | + remains fail-closed on Docker unavailability. |
| 45 | + |
| 46 | +## Evidence Check |
| 47 | + |
| 48 | +- `SkillRouter._auto_select_sandbox` now returns `SandboxType.DOCKER` for LOW risk |
| 49 | + and default fallback. |
| 50 | +- WASM unavailable/incompatible fallback returns Docker, not directory-snapshot. |
| 51 | +- `isolation_for_sandbox_type(SandboxType.WASM)` maps to Docker for subagent |
| 52 | + isolation wrappers because `prepare_subagent_isolation` has no WASM process |
| 53 | + boundary. |
| 54 | +- Explicit `SandboxType.DIRECTORY_SNAPSHOT` still maps to `directory-snapshot` for |
| 55 | + compatibility and is governed by the existing ack gate. |
| 56 | +- Tests: `tests/test_skill_router.py`, |
| 57 | + `tests/acceptance/test_sandbox_enhancement_flow.py`, |
| 58 | + `tests/test_isolation_acknowledgment_flag.py`, |
| 59 | + `tests/test_subagent_isolation.py`, |
| 60 | + `tests/acceptance/test_subagent_directory_snapshot_isolation_flow.py`. |
| 61 | + |
| 62 | +## Authority / Tool Boundary |
| 63 | + |
| 64 | +In scope: routing defaults in `teaagent/skill_router.py`, acceptance/unit tests, |
| 65 | +risk register, action register, and docs inventory. Out of scope: removing |
| 66 | +`directory-snapshot` entirely, changing Docker runtime internals, or changing the |
| 67 | +LOW-risk Docker fallback subprocess policy. |
| 68 | + |
| 69 | +## Failure Modes |
| 70 | + |
| 71 | +- Docker unavailable for LOW-risk skill: unchanged fallback subprocess path, now |
| 72 | + labelled as `SandboxType.DOCKER` with backend `docker_fallback_subprocess`. |
| 73 | +- User explicitly requests directory-snapshot: compatibility path remains, but |
| 74 | + direct subagent preparation still requires `acknowledge_no_os_isolation=True`. |
| 75 | +- Non-low-risk skill without Docker/WASM: existing fail-closed behavior remains. |
| 76 | + |
| 77 | +## Worst-case Scenario |
| 78 | + |
| 79 | +A low-risk skill still executes locally because Docker is unavailable. This is not |
| 80 | +represented as directory-snapshot isolation anymore; non-low-risk remains |
| 81 | +fail-closed. Full elimination of subprocess fallback is a separate breaking UX |
| 82 | +change and should have its own ADR. |
| 83 | + |
| 84 | +## Safe Dry-run Plan |
| 85 | + |
| 86 | +Run focused skill routing/isolation tests and docs validator. No network, no |
| 87 | +credentials, no destructive operations. |
| 88 | + |
| 89 | +## Rollback Plan |
| 90 | + |
| 91 | +`git revert` the commit. The change is routing/test/docs only; no persisted-state |
| 92 | +or migration concern. |
| 93 | + |
| 94 | +## Bounded Execution |
| 95 | + |
| 96 | +Single commit. No production deployment. No external I/O. |
| 97 | + |
| 98 | +## Audit Log Plan |
| 99 | + |
| 100 | +No runtime audit event added or removed. Risk/action register rows record the |
| 101 | +change for governance audit. |
| 102 | + |
| 103 | +## Human Review Required |
| 104 | + |
| 105 | +Yes for security posture semantics, though the changed code path is not listed in |
| 106 | +`high_risk_paths.yaml`. |
| 107 | + |
| 108 | +## Human Approval Gate |
| 109 | + |
| 110 | +Owner instructed: "Fix all known high risks one by one" and then "continue". |
| 111 | +This is the next bounded SEC-08 hardening slice after SEC-09/SEC-15. |
| 112 | + |
| 113 | +## Acceptance Criteria |
| 114 | + |
| 115 | +- Auto LOW/default/WASM-fallback skill routing chooses Docker, not directory-snapshot. |
| 116 | +- Explicit directory-snapshot still maps for compatibility and remains ack-gated. |
| 117 | +- Focused tests pass. |
| 118 | +- SEC-08 risk register row reflects reduced likelihood (M/M=4) with evidence. |
| 119 | + |
| 120 | +## Go / No-go Decision |
| 121 | + |
| 122 | +**GO** — small, reversible hardening that removes the silent directory-snapshot |
| 123 | +auto route while preserving explicit compatibility and existing LOW-risk fallback |
| 124 | +semantics. |
0 commit comments