diff --git a/04-ISSUES/344-known-gaps-in-the-agents-boundary-accepted-for-now/00-report.md b/04-ISSUES/344-known-gaps-in-the-agents-boundary-accepted-for-now/00-report.md new file mode 100644 index 00000000..bd5cec58 --- /dev/null +++ b/04-ISSUES/344-known-gaps-in-the-agents-boundary-accepted-for-now/00-report.md @@ -0,0 +1,73 @@ +--- +status: open +opened: 2026-10-09 +located-in: [] +fixed-by: +amended-design: +--- + +# 344. Known gaps in the agent's boundary, accepted for now + +## Symptom + +Three reviews on 2026-10-09 checked whether an agent can become root or approve in the operator's name. They +covered ADR 0266 (agents on the control-node run under an account of their own), the root routes found beside it, +and ADR 0259 (the operator's answers on any channel). Most findings are being fixed in the pull requests those +records name. The gaps below are **not** being fixed now. + +The operator decided on 2026-10-09: *"that's not too big of an issue, i kind of trust you to not do weird stuff all +of a sudden. We can improve security later on, you should note down the known gaps though."* This issue is that +note. Each gap says what is open, why it matters, and what would close it. + +## The gaps + +1. **On every machine but the control-node, agents run as the operator, with passwordless sudo.** ADR 0266 gives + agents an account of their own on the control-node only. On the laptop, the workstation and the home server, an + agent session holds everything the operator's account holds, root included. + *Closes with:* a follow-up decision that extends ADR 0266 to every node where agents run. + +2. **Tools that run a caller's command as the operator remain on those machines.** These are the login shell's + `execute` (withheld on the control-node by [ADR 0268](../../02-DECISIONS/0268-the-login-shells-execute-is-withheld-on-the-control-node-until-a-call-to-it-needs-a-persons-approval.md)), + the launcher's `run` and the terminal emulator's `open`. Through any of them, an agent reaches root on that + machine. + *Closes with:* `execute: withhold` mesh-wide once the operator's command exists (issue 343), and the + approval mark of [research 039](../../01-RESEARCH/039-a-tool-that-needs-a-persons-approval/00-overview.md) + for the other two. + +3. **The operator's chat client runs on a machine where agents run as the operator.** An agent there can focus the + desktop client and tap Approve. Telegram then authenticates the tap as the operator, and the router issues a + genuine warrant. The client's data directory was also found readable by every account (directories 755, files + 644), so another account could copy the logged-in session. + *Closes with:* gap 1 on that machine; no agent access to the operator's display; the client's data kept 0700. + +4. **One X display gives its clients no isolation.** Any program with access to the operator's display can read + other windows and send them input. + *Closes with:* agents' accounts get no access to the operator's display (no X authority cookie). + +5. **The acts a warrant authorises can still be called directly, as verbs.** Release, stop, a plan's go and stop, a + service restart and silencing a condition all remain open to any agent through a tool runner. So "the mesh does + this only on approval" does not hold yet. + *Closes with:* the approval mark of research 039, which withholds those verbs from agents. + +6. **The tool runner on the control-node runs as the operator** and can read the forge administrator's password + file. A future tool that reads a path the caller chooses could leak it. + *Closes with:* the tool runner under an account of its own; secrets read only by the module that owns them. + +7. **The forge's tools still use a site administrator's token.** The tools' own guards refuse admin and + protection-weakening calls. The account itself could do more, because the forge puts protection edits under the + repository scope. + *Closes with:* a non-administrator forge account for the tools, with write access through a team. + +8. **The controller's credential can rewrite the router's record** (identities, asks, the hour after a link). The + router itself enforces the hour, but its record is only as safe as the controller. + *Closes with:* the router's state in a bucket only the router may write. + +9. **The root search's two bounds disagree.** The node-engine's search for programs that run as root stops itself + after two minutes, while the record allows it fifteen. On a large disk the verdict stays "not judged". + *Closes with:* one bound, settled in the node-engine with ADR 0266. + +## Why it is an issue + +Each gap is a known way around a rule the mesh states. A gap that is written down can be weighed and closed. A +gap that is forgotten turns into a belief that the rule holds. This issue stays open until every gap above is +closed or decided against in writing.