Skip to content

Commit 9e0df3b

Browse files
jeremymanningjeremymanning
authored
Merge pull request #6 from ContextLab/002-safety-hardening
Safety hardening — red team response (issue #4)
2 parents 5fa05ce + 3b184b9 commit 9e0df3b

91 files changed

Lines changed: 8293 additions & 171 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/safety-hardening-ci.yml‎

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
name: Safety Hardening — Principle V Tests
2+
3+
on:
4+
push:
5+
branches: [002-safety-hardening, main]
6+
pull_request:
7+
branches: [main]
8+
9+
env:
10+
CARGO_TERM_COLOR: always
11+
RUST_BACKTRACE: 1
12+
13+
jobs:
14+
# ─── Standard tests (all platforms) ─────────────────────────────────
15+
test-linux:
16+
name: Tests (Linux)
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@v4
20+
- uses: dtolnay/rust-toolchain@stable
21+
with:
22+
components: clippy
23+
- uses: Swatinem/rust-cache@v2
24+
25+
- name: Install protoc
26+
run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
27+
28+
- name: Build
29+
run: cargo build --lib
30+
31+
- name: Run unit + integration tests
32+
run: cargo test --lib
33+
34+
- name: Clippy (zero warnings)
35+
run: cargo clippy --lib -- -D warnings
36+
37+
- name: Verify attestation rejects forged quotes
38+
run: cargo test --lib verification::attestation::tests -- --nocapture
39+
40+
- name: Verify policy engine rejects invalid submissions
41+
run: cargo test --lib policy::engine::tests -- --nocapture
42+
43+
- name: Verify governance separation of duties
44+
run: cargo test --lib governance::roles::tests -- --nocapture
45+
46+
- name: Verify egress IP blocking
47+
run: cargo test --lib sandbox::egress::tests -- --nocapture
48+
49+
- name: Verify incident containment auth
50+
run: cargo test --lib incident::containment::tests -- --nocapture
51+
52+
- name: Verify artifact registry separation
53+
run: cargo test --lib registry::tests -- --nocapture
54+
55+
test-macos:
56+
name: Tests (macOS)
57+
runs-on: macos-latest
58+
steps:
59+
- uses: actions/checkout@v4
60+
- uses: dtolnay/rust-toolchain@stable
61+
- uses: Swatinem/rust-cache@v2
62+
63+
- name: Install protoc
64+
run: brew install protobuf
65+
66+
- name: Build
67+
run: cargo build --lib
68+
69+
- name: Run all tests
70+
run: cargo test --lib
71+
72+
- name: Verify macOS idle detection works
73+
run: cargo test --lib preemption::triggers::tests::system_idle_ms_returns_something_on_macos -- --nocapture
74+
75+
- name: Verify sandbox cleanup removes work dir
76+
run: cargo test --lib sandbox::apple_vf::tests -- --nocapture
77+
78+
test-windows:
79+
name: Tests (Windows)
80+
runs-on: windows-latest
81+
steps:
82+
- uses: actions/checkout@v4
83+
- uses: dtolnay/rust-toolchain@stable
84+
- uses: Swatinem/rust-cache@v2
85+
86+
- name: Install protoc
87+
run: choco install protoc -y
88+
89+
- name: Build
90+
run: cargo build --lib
91+
92+
- name: Run all tests
93+
run: cargo test --lib
94+
95+
# ─── KVM sandbox tests (Linux with KVM) ─────────────────────────────
96+
sandbox-linux-kvm:
97+
name: Sandbox (Linux KVM)
98+
runs-on: ubuntu-latest
99+
steps:
100+
- uses: actions/checkout@v4
101+
- uses: dtolnay/rust-toolchain@stable
102+
- uses: Swatinem/rust-cache@v2
103+
104+
- name: Install protoc
105+
run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
106+
107+
- name: Check KVM availability
108+
id: kvm
109+
run: |
110+
if [ -e /dev/kvm ]; then
111+
echo "available=true" >> "$GITHUB_OUTPUT"
112+
echo "KVM is available"
113+
else
114+
echo "available=false" >> "$GITHUB_OUTPUT"
115+
echo "KVM not available — sandbox tests will be skipped"
116+
fi
117+
118+
- name: Install Firecracker
119+
if: steps.kvm.outputs.available == 'true'
120+
run: |
121+
FC_VERSION="1.6.0"
122+
curl -fsSL "https://github.com/firecracker-microvm/firecracker/releases/download/v${FC_VERSION}/firecracker-v${FC_VERSION}-x86_64.tgz" | tar xz
123+
sudo mv "release-v${FC_VERSION}-x86_64/firecracker-v${FC_VERSION}-x86_64" /usr/local/bin/firecracker
124+
sudo chmod +x /usr/local/bin/firecracker
125+
firecracker --version
126+
127+
- name: Run sandbox tests (KVM)
128+
if: steps.kvm.outputs.available == 'true'
129+
run: |
130+
cargo test --lib sandbox::firecracker::tests -- --nocapture
131+
echo "Firecracker sandbox tests passed"
132+
133+
- name: Run egress enforcement tests
134+
run: cargo test --lib sandbox::egress::tests -- --nocapture
135+
136+
- name: Generate Principle V evidence artifact
137+
if: always()
138+
env:
139+
KVM_AVAILABLE: ${{ steps.kvm.outputs.available }}
140+
run: |
141+
mkdir -p evidence
142+
echo "# Principle V Test Evidence" > evidence/sandbox-linux.md
143+
echo "Date: $(date -u)" >> evidence/sandbox-linux.md
144+
echo "Runner: $(uname -a)" >> evidence/sandbox-linux.md
145+
echo "KVM available: ${KVM_AVAILABLE}" >> evidence/sandbox-linux.md
146+
cargo test --lib sandbox 2>&1 | tail -1 >> evidence/sandbox-linux.md
147+
148+
- uses: actions/upload-artifact@v4
149+
if: always()
150+
with:
151+
name: evidence-sandbox-linux
152+
path: evidence/
153+
154+
# ─── Software TPM attestation tests ──────────────────────────────────
155+
attestation-swtpm:
156+
name: Attestation (swtpm)
157+
runs-on: ubuntu-latest
158+
steps:
159+
- uses: actions/checkout@v4
160+
- uses: dtolnay/rust-toolchain@stable
161+
- uses: Swatinem/rust-cache@v2
162+
163+
- name: Install protoc and swtpm
164+
run: |
165+
sudo apt-get update
166+
sudo apt-get install -y protobuf-compiler swtpm swtpm-tools tpm2-tools || echo "swtpm install failed — using built-in test helpers"
167+
168+
- name: Run attestation verification tests
169+
run: |
170+
cargo test --lib verification::attestation::tests -- --nocapture
171+
echo "All attestation tests passed"
172+
173+
- name: Run manifest signature tests
174+
run: |
175+
cargo test --lib scheduler::manifest::tests -- --nocapture
176+
echo "Manifest signature verification tests passed"
177+
178+
- name: Generate Principle V evidence artifact
179+
if: always()
180+
run: |
181+
mkdir -p evidence
182+
echo "# Principle V Test Evidence — Attestation" > evidence/attestation.md
183+
echo "Date: $(date -u)" >> evidence/attestation.md
184+
echo "Runner: $(uname -a)" >> evidence/attestation.md
185+
which swtpm > /dev/null 2>&1 && swtpm --version >> evidence/attestation.md || echo "swtpm: not available" >> evidence/attestation.md
186+
cargo test --lib verification::attestation 2>&1 | tail -1 >> evidence/attestation.md
187+
188+
- uses: actions/upload-artifact@v4
189+
if: always()
190+
with:
191+
name: evidence-attestation
192+
path: evidence/
193+
194+
# ─── Full safety audit summary ───────────────────────────────────────
195+
safety-audit:
196+
name: Safety Audit Summary
197+
runs-on: ubuntu-latest
198+
needs: [test-linux, test-macos, test-windows, sandbox-linux-kvm, attestation-swtpm]
199+
if: always()
200+
env:
201+
LINUX_RESULT: ${{ needs.test-linux.result }}
202+
MACOS_RESULT: ${{ needs.test-macos.result }}
203+
WINDOWS_RESULT: ${{ needs.test-windows.result }}
204+
SANDBOX_RESULT: ${{ needs.sandbox-linux-kvm.result }}
205+
ATTEST_RESULT: ${{ needs.attestation-swtpm.result }}
206+
steps:
207+
- name: Check all jobs passed
208+
run: |
209+
echo "=== Safety Hardening CI Results ==="
210+
echo "test-linux: ${LINUX_RESULT}"
211+
echo "test-macos: ${MACOS_RESULT}"
212+
echo "test-windows: ${WINDOWS_RESULT}"
213+
echo "sandbox-linux-kvm: ${SANDBOX_RESULT}"
214+
echo "attestation-swtpm: ${ATTEST_RESULT}"
215+
echo ""
216+
if [ "${LINUX_RESULT}" != "success" ] || \
217+
[ "${MACOS_RESULT}" != "success" ] || \
218+
[ "${WINDOWS_RESULT}" != "success" ]; then
219+
echo "FAIL: Core tests failed on one or more platforms"
220+
exit 1
221+
fi
222+
echo "PASS: All core platform tests passed"
223+
echo "Note: KVM/swtpm tests may skip if hardware unavailable"

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,4 @@ Thumbs.db
2525

2626
# Evidence artifacts (generated, not committed)
2727
evidence/
28+
.credentials

0 commit comments

Comments
 (0)