gamertan
bf56dbce0f
Export the reviewed allowlisted snapshot from private source commit 07c1655921f21ee5e4fc4d85639d199e8867b17d. This records the Docker Compose activation, schema-compatible rollback, and stateful migration resource findings from Observatory Preview 19 dogfooding. AI-Assisted: OpenAI Codex Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2.9 KiB
Threat model
Protected properties
- A release is identified by an operator-approved SHA-256 digest.
- Only regular, bounded, allowlisted archive entries are extracted.
- Release roots, state, pointers, and Caddy files reject symlink substitution at their checked boundaries.
- Configuration is strict JSON and is never interpolated into a shell command.
- Candidate health is established before traffic or any current release pointer changes. New deployments also satisfy configured content smoke checks; rollback uses health and readiness because future-release content markers are not valid requirements for an older retained release.
- Caddy configuration validates before reload.
- Canonical routed origins and the previous blue/green slot or singleton handoff candidate remain under probe for the configured activation window; a failure restores the old handler and release pointer.
- Desired, candidate, active, previous, and failed-attempt identities remain distinct in state. Bounded deployment events contain no arbitrary command output or environment values and cannot block deployment.
- An activation failure restores the previously observed state.
- Active and previous releases survive pruning.
- The restricted receiver accepts one versioned bounded stream, one allowlisted service name, and one explicitly approved digest. It accepts no remote path, URL, environment value, or shell expression.
- OpenSSH host keys are pinned; forwarding, PTYs, proxy commands, local commands, and user SSH configuration are disabled by the client invocation.
- Production secret values are absent from configuration, process arguments, artifacts, manifests, reports, deployment state, and Tend logs.
- One host-wide lock serializes shared Caddy activation without stopping or reconfiguring unrelated services.
Trusted inputs
Reviewed source, the pinned Go toolchain, root-owned server policy and service configuration, systemd unit files, the Caddy handler template, the operator, and the target host's root account are trusted. Packaging a hostile repository can execute hostile Go compiler hooks or consume resources; Tend is not a source-code sandbox.
Adversarial inputs
Artifact paths and bytes, protocol frames, requested service names, archive metadata, stale or malformed state, HTTP responses, subprocess failures, and filesystem objects at managed paths are validated and fail closed. Process output and receive fields are bounded.
Non-goals and preview limits
Tend does not defend against a concurrently malicious root user, a compromised kernel/toolchain/systemd/Caddy/OpenSSH installation, denial of service by the trusted application, or secrets an application itself exposes. It does not manage data migrations, databases, containers, Kubernetes, or application-specific activation. EQL therefore remains outside the generic deployment adapter until its SQLite/catalog publication checkpoints can be modeled explicitly.