 Claude
|
3e5f92ef8b
|
security: eliminate hardcoded HMAC keys, fix timing attacks, remove command injection
- Remove hardcoded DEFAULT_SIGNING_KEY from proof.ts, artifacts.ts, evolution.ts
Constructors now require explicit signingKey (fail-closed)
- Add timingSafeEqual() XOR-based constant-time comparison to proof.ts,
artifacts.ts, authority.ts (prevents HMAC timing side-channels)
- Fix command injection in headless.ts: replace execFile('sh', ['-c', cmd])
with direct arg-array execFile('claude', ['-p', prompt, ...])
- Fix command injection in analyzer.ts: same shell-free pattern
- Remove dead code: unused toLowerCase() in analyzer.ts extractMetrics
and scoreCompleteness
- Hoist gates.ts GATE_DECISION_SEVERITY to module-level constant
- Add ConformanceRunner signingKey parameter for explicit key propagation
- Update tests: 3 new "should throw without key" assertions
- Add flight build report (docs/reports/flight-build-report.md)
1,331 tests passing.
https://claude.ai/code/session_01HLi9WmfvFgkDLJxLKGAUTf
|
2026-02-02 01:51:26 +00:00 |
|
|
Claude
|
4d68d8b47a
|
feat: add capability algebra and evolution pipeline
Capability algebra: typed capability objects with grant, restrict,
delegate, expire, revoke, attest operations. Permissions are composable
data, not scattered config. Supports delegation chains, constraint
intersection, and subset checking.
Evolution pipeline: signed change proposals with simulation, replay
comparison, staged rollout, and automatic rollback on divergence.
Every change to rules/policies/tools follows:
propose → simulate → compare → stage → promote/rollback.
https://claude.ai/code/session_01HLi9WmfvFgkDLJxLKGAUTf
|
2026-02-01 11:44:31 +00:00 |
|