security: define user data isolation redline

docs/releases/V1R4C5-promotion-operator-handoff.md

@@ -1,158 +0,0 @@
-# V1R4C5 Baseline Promotion Operator Handoff
-
-Date: 2026-07-11
-
-Status: ready for operator promotion; baseline not yet switched
-
-## Current Verified State
-
-```text
-GitOps runtime: active
-workspace branch: request/promote-V1R4C5-recommended-20260711
-current active baseline: V1R4C3
-V1R4C5 tag: exists
-```
-
-`V1R4C5` tag is present in GitOps version list.
-
-Current active baseline remains `V1R4C3`.
-
-## Owner Decision
-
-Owner approved final promotion using the recommended scheme:
-
-```text
-Do not move existing V1R4C5 tag.
-Do not force-push.
-Promote using the metadata-complete release commit.
-Keep memory search disabled.
-```
-
-## Recommended Promotion Source
-
-Promotion source branch:
-
-```text
-release/v1r4c5-final-owner-approval-20260711
-```
-
-Metadata-complete promotion commit observed earlier:
-
-```text
-c128d6b
-```
-
-Existing immutable tag:
-
-```text
-V1R4C5
-```
-
-Tag object:
-
-```text
-ac9bdacb19ff66cba8046d75358866f0f0fffb82
-```
-
-Tag target commit:
-
-```text
-d457ac396147043ed5d0a3fd8b44bcb10f48bceb
-```
-
-The tag must not be moved.
-
-## Required Pre-Promotion Checks
-
-Run on the operator host:
-
-```bash
-cd /data/aios-gitops/workspace
-
-git fetch origin --tags
-
-git checkout release/v1r4c5-final-owner-approval-20260711
-git pull --ff-only origin release/v1r4c5-final-owner-approval-20260711
-
-git rev-parse --short HEAD
-test -f versions/V1R4C5.json
-git ls-remote --tags origin V1R4C5
-```
-
-Expected:
-
-```text
-HEAD is c128d6b or a later normal fast-forward commit on the release branch
-versions/V1R4C5.json exists
-refs/tags/V1R4C5 exists
-```
-
-## Promotion Command
-
-Use the existing baseline promotion mechanism to set:
-
-```text
-current_baseline = V1R4C5
-previous_baseline = V1R4C3
-git = <release branch HEAD containing versions/V1R4C5.json>
-promoted_by = openclaw/admin
-```
-
-Promotion reason:
-
-```text
-V1R4C5 reliability, watcher cleanup, user data isolation gate, and admin workbench read-only preparation; memory search remains disabled
-```
-
-## Hard Constraints
-
-Do not run:
-
-```bash
-git push --force
-```
-
-Do not:
-
-```text
-move refs/tags/V1R4C5
-enable memory search
-modify Gitea DB
-bulk merge old test/smoke/auth branches
-deploy full SR-04 portal rollout beyond read-only/admin visibility preparation
-```
-
-## Post-Promotion Verification
-
-After promotion, verify:
-
-```text
-getBaseline
-```
-
-Expected:
-
-```json
-{
-  "current_baseline": "V1R4C5",
-  "previous_baseline": "V1R4C3"
-}
-```
-
-Also verify:
-
-```text
-AIOS_MEMORY_ENABLED=false
-memory search disabled
-Gitea sentinel healthy
-```
-
-## Fallback
-
-If any promotion check fails:
-
-1. Stop promotion.
-2. Keep active baseline at V1R4C3.
-3. Keep memory search disabled.
-4. Do not move the existing tag.
-5. Reconcile release branch normally, without force-push.

docs/security/user-data-isolation-redline.md

@@ -0,0 +1,193 @@
+# User Data Isolation Redline
+
+Status: mandatory
+
+Decision date: 2026-07-10
+
+Baseline at decision: V1R4C3
+
+## Redline
+
+User data isolation is a hard system-design requirement.
+
+No component may read, write, search, rank, summarize, cache, or report data from another user, tenant, project, session, workspace, branch, agent, or task context unless explicit authorization and context binding exist.
+
+This applies to memory search, filesystem logs, vector indexes, search gateways, autonomous controller state, task records, audit logs, artifacts, and any fallback provider.
+
+## Incident Class
+
+Any cross-context data contamination is a security and reliability incident, not a normal feature bug.
+
+Examples:
+
+- memory search returns records from another project;
+- shared workspace logs are used as current-session evidence;
+- global `memory/` state mixes unrelated users or tasks;
+- fallback provider uses unscoped records;
+- agent reports status based on stale or unrelated context;
+- shared cache leaks content across users, groups, or sessions.
+
+## Core Rule
+
+A query may only access records satisfying all required scope dimensions:
+
+```text
+user_id
+  AND tenant_id / group_id
+  AND session_id or conversation_id
+  AND project_id
+  AND workspace_id
+  AND branch or baseline scope
+  AND agent_id / tool_context when applicable
+```
+
+If a dimension is unavailable, the safe behavior is deny-by-default or text-only fallback.
+
+## Forbidden Design
+
+The following are forbidden in production paths:
+
+1. Global shared memory directories without per-scope namespace.
+2. Search over untagged records.
+3. Search over records whose owner/scope cannot be proven.
+4. Trusting filesystem location alone as authorization.
+5. Treating memory search results as authoritative without provenance.
+6. Cross-session fallback without explicit allowlist.
+7. Auto-reporting from memory results that are not bound to the current runtime/baseline/task.
+8. Using stale context from unrelated branches or projects as current-state evidence.
+
+## Required Design
+
+Every persisted memory/state record must include immutable metadata:
+
+```text
+record_id
+user_id
+tenant_id or group_id
+session_id / conversation_id
+project_id
+workspace_id
+branch
+baseline
+agent_id
+source_tool
+created_at
+schema_version
+sensitivity
+retention_class
+```
+
+Every read/search request must include a scope envelope:
+
+```text
+request_user_id
+request_tenant_id / group_id
+request_session_id / conversation_id
+request_project_id
+request_workspace_id
+allowed_branches / current_branch
+allowed_baselines / current_baseline
+purpose
+```
+
+A record is readable only if its metadata matches the request scope policy.
+
+## Enforcement Layers
+
+### 1. Storage namespace isolation
+
+Memory/state paths must be namespaced:
+
+```text
+memory/{tenant_id}/{user_id}/{project_id}/{session_id}/...
+state/{tenant_id}/{project_id}/{workspace_id}/...
+```
+
+No production component may write unrelated contexts into a single global `memory/` directory.
+
+### 2. Metadata enforcement
+
+Untagged records are unreadable by default.
+
+Records without owner/scope metadata may be archived for forensic review but must not be searched or used for live reasoning.
+
+### 3. Query-time ACL
+
+Search must apply a mandatory scope filter before ranking or summarization.
+
+The ranking stage must never receive out-of-scope records.
+
+### 4. Provenance requirement
+
+Every memory/search result used for operational reporting must carry provenance:
+
+```text
+record_id
+scope metadata
+source path or source index
+match reason
+created_at
+```
+
+Responses must prefer current runtime truth sources over memory:
+
+```text
+getRuntimeStatus
+getBaseline
+listPatches
+explicit user-provided current context
+current branch files
+```
+
+Memory search is advisory only after scope validation.
+
+### 5. Fallback safety
+
+If provider search cannot prove scope isolation, the system must use text-only fallback or no-memory fallback.
+
+Fallback must not silently broaden the scope.
+
+### 6. Write-path isolation
+
+Writers must not append current-session records into shared directories.
+
+Writers must derive the target path from the scope envelope, not from a global default.
+
+### 7. Audit and detection
+
+The system must produce audit events when:
+
+- a record is denied due to scope mismatch;
+- untagged memory is encountered;
+- fallback disables memory search;
+- a provider tries to return out-of-scope records;
+- cross-context contamination is detected.
+
+## Acceptance Criteria
+
+A memory/search provider is allowed only if all tests pass:
+
+1. Same user, same project, same session -> records are visible.
+2. Same user, same project, different session -> visible only if policy permits.
+3. Same user, different project -> denied by default.
+4. Different user, same project -> denied unless explicitly shared by group policy.
+5. Different tenant/group -> denied.
+6. Untagged record -> denied.
+7. Stale branch/baseline record -> not used as current evidence.
+8. Provider fallback without scope support -> memory disabled.
+9. Search result provenance is returned and logged.
+10. Out-of-scope records are filtered before ranking/summarization.
+
+## Runtime Rule
+
+If memory search is enabled without these controls, recurrence is possible.
+
+Therefore, memory search must remain disabled or in scoped allowlist mode until the isolation acceptance suite is green.
+
+## Owner Gate
+
+Any change that enables shared memory search, cross-session recall, global vector indexes, or cross-agent memory reuse requires owner/admin approval.
+
+## Final Rule
+
+User data isolation is a redline. Reliability, convenience, or recall quality may not override it.

versions/V1R4C5.json

@@ -1,45 +0,0 @@
-{
-  "version": "V1R4C5",
-  "codename": "C5 reliability-security-admin-readonly",
-  "status": "promotion-request-ready",
-  "tag": "V1R4C5",
-  "tag_ref": "refs/tags/V1R4C5",
-  "tag_object": "ac9bdacb19ff66cba8046d75358866f0f0fffb82",
-  "tag_target_commit": "d457ac396147043ed5d0a3fd8b44bcb10f48bceb",
-  "recommended_promotion_branch": "release/v1r4c5-final-owner-approval-20260711",
-  "recommended_promotion_commit": "c128d6b",
-  "base_baseline": "V1R4C3",
-  "previous_baseline": "V1R4C3",
-  "created_at": "2026-07-11",
-  "created_by": "chatgpt-gitops-bot",
-  "release_type": "controlled-integration",
-  "promotion_policy": "owner-gated",
-  "owner_approval": {
-    "final_promotion_approved": true,
-    "memory_search_enabled": false,
-    "force_push_allowed": false,
-    "recommended_scheme_accepted": true
-  },
-  "scope": {
-    "included": [
-      "SR-01 Gitea reliability and branch consistency guardrails",
-      "SR-02 watcher/stuck command cleanup",
-      "User data isolation redline and enforcement gates",
-      "SR-04 admin workbench read-only visibility preparation"
-    ],
-    "excluded": [
-      "memory search activation",
-      "full cross-session memory recall",
-      "global vector index",
-      "full SR-04 production portal rollout",
-      "bulk merge of old test/smoke/auth branches",
-      "force-push based reconciliation"
-    ]
-  },
-  "deployment_constraints": {
-    "AIOS_MEMORY_ENABLED": false,
-    "memory_search_activation_requires_future_owner_approval": true,
-    "gitea_db_mutation_requires_owner_admin_approval": true,
-    "sr04_full_rollout_deferred": true
-  }
-}

versions/proposals/V1R4C5-promotion-recommended-scheme.json

@@ -1,39 +0,0 @@
-{
-  "version": "V1R4C5",
-  "request_type": "baseline_promotion",
-  "status": "owner_approved_ready_for_operator_promotion",
-  "decision": "use_recommended_scheme_do_not_move_existing_tag",
-  "current_active_baseline": "V1R4C3",
-  "target_baseline": "V1R4C5",
-  "promotion_source_branch": "release/v1r4c5-final-owner-approval-20260711",
-  "promotion_commit": "c128d6b",
-  "existing_tag": {
-    "name": "V1R4C5",
-    "tag_object": "ac9bdacb19ff66cba8046d75358866f0f0fffb82",
-    "target_commit": "d457ac396147043ed5d0a3fd8b44bcb10f48bceb",
-    "policy": "immutable_do_not_move"
-  },
-  "reason": "V1R4C5 metadata was completed after tag creation. Recommended scheme preserves tag immutability and promotes the metadata-complete release commit through normal baseline promotion.",
-  "owner_approval": {
-    "final_promotion_allowed": true,
-    "recommended_scheme_accepted": true,
-    "force_push_allowed": false,
-    "memory_search_enabled": false
-  },
-  "constraints": [
-    "Do not move or recreate refs/tags/V1R4C5",
-    "Do not force-push",
-    "Keep AIOS_MEMORY_ENABLED=false",
-    "Do not activate memory search",
-    "Do not bulk merge old test/smoke/auth branches",
-    "Do not mutate Gitea DB without separate owner/admin approval"
-  ],
-  "operator_action": [
-    "Verify release/v1r4c5-final-owner-approval-20260711 contains versions/V1R4C5.json",
-    "Promote baseline to V1R4C5 using promotion commit c128d6b or the resolved full commit for that release HEAD",
-    "Record previous_baseline=V1R4C3",
-    "Record promoted_by=openclaw/admin",
-    "Record promotion reason: V1R4C5 reliability, watcher cleanup, user data isolation gate, and admin workbench read-only preparation; memory search remains disabled",
-    "Run post-promotion getBaseline verification"
-  ]
-}