AIOS Governed Continuation
abe81d7f64
fix(sec): port G7 security-critical closure (S1-S5 + negative tests) onto final integration tree
Ported from authority branch agent/g7-security-critical-closure-20260914 (d5f5c9b, base=beabd053).
S1 auth: role/user from server token->identity mapping, ignore client X-AIOS-* headers.
S2 bootstrap credential: PBKDF2 random-salt, fail-closed SECRET, no plaintext fallback, session HMAC+expiry.
S3 path containment + control-plane file-read hardening.
S4 admin UI XSS + real governed approval + dashboard CSRF/branch validation.
S5 runtime delivery: registry.yaml conflict, openapi securityScheme, install.sh fail propagation, do_POST shadowing.
Tests: 5 negative suites (66 tests). Evidence pack in deliverables/g7-evidence/.
2026-09-14 22:11:51 +08:00
..
2026-09-07 23:14:29 +08:00
2026-07-26 05:03:50 +08:00
2026-08-06 19:10:47 +08:00
2026-07-07 19:45:51 +08:00
2026-09-14 22:11:51 +08:00
2026-08-08 23:33:21 +08:00
2026-09-10 12:09:47 +08:00
2026-07-12 15:55:38 +08:00
2026-07-06 17:07:09 +08:00
2026-07-06 19:16:31 +08:00
2026-08-07 02:20:41 +08:00
2026-09-10 12:09:47 +08:00
2026-08-09 18:14:22 +08:00
2026-07-24 11:29:00 +08:00
2026-07-09 11:20:22 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-07-06 14:44:09 +08:00
2026-09-12 02:44:54 +08:00