Release readiness: resolve audit blockers and qualify the September 17 candidate

[defangdevs]

Release target: 2026-09-17. Audit baseline: 0cc18b8, still current master when the findings were filed on 2026-09-10.

No P0 was confirmed by this audit. The P1 findings below are release blockers for the affected supported capabilities. They require local access, operator interaction, a particular deployment configuration, or correction of the release process; no unauthenticated Internet takeover of the default deployment was demonstrated. This triage is not a claim that an exhaustive security assessment found no other vulnerabilities.

V1 fixes and remaining release blockers (P1)

• security: unauthenticated ttyd loopback ports bypass Linux-user isolation #628 Move ttyd to Unix sockets and reject foreign browser origins. Merged fix(web): put ttyd on a per-user unix socket, not a loopback port (#628) #650; reviewed with no residual finding.
• security: download symlinks can expose files outside the authenticated user's root #630 Confine downloads against out-of-root symlinks. Merged fix(web): serve the file drop from the per-user daemon, confined (#630) #654 + fix(web): take caddy's group access off the file drop (#630 follow-up) #659; reviewed together with no residual finding.
• security: active downloads inherit the settings and terminal browser origin #631 Prevent active downloads from executing in the management browser origin. Merged fix(web): serve ~/downloads as attachments, lock down framing (#631) #653; reviewed with the download follow-ups.
• Avoid sending WebPassword plaintext to CloudFormation/user-data #25 Remove recoverable AWS bootstrap passwords; include existing-box rotation guidance.
• release: require green checks and promote only tested immutable artifacts #632 Require green checks/review and promote exactly the tested immutable release. Open ci(release): require a reportable gate and promote only tested artifacts (#632) #648 needs changes: publication bypasses, mutable rollback manifests, incorrect candidate checkout, missing Lightsail boot qualification, and rollback checks after publication. Five review findings.
• sessions: refuse registry mutations when the sidecar lock cannot be acquired #633 Refuse registry writes after lock failure. Merged fix(sessions): refuse registry mutations when the sidecar lock cannot be acquired #656; shell and Python refusal/retry paths reviewed.
• tests/webhook.nix is 267 bytes from the testScript ceiling, and the guard that should have said so was broken and unrun #610 Shrink the webhook VM script and wire the size guard into CI. Merged ci: shrink tests/webhook.nix under the testscript-fits ceiling, and run the guard #645. Duplicate testscript-fits check exists but ci.yml never builds it #570 remains open administratively; it is not a separate missing implementation.

Conditional security and reliability follow-up (P2)

• security: bound stale portal signing keys and serialize JWKS refreshes #634 Bound stale portal keys and serialize JWKS refreshes. This gates portal sign-in support if that capability is in release scope.
• security: bound settings/auth request bodies before reading or draining them #635 Bound settings/auth request bodies, draining, read time, and public worker concurrency. This also gates portal qualification.
• sessions: keep first-use harness downloads out of the supervisor reconcile loop #636 Keep first-use downloads out of the session reconciliation loop.
• Make the session registry a single atomic mutation authority #528 Consolidate complete registry mutations behind one authority; do not make the focused lock-refusal fix wait for this refactor.
• Self-update service: verify releases before applying (supply-chain hardening) #46 Verify signed release identity in the update path, after a tested release/promotion channel exists.

Post-v1 scope and simplification

• security: agent-owned Caddy snippets can bypass other users' authentication #629 (P2 / post-v1) Isolate shared Caddy authority for multiple Linux users. fix(web): declare extra vhosts instead of importing agent-written Caddy snippets (#629) #655 is open; requested revision or deferral because it drops existing snippet-defined sites and removes self-service publishing. Preserve the single-user workflow for v1.

• refactor: split native configuration, rendering, activation, and update responsibilities #637 Split native schema/render/commit/activation/update responsibilities.

• Split the settings daemon into importable responsibility modules #529 Split settings-daemon responsibilities into importable components and smaller route handlers.

• Backend parity by construction: one binding contract for both renderers (#154 Phase 5 design) #451 Continue the shared backend-contract work while retaining parity checks.

• Generate AWS and Azure native bootstrap from one shared script #530 Generate common native bootstrap with explicit provider adapters.

These are existing or separately filed issues, not additional implementations to duplicate inside this tracker. Historical incident narratives can move to the wiki while preserving short invariants beside the code.

Scope and evidence required before promotion

Confirmed scope: single-user VMs for v1 (one Linux agent user per box), with no shared tenancy. Multi-user support is post-v1. Browser-origin security, credential handling, and single-user reliability remain in scope. The supported backend/cloud/architecture matrix and portal inclusion still need an explicit release decision; native Ubuntu and one fresh-boot-qualified cloud path remain the proposed minimum. Do not claim shared-tenancy isolation for v1.

• Confirm the tenancy scope: single-user VMs; multi-user support is post-v1.
• Freeze new features and record the supported backend/cloud/architecture matrix and portal inclusion.
• Add SECURITY.md with a private reporting route, supported versions, and credential recovery guidance; verify private vulnerability reporting is enabled/configured.
• Preserve existing secret scanning and push protection; record a dependency/secret scan and resolve release-impacting results.
• Keep a checked inventory of declared native/VM checks and CI membership, including coverage of source/test changes in workflow triggers.
• Enumerate and run all current native checks and required x86 VM scenarios against the actual candidate. Keep browser-origin and single-user regressions in scope; two-user qualification is deferred with shared tenancy.
• Fresh-deploy the chosen cloud artifact and exercise sign-in, sessions, reconnect, downloads, and password rotation. Renderer fixtures alone do not qualify a cloud bootstrap.
• Exercise reboot, interrupted/failed update, rollback, restore, and an overnight soak with preserved session data.
• Record immutable source/dependency/template identities, and promote exactly the tested artifacts. Do not publish a separately resolved unstable dependency set.

Baseline audit evidence (2026-09-10): all 34 then-declared aarch64 native checks passed. The webhook size guard failed at 130805 bytes and was omitted from CI at that baseline; #645 subsequently reduced the script and wired the guard into CI. These baseline results do not qualify a later release candidate.

PR review evidence (2026-09-11): reviewed #650, #653, #654, #655, #656, #659 and #648, including cumulative master 88a290b for merged fixes. No reviewed merged issue needed reopening. Locally, 41 download + 42 registry + 16 session-route + 21 release-manifest + 20 changed-path tests passed (140 total). A disposable ttyd probe accepted the matching origin and closed the foreign-origin request without upgrading. Manifest probes reproduced the rollback pin drift and older-candidate checkout mismatch. Existing PR CI was green; no new cloud deployments or local x86 VM/browser suites were run. No production configuration was changed.

#634, #635, #636 and #637 remain open; no associated fix PR was found during this review. Do not mark them complete based on the other audit PRs. The detailed review update records the scope and findings.

Work order for the week

1. Freeze scope and enforce CI/review/promotion requirements.
2. Preserve the single-user publishing workflow; defer shared-tenancy redesign.
3. Fix download and chosen-cloud credential handling.
4. Verify the merged lock-refusal and test-guard fixes on the candidate; finish remaining in-scope reliability work.
5. Fresh-deploy the chosen candidate and complete dependency/secret checks.
6. Prove recovery/rollback, then soak.
7. Record go/no-go and promote only if all supported-scope gates pass.

If the work does not fit the available staffing, reduce the supported feature set or delay the affected capability rather than weakening the security gates. Broad framework/backend rewrites are outside this release week.

Repository ownership

All confirmed defects here are owned by agent-box. In particular, JWKS and HTTP parsing live in modules/src/settings-daemon.py; ttyd/Caddy behavior is controlled by agent-box's integration; the registry and installation loop are agent-box code. No new local-channels defect was established by this audit, so no duplicate/speculative upstream issue was filed there. Webhook HMAC authenticates a sender service, not the trustworthiness of an issue author's content; credentials and autonomous-dispatch authority must remain scoped accordingly.

[defangdevs]

Status incorporated into the tracker body and checkboxes. Completed merged fixes are checked; #632 remains open; #629 is P2 / post-v1. Candidate qualification remains unchecked.

PR review update (2026-09-11), scoped per the user to single-user VMs for v1; shared tenancy is post-v1.

• security: unauthenticated ttyd loopback ports bypass Linux-user isolation #628 / fix(web): put ttyd on a per-user unix socket, not a loopback port (#628) #650, security: download symlinks can expose files outside the authenticated user's root #630 / fix(web): serve the file drop from the per-user daemon, confined (#630) #654 + fix(web): take caddy's group access off the file drop (#630 follow-up) #659, security: active downloads inherit the settings and terminal browser origin #631 / fix(web): serve ~/downloads as attachments, lock down framing (#631) #653, and sessions: refuse registry mutations when the sidecar lock cannot be acquired #633 / fix(sessions): refuse registry mutations when the sidecar lock cannot be acquired #656: reviewed including cumulative current master 88a290b. No actionable residual finding; keep the issues closed. Posted review notes on each PR.
• release: require green checks and promote only tested immutable artifacts #632 / ci(release): require a reportable gate and promote only tested artifacts (#632) #648: five findings posted in ci(release): require a reportable gate and promote only tested artifacts (#632) #648 (review). Keep this release blocker open.
• security: agent-owned Caddy snippets can bypass other users' authentication #629 / fix(web): declare extra vhosts instead of importing agent-written Caddy snippets (#629) #655: requested revision or deferral because removing self-service site publishing is unnecessary feature loss for single-user v1. Cross-user isolation is post-v1, not a release blocker.
• security: bound stale portal signing keys and serialize JWKS refreshes #634, security: bound settings/auth request bodies before reading or draining them #635, sessions: keep first-use harness downloads out of the supervisor reconcile loop #636, refactor: split native configuration, rendering, activation, and update responsibilities #637: still open; no associated fix PR found in issue timelines or the latest 100 PR titles/bodies. These have not been reviewed as completed fixes.

Validation: 41 download, 42 registry, 16 session-route, 21 release-manifest and 20 changed-path tests pass locally (140 total). Disposable ttyd origin probe: matching origin upgraded, foreign origin closed without upgrade. Manifest probes reproduced changed dependency pins for the same SHA and the older-candidate checkout mismatch. Existing PR CI is green. No new cloud deployments or local x86 VM/browser suites were run, and no production configuration changed.

For the week-one release: finish #632 and the remaining in-scope security/reliability work; defer the broad CLI split (#637) and multi-user redesign. No merged issue needed reopening on the evidence reviewed.