aaronrene / knowtation public
feat/sec-kn-4a-delegation-principal-binding-freeze #9 / 9
aaronrene · 44 days ago · Jul 26, 2026 · Diff

SEC-KN-4a: freeze P4 delegation principal binding at apply (review BLOCKED).

Delegation apply trusts proposal.body.principal_ref and the canister proposal record has no authorship column, so approval mints a bearer grant for an attacker-named principal. This freezes the contract: bind the principal to the server-recorded proposal author (canister created_by from X-Actor-Id only, self-hosted proposed_by), refuse on mismatch, reject org_ref: authority refs in v0, and gate the previously ungated apply path.

Deliberate deviation from the audit wording: the principal binds to the recorded author, not the authenticated actor at apply -- the approver is often the workspace owner reviewing a member's proposal, so binding to the approver would be a second impersonation bug.

Freeze review round 1 = blocked; 6 findings amended, 2 escalated to the operator (fail-open author fallback; non-idempotent migration hook). SEC-KN-4b must not start until freeze section 12 D1/D2 are ratified.

sha256:f32bb4e9f6e5223afb08d9e9bf9b31811d7c1683a51aa938adb29fcb3b197df3 sha
sha256:5954c433e02f1be6e102da24f6ccf23649373a50feb9cb819a306969ab621e0d parent
+47 ~11 −5 symbols
sha256:c0a179606e49e71d84a2c6ff13f70dd78e4542473073e442f4027eb5ef800d1a snapshot
+47
symbols added
~11
symbols modified
−5
symbols removed
0
dead code introduced
Semantic Changes 63 symbols
~ docs/SEC-KN-4-DELEGATION-PRINCIPAL-BINDING-FREEZE.md .md 42 symbols added
+ SEC-KN-4 — frozen spec: delegation principal binding at apply + proposal authorship section SEC-KN-4 — frozen spec: delegation principal binding at apply + proposal authorship L1–455
+ Plain-language summary section 1. Plain-language summary L33–59
+ Technical summary section Technical summary L46–59
+ Ground-truth edge section 10. Ground-truth edge L421–431
+ Review record section 11. Review record L431–449
+ table section table L438–442
+ Operator decisions required before SEC-KN-4b (Tier 3 / escalated) section 12. Operator decisions required before SEC-KN-4b (Tier 3 / escalated) L449–455
+ table section table L451–455
+ Ground truth — what the code does today (file+line) section 2. Ground truth — what the code does today (file+line) L59–105
+ 1 Exploit paths (ordered by precondition cost) section 2.1 Exploit paths (ordered by precondition cost) L82–105
+ table section table L84–90
+ table section table L63–81
+ Frozen trust model section 3. Frozen trust model L105–141
+ 1 Spec correction (deliberate deviation from the audit's fix wording) section 3.1 Spec correction (deliberate deviation from the audit's fix wording) L114–127
+ 2 Trust assumptions this fix inherits (stated, not assumed silently) section 3.2 Trust assumptions this fix inherits (stated, not assumed silently) L127–141
+ table section table L107–113
+ Frozen rules (SEC-KN-4b implements exactly these) section 4. Frozen rules (SEC-KN-4b implements exactly these) L141–344
+ 1 Error codes introduced section 4.1 Error codes introduced L313–325
+ table section table L315–322
+ 2 Frozen signature section 4.2 Frozen signature L325–344
+ code[js] variable variable code[js] L327–335
+ R1 — Server-only proposal authorship section R1 — Server-only proposal authorship L143–188
+ R2 — Author is required at apply (fail closed) section R2 — Author is required at apply (fail closed) L188–235
+ table section table L211–219
+ 1 — Frozen check order inside precheckApprovedDelegationProposal section R2.1 — Frozen check order inside precheckApprovedDelegationProposal L235–258
+ R3 — Re-derive the consent principal section R3 — Re-derive the consent principal L258–270
+ R4 — Re-derive the identity owner section R4 — Re-derive the identity owner L270–275
+ R5 — org_ref: authority refs are rejected in v0 section R5 — org_ref: authority refs are rejected in v0 L275–287
+ R6 — Narrow the propose-time surface section R6 — Narrow the propose-time surface L287–294
+ R7 — Apply is gated section R7 — Apply is gated L294–301
+ R8 — No cross-partition apply section R8 — No cross-partition apply L301–307
+ R9 — Delegation intents stay out of self-apply section R9 — Delegation intents stay out of self-apply L307–313
+ Scope section 5. Scope L344–359
+ Test matrix — seven tiers plus security regression section 6. Test matrix — seven tiers plus security regression L359–378
+ table section table L364–373
+ Definition of done for SEC-KN-4b section 7. Definition of done for SEC-KN-4b L378–393
+ Tier 3 gates (not part of SEC-KN-4b) section 8. Tier 3 gates (not part of SEC-KN-4b) L393–409
+ table section table L395–401
+ Residual risks and non-goals (explicitly accepted) section 9. Residual risks and non-goals (explicitly accepted) L409–421
+ table section table L411–418
+ Freeze-contract declaration section Freeze-contract declaration L11–33
+ code[yaml] variable variable code[yaml] L13–30
~ docs/OVERSEER-HANDOVER.md .md 5 symbols added, 5 symbols removed, 5 symbols modified
− NEXT SESSION — SEC-KN-4 delegation principal_ref binding (PRIMARY) section NEXT SESSION — SEC-KN-4 delegation principal_ref binding (PRIMARY) L20–96
− Governance gates checklist section Governance gates checklist L81–96
− Knowtation-owned findings (from Pass 2) section Knowtation-owned findings (from Pass 2) L61–81
− table section table L63–73
− code[text] variable variable code[text] L29–60
+ NEXT SESSION — SEC-KN-4 operator ratification, then SEC-KN-4b build (PRIMARY) section NEXT SESSION — SEC-KN-4 operator ratification, then SEC-KN-4b build (PRIMARY) L20–130
+ Governance gates checklist section Governance gates checklist L113–130
+ Knowtation-owned findings (from Pass 2) section Knowtation-owned findings (from Pass 2) L93–113
+ table section table L95–105
+ code[text] variable variable code[text] L46–92
~ Overseer Handover — Knowtation
~ Change log
~ table
~ Verified snapshot (what exists now)
~ table
~ docs/ROADMAP.md .md 6 symbols modified
~ Roadmap — knowtation
~ Build queue
~ table
~ Cross-references
~ Current status (2026-07-26)
~ table
← Older Oldest on feat/sec-kn-4a-delegation-principal-binding-freeze
All commits Newer SEC-KN-4a: freeze review round 2 — revert self-ratification, tig… sha256:6f1a671d4fda6bf8b5eea613e53f93d7cd466273255310385dbc291b18dfbe10

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:f32bb4e9f6e5223afb08d9e9bf9b31811d7c1683a51aa938adb29fcb3b197df3 --body "your comment"