Remote-MCP: tamper-evident audit, full-surface secret redaction, and attribution-is-not-authentication #959

New Issue

2026-07-28T02:53:39-05:00

jcwalker3 commented

2026-07-28 02:53:39 -05:00

Parent epic: #929.
Cross-link: #700, #171, #18, #86, #955 (certification umbrella).
Depends on: #938, #957.

Goal supported: secure isolation.

Problem — three related defects

(a) Redaction coverage is incomplete. Redaction is enforced on tool results, log lines, and workflow comments (#700 AC1) and on raw URLs in one output path (#171, closed). Nothing covers structured errors, exception payloads, traces, request headers, or subprocess output — every one of which is a new surface once the endpoint is remote.

(b) The audit trail is not tamper-evident. #18 (closed) added audit logging of mutating actions with profile metadata. The records are appended in the clear and nothing detects retroactive modification, so an attacker with host access can erase their own trail.

(c) Attribution can be mistaken for authentication. #86 (closed) introduced opaque LLM-Agent-SHA attribution for issues, branches, PRs, and review handoffs. It is a caller-supplied attribution field. No issue states that it — or any similar field — must never be accepted as authentication or authorization, and #932's per-request principal is exactly where such a field would be mistaken for one.

Current evidence

#700 AC1 enumerates three surfaces.
#171's title scopes to "raw URL exposure in PR inventory/review failure output".
#18's title is "Audit-log Gitea MCP mutating actions with execution profile metadata".
#86's title is "Add opaque LLM agent SHA attribution for issues, branches, PRs, and review handoffs".

Scope

Extend redaction to structured errors, exceptions, traces, URLs, headers, audit records, and subprocess stdout/stderr.
Make the audit chain tamper-evident (hash-chained or signed) with verification tooling.
Assert in code and test that attribution fields are recorded as metadata only and can never influence an authorization decision.

Non-goals

Replacing #700's local walls.
Changing the attribution format from #86.
A full SIEM.

Security and concurrency boundaries

Attribution is metadata. Authentication is the authenticated principal. The two must be distinct fields in every audit record and must never be interchangeable in an authorization decision.

Acceptance criteria

No credential material appears on any enumerated surface, proven per surface.
The audit chain detects insertion, deletion, and modification.
Verification tooling reports a broken chain rather than silently passing.
Supplying LLM-Agent-SHA, or any attribution field, never changes an authorization outcome.
Audit records carry the attribution and the authenticated principal as distinct fields.

Required positive tests

A redaction test per surface.
Chain verification on an intact log.

Required negative and adversarial tests

A token planted in a header, a URL, a subprocess argument, an exception message, and a trace, each asserted redacted.
A modified, a deleted, and a reordered audit record, each detected.
A request supplying a forged attribution field for a privileged principal, asserted denied and audited.
A request supplying attribution matching a real worker but no valid credential, asserted denied.

Deployment and migration requirements

The audit chain root is recorded at deploy.

Rollback and recovery requirements

Chain segments remain independently verifiable.

Observability and audit requirements

This issue is the audit-integrity owner for the remote deployment.

Definition of done

All three defects closed with executing tests.

Parent epic: #929. Cross-link: #700, #171, #18, #86, #955 (certification umbrella). Depends on: #938, #957. **Goal supported:** secure isolation. ## Problem — three related defects **(a) Redaction coverage is incomplete.** Redaction is enforced on tool results, log lines, and workflow comments (#700 AC1) and on raw URLs in one output path (#171, closed). Nothing covers structured errors, exception payloads, traces, request headers, or subprocess output — every one of which is a new surface once the endpoint is remote. **(b) The audit trail is not tamper-evident.** #18 (closed) added audit logging of mutating actions with profile metadata. The records are appended in the clear and nothing detects retroactive modification, so an attacker with host access can erase their own trail. **(c) Attribution can be mistaken for authentication.** #86 (closed) introduced opaque `LLM-Agent-SHA` attribution for issues, branches, PRs, and review handoffs. It is a caller-supplied attribution field. No issue states that it — or any similar field — must never be accepted as authentication or authorization, and #932's per-request principal is exactly where such a field would be mistaken for one. ## Current evidence - #700 AC1 enumerates three surfaces. - #171's title scopes to "raw URL exposure in PR inventory/review failure output". - #18's title is "Audit-log Gitea MCP mutating actions with execution profile metadata". - #86's title is "Add opaque LLM agent SHA attribution for issues, branches, PRs, and review handoffs". ## Scope - Extend redaction to structured errors, exceptions, traces, URLs, headers, audit records, and subprocess stdout/stderr. - Make the audit chain tamper-evident (hash-chained or signed) with verification tooling. - Assert in code and test that attribution fields are recorded as metadata only and can never influence an authorization decision. ## Non-goals - Replacing #700's local walls. - Changing the attribution format from #86. - A full SIEM. ## Security and concurrency boundaries Attribution is metadata. Authentication is the authenticated principal. The two must be distinct fields in every audit record and must never be interchangeable in an authorization decision. ## Acceptance criteria - No credential material appears on any enumerated surface, proven per surface. - The audit chain detects insertion, deletion, and modification. - Verification tooling reports a broken chain rather than silently passing. - Supplying `LLM-Agent-SHA`, or any attribution field, never changes an authorization outcome. - Audit records carry the attribution and the authenticated principal as **distinct** fields. ## Required positive tests - A redaction test per surface. - Chain verification on an intact log. ## Required negative and adversarial tests - A token planted in a header, a URL, a subprocess argument, an exception message, and a trace, each asserted redacted. - A modified, a deleted, and a reordered audit record, each detected. - A request supplying a forged attribution field for a privileged principal, asserted denied and audited. - A request supplying attribution matching a real worker but no valid credential, asserted denied. ## Deployment and migration requirements The audit chain root is recorded at deploy. ## Rollback and recovery requirements Chain segments remain independently verifiable. ## Observability and audit requirements This issue is the audit-integrity owner for the remote deployment. ## Definition of done All three defects closed with executing tests.