feat(plugins): add GateProve safety boundary & hash-chained action ledger plugin - #3410
Open
AAH20 wants to merge 6 commits into
Open
feat(plugins): add GateProve safety boundary & hash-chained action ledger plugin#3410AAH20 wants to merge 6 commits into
AAH20 wants to merge 6 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Introduces the new gate_prove plugin to enforce a deterministic “Gate/Prove” safety boundary for Caldera ability dispatch, including audit logging via a hash-chained action ledger, plus wiring Caldera’s dispatch paths through the new governor.
Changes:
- Added
gate_proveplugin implementation (service, authorization leases, ledger, attestation, trust contract) plus JSON schemas and README. - Added unit tests covering safety decisions, lease enforcement, intent binding, ledger hash-chain integrity, and attestation verification.
- Integrated dispatch enforcement by routing manual commands and cleanup links through
Operation.apply()(now GateProve-aware).
Reviewed changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| plugins/gate_prove/app/gate_prove_svc.py | Core policy engine: kill-switch, destructive-technique gating via leases, intent binding, link governance |
| plugins/gate_prove/app/ledger.py | Append-only SHA-256 hash-chained JSONL ledger + chain verification |
| plugins/gate_prove/app/authorization_lease.py | HMAC-based scoped authorization lease issuing/verifying |
| plugins/gate_prove/app/attestation.py | Signed evidence bundle generation + verification |
| plugins/gate_prove/app/trust_contract.py | Operation intent digesting, building, and validation |
| plugins/gate_prove/app/ability_manifest.py | AI-generated ability manifest + provenance validation and stable hashing |
| plugins/gate_prove/app/schema.py | Decision dataclass and destructive technique patterns |
| plugins/gate_prove/hook.py | Plugin enable hook registers gate_prove_svc configured via env vars |
| plugins/gate_prove/tests/test_gate_prove.py | Unit test suite for the plugin behavior and integrity properties |
| plugins/gate_prove/schemas/*.schema.json | Machine-readable schemas for intent + ability manifest contracts |
| plugins/gate_prove/conf/default.yml | Default plugin configuration values |
| plugins/gate_prove/README.md | Plugin documentation and usage guidance |
| app/service/rest_svc.py | Manual command dispatch now goes through Operation.apply() |
| app/objects/c_operation.py | Centralized dispatch path now consults GateProve before enqueuing links |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+22
to
+31
| def __init__( | ||
| self, | ||
| prove_token: str = "", | ||
| ledger: OperationLedger | None = None, | ||
| ledger_path: str = "artifacts/caldera_action_ledger.jsonl", | ||
| manifest_validator: AbilityManifestValidator | None = None, | ||
| authorization_key: str = "", | ||
| attestation_key: str = "", | ||
| ) -> None: | ||
| self.prove_token = prove_token or os.environ.get("CALDERA_PROVE_TOKEN", "") |
Comment on lines
+54
to
+69
| def evaluate_ability( | ||
| self, | ||
| operation_id: str, | ||
| ability_id: str, | ||
| technique_id: str, | ||
| technique_name: str = "", | ||
| approved: bool = False, | ||
| offered_token: str = "", | ||
| simulate: bool = False, | ||
| ability_manifest: dict[str, Any] | None = None, | ||
| provenance: dict[str, Any] | None = None, | ||
| cleanup: bool = False, | ||
| authorization_lease: str = "", | ||
| ability_digest: str = "", | ||
| target: str = "", | ||
| ) -> AbilityDecision: |
Comment on lines
+19
to
+20
| INSTANT_AUDIT_CTA = "https://a2zsoc.com/productized-services#caldera-arsenal-tripwire" | ||
| CONSULTATION_CTA = "https://a2zsoc.com/consultation" |
Comment on lines
+39
to
+43
| compliance_mapping: list[str] = field( | ||
| default_factory=lambda: ["NIST_CSF_DE.CM", "SOC2_CC7.2", "ISO_27001_A.12.6.1"] | ||
| ) | ||
| instant_audit: str = INSTANT_AUDIT_CTA | ||
| consultation: str = CONSULTATION_CTA |
Comment on lines
+293
to
+296
| elif str(manifest.get("privilege", "")) != str( | ||
| intent.get("range", {}).get("privilege_ceiling", "") | ||
| ): | ||
| binding_errors.append("ability privilege does not match the operation intent ceiling") |
Comment on lines
+21
to
+29
| def _load(self) -> None: | ||
| self.entries = [] | ||
| with open(self.path, "r", encoding="utf-8") as f: | ||
| for line in f: | ||
| line = line.strip() | ||
| if line: | ||
| data = json.loads(line) | ||
| self.entries.append(data) | ||
| self._last_hash = data.get("receipt_hash", self._last_hash) |
Comment on lines
+41
to
+42
| ledger_id = str(uuid.uuid4()) | ||
| ts = time.time() |
Comment on lines
+61
to
+64
| if self.path: | ||
| self.path.parent.mkdir(parents=True, exist_ok=True) | ||
| with open(self.path, "a", encoding="utf-8") as f: | ||
| f.write(json.dumps(payload, sort_keys=True) + "\n") |
| authorization_lease: str = "", | ||
| ability_digest: str = "", | ||
| target: str = "", | ||
| ) -> AbilityDecision: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
gate_prove, a native safety boundary and hash-chained Action Ledger plugin for MITRE Caldera operations.Problem Solved
When running automated adversary emulation against enterprise or staging infrastructure, executing high-blast abilities (such as
T1562Impair Defenses,T1070Indicator Removal, orT1485Data Destruction) without strict safety controls creates acute operational risk and potential production downtime.This plugin introduces a zero-trust safety boundary:
never_equate_intent_to_approval: true: High planner confidence or automated execution does not authorize destructive techniques.CALDERA_PROVE_TOKEN).CALDERA_KILL_SWITCH=1) or file sentinel (artifacts/KILL).Testing & Validation
plugins/gate_prove/tests/test_gate_prove.pyverifying safe ability allowance, destructive technique simulation, HITL prove token validation, and SHA-256 ledger hash-chain integrity (all unit tests passing).Upstream & Production Context
Maintained by A2Z SOC for safe purple-team adversary emulation, Cyber Risk Quantification (CRQ), and SOC 2 Type II audit readiness.
For teams deploying adversary emulation requiring safety audits or purple team sprints: