This repository has been archived on 2026-08-04. You can view files and clone it, but cannot push or open issues or pull requests.
orchestrator/security-review/checkers/fixtures/doc-drift/README.md

44 lines
2.9 KiB
Markdown
Raw Normal View History

feat(secrev): Plane-1 Phase 3 — doc-drift + IAM artifacts (aws-posture gated) (#19) * feat(secrev): doc-drift Plane-1 Tier-1 checker (UNGATED) Third Plane-1 checker on the Phase-0 shared substrate, mirroring compliance-drift.sh / dependency-cve.sh conventions verbatim (set -euo pipefail, sourced substrate, --canary/--dry-run/--no-api/--refresh/--targets, mode-600 reports under $REPORT_ROOT/doc-drift/<UTC-date>/, ALARM-only, finding.schema spirit JSON, exit 0/2/3, dotgit->.git fixture trick). Detects documentation drift deterministically (design §4 doc-drift row): - readme-omits-component: README omits an existing major component in the tree (top-level service dir, SAM/CDK stack, Lambda handler dir, openapi/docs spec) - readme-stale-vs-code: README last-touch far older than newest code commit (two-factor: >=DOC_DRIFT_STALE_DAYS AND >=DOC_DRIFT_STALE_COMMITS) A repo with NO README is SKIPPED (compliance-drift owns readme-present; no double-flag). Future Gemini large-context judge (§4) is an inert stub (maybe_judge), off in canary/dry-run/offline. Planted-drift fixture corpus + EXPECTED_DRIFT_COUNT=4, canary-asserted (exit 3 on miss). shellcheck -x clean (only accepted SC1091 source-line info). Does NOT touch checker_coordinator.sh, requirements.txt, or aws-posture. Wiring/systemd is gated (PROVISIONING footer). Design refs §4, §7 Phase 3. * feat(secrev): Phase-3 IAM artifacts for cross-review (aws-posture gated) Authored FILES (not applied to AWS — provisioning gated behind the mandatory GPT-4.1 IAM cross-review + Adam, design §7 B3) for the aws-posture checker's read-only AWS identity. Decision D5: box stays read-only, auths via IAM Roles Anywhere short-lived leaf certs from a new internal step-ca; NO long-lived AWS key. - aws-posture-readonly-policy.json least-privilege read-only (ce:Get*, cloudwatch:GetMetric*/DescribeAlarms, ec2/elb/rds:Describe*, lambda list + GetFunctionConfiguration, s3:ListAllMyBuckets/GetBucketLocation). No write, no iam:* mutation, no s3:GetObject/secrets/kms/logs data reads, no wildcard actions. Resource:* only where AWS has no resource-level support. - aws-posture-readonly-policy.rationale.md per-statement least-privilege rationale. - aws-posture-trust-policy.json pins Roles Anywhere principal + leaf subject CN + issuer CN + trust-anchor SourceArn (three conditions, all required). - roles-anywhere-config.json trust anchor (pins step-ca root) + profile (1h session). - step-ca-config-sketch.md internal CA config + systemd-timer leaf auto-renewal. - CROSS-REVIEW-PACKET.md end-to-end trust model, blast radius, EXERCISED rollback, reviewer scrutiny list. Does NOT build aws-posture.sh, touch checker_coordinator.sh, or requirements.txt. * fix(secrev): apply IAM cross-review FIXes GPT-4.1 IAM cross-review 2026-06-18: APPROVE, no BLOCKs. Applied FIXes: - trust policy: add aws:SourceAccount=328440206208 (confused-deputy guard) alongside the existing aws:SourceArn trust-anchor pin - readonly policy: remove ec2:DescribeImages (data minimization — AMIs are not an idle-spend signal) - aws:RequestedRegion NIT: deliberately SKIPPED — ce:* and s3:ListAllMyBuckets are global-endpoint services a blanket region condition could DENY; rationale recorded in aws-posture-readonly-policy.rationale.md - rationale.md + CROSS-REVIEW-PACKET.md: record APPROVE + FIXes + NIT answers (snapshots=account-owned idle signal; s3 list=names-only; no logs:* needed) * feat(secrev): aws-posture checker (Tier-2, provisioning-gated) Read-only Tier-2 idle/anomalous-spend + idle-resource posture checker for the R720 agent-team (design D5 / §4 / §6.3 / §7 Phase 3). Mirrors the Tier-1 checker conventions verbatim (flags --canary/--dry-run/--no-api/--targets, mode-600 report under $REPORT_ROOT/aws-posture/<date>/, ALARM-only, finding.schema.json spirit, exit 0/2/3, shared substrate redact/post_slack_alarm). Detectors (complement GuardDuty/SecurityHub/Config, do not replace): - anomalous Cost Explorer deltas (ce get-anomalies, $-impact threshold) - stopped EC2 still paying for attached EBS - unattached EBS volumes - unassociated Elastic IPs - idle NAT gateways (≈0 bytes out) - idle load balancers (0 healthy targets) - idle RDS (0 connections over window) Live AWS calls are PROVISIONING-GATED: they run ONLY when Roles Anywhere creds are available (STS identity probe) AND not --no-api/--canary. With no creds or --no-api/--canary the checker SKIPS live calls and notes them — NEVER alarms on missing data (memory feedback_cloudwatch_alarms). Roles Anywhere/step-ca are not stood up (IAM cross-review PASSED 2026-06-18; see security-review/iam/). Offline canary: fixtures of mocked AWS responses (cost/describe-* JSON) under fixtures/aws-posture/ + EXPECTED_FINDING_COUNT=7, asserted fully offline (no aws, no network). Identical detector code runs online and offline. shellcheck-clean (only accepted SC1091), chmod +x. * fix(secrev): doc-drift fixture py ruff-clean (root CI runs check + format --check) The repo-root CI lint runs both 'ruff check .' and 'ruff format --check .' over all fixtures. Fixed E701 one-liners and ruff-formatted the sample-service .py files (handlers/*, feature_*.py). Fixture content is irrelevant to doc-drift (keys on file/dir presence + git staleness).
2026-06-18 16:25:40 -04:00
# doc-drift canary fixtures
Planted-drift corpus for `checkers/doc-drift.sh --canary` (offline, no network/token).
The checker asserts the total drift count equals `EXPECTED_DRIFT_COUNT` (anti-complacency
floor, design §6.4). If a check regresses (stops firing), the count drops and the canary
FAILS (exit 3).
doc-drift flags repos whose **architecture moved but the README did not** (design §4,
doc-drift row). It is deliberately deterministic and grounded — no fuzzy LLM judgment. The
LLM judge layer (Gemini large-context) is a later enhancement and is inert offline (see the
`maybe_judge` stub in the checker).
Each fixture is a real git checkout (its `.git` is shipped as `dotgit/` so it commits into
THIS repo without becoming a nested submodule; the checker renames it back to `.git/` at run
time, the same trick `compliance-drift.sh` / `dependency-cve.sh` use). Real commit history is
required because the staleness check reads `git log` dates.
## Detected drift (the deterministic checklist)
| Check | Rule cited | What fires |
|---|---|---|
| `readme-omits-component` | global CLAUDE.md: "README must accurately describe architecture, services, data flow" | A README exists but omits mention of a major existing component present in the tree: a top-level service dir, a SAM/CDK stack (`template.yaml` / `app.py` / `cdk.json`), a Lambda handler dir, or an `openapi`/`docs` API spec. |
| `readme-stale-vs-code` | global CLAUDE.md: "update the README in the same commit" as functionality changes | The README's last-touched commit is far older than the newest code commit (≥ `DOC_DRIFT_STALE_DAYS` days) AND ≥ `DOC_DRIFT_STALE_COMMITS` substantial code commits landed after the README was last touched. |
A repo with **no README at all** is SKIPPED by doc-drift, not flagged — `readme-present` is
`compliance-drift.sh`'s job, and double-flagging would be a false alarm
(memory `feedback_cloudwatch_alarms`).
## Fixtures
| Fixture | Planted drift | Count |
|---|---|---|
| `clean-repo` | none — README names every component (`api/`, the SAM stack, `handlers/`, `openapi/`) and the README was committed alongside the code | 0 |
| `drift-omits-repo` | README mentions only `notifier-service`; omits `payments-service/`, the SAM `template.yaml` stack, and the `handlers/charge` Lambda dir | 3 |
| `drift-stale-repo` | README names its one component (no omission) but was last touched 2026-01-05 while 5 substantial code commits landed in 2026-06 — stale | 1 |
| `no-readme-repo` | no README — doc-drift SKIPS it (must NOT fire; compliance-drift owns this) | 0 |
Total = **4** (`EXPECTED_DRIFT_COUNT`). The canary pins the staleness thresholds it was
authored against (`DOC_DRIFT_STALE_DAYS`, `DOC_DRIFT_STALE_COMMITS`) internally so it is
deterministic regardless of the operator's env.
When you add/remove a check or fixture, update both the fixture and `EXPECTED_DRIFT_COUNT`
in the same commit (the canary edit is itself caught on the next run — design §6.4).