fix(audit): extract injection patterns to versioned config, include version in audit events (INJECT-006) - #257
Merged
Conversation
…chain substitution (AUDIT-002) verify_chain() now checks the chain_root against an externally-committed anchor value that is derived from a per-session TEE attestation nonce (SHA-256 of chain_root_bytes || session_id_bytes). An attacker who discards _entries and constructs a fresh self-consistent chain will get a different root that fails the anchor check even though all internal hash links pass. In dev / Level-0 mode (software-only TEE) verify_chain emits a warning instead of failing. Closes #146. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ersion in audit events (INJECT-006)
Move the hardcoded fallback regex patterns out of pipeline.py into
src/cmcp_gateway/inspection/patterns_v1.json with a top-level "version"
field ("1.0.0"). Load at module init via _load_patterns(); log the version
and file path at INFO level on each load.
Replace InspectionResult.injection_pattern_set_hash (a sha256 hash) with
patterns_version (the human-readable semantic version string). Both return
sites in InspectionPipeline.run() — the normal path and the non-UTF-8
early-return — now carry patterns_version=_PATTERNS_VERSION, so every
audit record is tied to the exact pattern set that made the decision.
Tests: replace the three old sha256-hash assertions with five new tests
covering allow, deny, stability across instances, config-file round-trip
(version in result equals version in JSON), and the non-UTF-8 path.
Closes #190.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pipeline.pyintosrc/cmcp_gateway/inspection/patterns_v1.jsonwith a top-levelversionfield ("1.0.0")_load_patterns(); logs version, count, and file path at INFO on each loadInspectionResult.injection_pattern_set_hash(a sha256 hash) withpatterns_version(semantic version string from the config); both return sites inInspectionPipeline.run()now emitpatterns_version=_PATTERNS_VERSIONso every audit record is tied to the exact pattern set that made the decisionTest plan
test_patterns_version_present_on_allow—patterns_versionset on allow resulttest_patterns_version_present_on_deny—patterns_versionset on deny resulttest_patterns_version_stable_across_instances— version is the same across two pipeline instancestest_patterns_version_matches_config_file— version in audit result equalsversionfield inpatterns_v1.jsontest_patterns_version_present_on_non_utf8_deny— non-UTF-8 early-return path also carriespatterns_versionCloses #190.
🤖 Generated with Claude Code