feat(cua): enforce security boundaries

[jyaunches]

Summary

Add a fail-closed CUA security admission boundary before any live task adapter can run. A trusted host-side verifier proves the applied network, credential, process, artifact, state, and fixture-authority controls and returns only a strict content-free attestation bound to the current runtime, policy, inference, target, and capability identities.

This PR is stacked on #7780 and should be reviewed against codex/cua-task-result-7752.

Related Issue

Fixes #7754

Accepted product and architecture direction: #7750 (comment)

Changes

• Add public cua security verify and cua security status commands with deterministic records and exit codes.
• Add a trusted host-side verifier boundary that runs an absolute executable without a shell, forwards no unrelated host authority variables, bounds time and output, and never copies verifier diagnostics into public output.
• Define a strict security-attestation record that proves deny-default networking, managed inference plus exactly three target services, required negative destinations, host-side secret delivery, non-root isolation, private artifact handling, and synthetic fixture authority.
• Bind each attestation to the exact runtime, sandbox image, target image, service bundle, policy, task protocol, inference route, capability protocols, target identity, and verifier identity.
• Reject missing, malformed, incomplete, authority-bearing, or identity-stale attestations before invoking a task adapter.
• Clear the attestation after successful target reset, detach, or destroy, when target health records the target as unreachable, incompatible, or replaced, and whenever an explicit re-verification fails.
• Persist and expose only the content-free attestation through status and doctor; private endpoints, host details, transport authority, credentials, paths, task content, and artifacts remain outside public state.
• Add adversarial schema, adapter, lifecycle, persistence, status, doctor, target-transition, task-gate, integration, and compiled-command tests.
• Document the verifier trust boundary, exact controls, lifecycle invalidation, public commands, and exit-code contract.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Focused review below; no findings remain after making every failed explicit verification revoke prior admission.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Focused Security Review

Verdict: pass, with no remaining findings.

• Secrets and credentials: no hardcoded authority; the verifier receives a strict public request through a credential-free environment, and private endpoints, credentials, paths, and diagnostics never enter public records.
• Input validation: strict schemas reject missing and extra fields; executables and descriptor-bound input files are validated without following symbolic links; invocation has no shell and is bounded by time and output size.
• Authorization: only the operator-selected trusted host verifier can issue admission, and untrusted task, page, screen, download, or runtime content cannot expand authority.
• Dependencies: no dependency changes.
• Errors and logging: failures use bounded families; raw verifier output and standard error are not returned or persisted.
• Cryptography and data: immutable identities use SHA-256 digests; no custom cryptography is introduced; sensitive artifacts remain private references with bounded retention.
• Configuration: admission requires deny-default networking, managed inference, exactly the declared target services, non-root isolation, and explicit host/socket/mount denials.
• Tests: adversarial records, missing controls, identity drift, negative destinations, private material handling, authority expansion, lifecycle invalidation, failed re-verification, task gating, and symlinked input rejection are covered.
• System behavior: registry locking makes verification and task admission atomic; every failed explicit verification clears prior admission and task execution remains fail-closed.

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: At 647acf5ff64a910d6c0220bc582bb3022c704d76, the documentation writer reviewed the complete 31-file diff and confirmed the security attestation lifecycle, verifier boundary, task gate, target invalidation, and inherited descriptor-bound input documentation match the implementation and tests. The review also confirmed writing conventions and public-safe content. Focused security/target/task tests (46), npm run build:cli, git diff --check, and npm run docs passed; docs reported 0 errors and 2 existing warnings.
• Agent: Codex Desktop — CUA security attestation lifecycle, verifier boundary, fail-closed task admission, target invalidation, and descriptor-bound private input documentation

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed
• Targeted behavior tests pass for the current change set — 46 focused security, target, and task tests passed; npm run build:cli and pre-push CLI type-check passed.
• Applicable broad gate passed — GitHub CI supplies the full test and coverage lanes for this stacked change.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without errors (doc changes only) — exited 0 with 0 errors and 2 existing Fern warnings.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 51c7a9a6-7111-4f05-ab65-2691d99f5737

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 647acf5 in the codex/cua-security-7... branch remains at 96%, unchanged from commit 125ca30 in the codex/cua-task-resul... branch.

TypeScript / code-coverage/cli

The overall coverage in commit 647acf5 in the codex/cua-security-7... branch is 80%. The coverage in commit cf34b72 in the codex/cua-task-resul... branch is 81%.

Show a code coverage summary of the most impacted files.

File	codex/cua-task-resul... cf34b72	codex/cua-security-7... 647acf5	+/-
src/lib/actions...ndbox/doctor.ts	88%	81%	-7%
src/lib/state/registry.ts	93%	90%	-3%
src/lib/adapters/cua-target.ts	0%	76%	+76%
src/lib/adapters/cua-task.ts	0%	76%	+76%
src/lib/adapter...cua-security.ts	0%	80%	+80%
src/lib/cua/schema.ts	0%	80%	+80%
src/lib/cua/tar...et-lifecycle.ts	0%	82%	+82%
src/lib/cua/sec...ty-lifecycle.ts	0%	82%	+82%
src/lib/cua/task-lifecycle.ts	0%	88%	+88%
src/lib/cua/contract.ts	0%	92%	+92%

---

_{Updated July 29, 2026 06:14 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 2 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 2 more warnings, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, security-posture, onboard-repair, onboard-resume, state-backup-restore, upgrade-stale-sandbox

1 optional E2E recommendation

• network-policy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[jyaunches]

Superseded by the one-commit consolidation in #8169 at bc98436. Closing this obsolete stack layer; its branch is retained.