Harden governance and scheduler handoff

[amittell]

Summary

• closes the audit findings across governance, approvals, identity, authorization proof, evidence, sandboxing, CLI errors, and scheduler handoff negotiation
• binds approvals to the effective execution environment, canonical working directory, timeout, instance, and source manifest without persisting raw secrets
• makes required evidence verification fail closed and keeps verify output out of audits, evidence, and structured errors
• strengthens SPIFFE, OPA, proof-key, output-permission, conversion, schema, and documentation behavior
• closes manifest-init overwrite races and refuses symlinked or non-regular filesystem destinations without redirecting permission changes or blocking on FIFOs
• adds exact required-check aggregation and narrows publish workflow permissions

Verification

• 784 tests passed on Node 24 against pinned openclaw-scheduler ac9ea643a8efc68e9f81c8d93125467ca62140b5
• exact-head Node 22.13.0 and Node 24.x CI passed, including the required lint-test aggregate
• ESLint passed with zero warnings
• npm audit reports zero vulnerabilities
• package dry-run includes 129 expected entries
• all nine published Copilot review findings were fixed with regression coverage and resolved
• Copilot's suppressed JSDoc observation was also corrected
• Copilot's exact-head rereview completed with no new comments

Release

The package and documentation are prepared as 0.4.0. This PR is ready to merge and publish from the annotated v0.4.0 tag after the final required checks pass.

[Copilot]

Pull request overview

This PR significantly hardens agentcli’s governance and runtime handoff boundaries, aiming to close multiple audit findings by tightening secret handling, fail-closed enforcement (approvals/proofs/sandbox/evidence), and scheduler capability negotiation. It also expands conformance coverage and updates docs/examples/CI to reflect the stricter behavior.

Changes:

• Introduces canonical hashing/binding primitives and expands “effective execution binding” to prevent secret persistence while strengthening approval/proof/evidence binding.
• Makes multiple local-state surfaces (output, registry, audit, allowed_signers) more symlink-safe and permission-restrictive; enforces sandbox/network/path restrictions fail-closed.
• Adds scheduler handoff v3 field projection + explicit negotiation and expands tests/CI to validate cross-repo scheduler integration.

Reviewed changes

Copilot reviewed 82 out of 84 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/scheduler-conformance.test.js	Adds scheduler conformance tests (handoff v3 fields, secret non-persistence, capability negotiation).
test/sandbox.test.js	Adds sandbox/canonical path and fail-closed enforcement tests.
test/run-workflow.test.js	Adds tests for manifest digest binding and disabled task skipping behavior.
test/integration-scheduler.test.js	Updates scheduler integration expectations for newer handoff versions and field defaults.
test/foundation.test.js	Adds foundational tests for canonicalization, binding hashes, registry/audit/output permissions, docs validity.
src/targets.js	Reuses shared standalone feature declarations and expands scheduler feature matrix.
src/signing/ssh.js	Hardens allowed_signers handling (file checks, safer writes, permissions).
src/scheduler-fields.js	Adds v3 scheduler fields and field-version map.
src/sandbox.js	Implements symlink-safe canonicalization and fail-closed sandbox enforcement logic.
src/runtime/openclaw-scheduler.js	Removes dispatch compile caching and negotiates handoff field version per job.
src/run.js	Updates dry-run planning/summary and skips disabled tasks/branches in local run.
src/registry.js	Hardens registry dir/entry handling (symlink refusal, permissions, safer writes, parse errors).
src/merge.js	Extends merge to include v0.2 profile collections and detects conflicting profile definitions.
src/io.js	Adds structured error codes and strengthens safe output path resolution / symlink refusal / permissions.
src/init.js	Updates scaffold to v0.2 and writes manifests via safe output path + restricted permissions.
src/index.js	Expands public exports for new schema/error/evidence/proof/canonical utilities.
src/identity/oidc-token-exchange.js	Threads commandEnv for controlled command execution environment usage.
src/identity/oidc-client-credentials.js	Threads commandEnv for controlled command execution environment usage.
src/identity/file-bearer.js	Avoids leaking token file paths; reports permission checks in an audit-safe way; threads commandEnv.
src/identity/entra-agent-id.js	Threads commandEnv and expands value_from command context handling.
src/home.js	Ensures home directories/files are created with private permissions.
src/evidence/ssh.js	Introduces versioned evidence envelope, canonical signing document, and fail-closed verification.
src/evidence/payload.js	Adds complete evidence payload builder/validator, redaction, and record-binding verification.
src/evidence/index.js	Adds a fail-closed evidence envelope verification wrapper.
src/errors.js	Introduces structured error codes/types and normalization helpers.
src/describe.js	Expands RPC method surface documentation (targets/paths/audit/registry/approvals/proof verify).
src/convert.js	Hardens v0.1→v0.2 conversion (deterministic ids, avoids inventing proof trust material, post-validate).
src/compiler/standalone.js	Adds standalone feature map and sanitizes compiled artifacts to avoid persisting secrets.
src/compiler/shared.js	Adds canonical execution binding + child env allowlist + hashing helpers for governed binding.
src/compiler/openclaw-scheduler.js	Adds v3 fields, secret persistence refusal for shell env/stdin, and disables auto-reject jobs.
src/command.js	Adds a safe resolveValueFrom helper with explicit opt-in for command execution.
src/capabilities.js	Makes runtime feature reports authoritative and adds new governed capability checks.
src/canonical.js	Adds canonical stringify + digest/hash helpers for deterministic binding.
src/authorization/opa.js	Validates secure endpoints and sanitizes policy references for audit safety.
src/authorization-proof/jwt.js	Enforces cryptographic verification + manifest binding; hardens trust material validation.
src/authorization-proof/index.js	Adds profile validation helpers and a fail-closed verification wrapper.
src/authorization-proof/detached-signature.js	Hardens detached signature verification, canonical manifest binding, and temp file handling.
src/audit.js	Makes audit IDs collision-resistant and hardens audit file writes/reads (permissions, malformed-line handling).
src/apply.js	Adds scheduler handoff v3 negotiation and safe proof value_from resolution with explicit command opt-in.
skills/manifest-authoring/SKILL.md	Updates guidance to match fail-closed sandbox/dry-run/governance behavior.
SECURITY.md	Documents hardened fail-closed boundaries and trust model.
README.md	Updates minimum Node version and documents stricter governance guarantees and capability negotiation.
package.json	Bumps Node engine floor and adds dependency overrides.
package-lock.json	Updates locked versions and overridden dependency resolutions.
MANIFEST-QUICK-REF.md	Updates quick reference with new safety and schema behavior.
examples/vercel-ops.json	Removes inline shell env secrets from examples (use identity materialization).
examples/stripe-projects.json	Removes inline shell env secrets from examples (use identity materialization).
examples/oidc-service-auth.json	Updates identity auth caching defaults.
examples/full-stack-deploy.json	Tightens JWT proof config (audience/jwks + required verification).
examples/ansible-ops.json	Moves runtime timeout to the runtime block and updates reliability structure.
docs/versioning.md	Updates versions and schema output expectations.
docs/spec.md	Updates normative spec to reflect fail-closed enforcement, approval binding, proof requirements, evidence binding.
docs/runtime-integration-backlog.md	Updates status/date and documents implemented integration/capability negotiation.
docs/roadmap.md	Updates completed items list reflecting hardened governance/runtime behavior.
docs/protocol.md	Expands JSON-RPC surface and documents new params/results/envelopes.
docs/guide-testing-stripe-identity-step-up.md	Updates guide to avoid misuse of dry-run and include manifest-bound proof claim.
docs/field-reference.md	Updates reference to match new enforcement ordering and proof/evidence rules.
docs/conformance.md	Updates conformance profiles and schema/RPC expectations.
docs/capabilities.md	Updates feature key list and clarifies runtime-authoritative capability merging.
docs/architecture.md	Updates exec pipeline phases and dual-path guarantees to match new hardening.
docs/adoption.md	Updates scheduler capability negotiation narrative and safety constraints.
CHANGELOG.md	Adds unreleased hardening summary entries.
bin/agentcli.js	Switches to normalized structured errors and throws on validation failures for consistent envelopes.
.github/workflows/publish.yml	Narrows default permissions and pins scheduler fixture checkout for test job.
.github/workflows/ci.yml	Adds Node version test matrix + pinned scheduler fixture verification and aggregation job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 82 out of 84 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/evidence/ssh.js:180

• The JSDoc for resolve() says it returns only { keyPath }, but the implementation also returns principal. This mismatch can mislead callers and makes the public provider contract unclear.

[Copilot]

Pull request overview

Copilot reviewed 82 out of 84 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 82 out of 84 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 82 out of 84 changed files in this pull request and generated no new comments.