Skip to content

v0.2.4 — Enterprise-Publishable Upgrade

Choose a tag to compare

View all tags
@dahai80 dahai80 released this 29 Aug 14:29
· 11 commits to main since this release
v0.2.4
a7a01c7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.2.4 — Enterprise-Publishable Upgrade

Product-readiness audit (audit/fusion-executor-audit-result-product-0827.md, baseline v0.2.3) judged fusion-executor ❌ NOT enterprise-publishable (6 real CRITICAL + 33 MAJOR/MINOR). This release closes all of them, upgrading to enterprise-publishable. All work is on main; 476 Rust + 200 Python (1 TCC skip) tests green, clippy/fmt/ruff clean, maturin develop builds.

Scope

Per user directive: fix all 6 real CRITICAL + 33 MAJOR/MINOR + D3-1 inline-interpreter hardening (opt-in gateway). D3-4 heap limit had no pure-code fix → per-task RSS watchdog (sysinfo, existing dep) kills on memory overage as mitigation. Only excluded cross-project Issue #23 (fusion-guard Phase 3).

Highlights

Security hardening

  • D3-1 inline-interpreter gateway — fe-security::validate_argv blocks python -c / node -e / ruby -e / perl -e by default (binary+flag level, payload-agnostic — prevents agent-driven model one-liner bypass); with_allow_inline_interpreter(true) opt-in for trusted callers.
  • ARCH-2 resolved-path whitelist — resolve_binary_path double-check: basename in whitelist AND absolute path starts_with(trusted_bin_dirs) (/usr/bin, /usr/local/bin, /opt/homebrew/bin, /bin, /sbin + auto-registered VIRTUAL_ENV/bin, current_exe parent, $HOME/.cargo/bin). /tmp/python3 poisoning rejected.
  • D3-6 fail-closed — PATH-resolve failure (None) rejects instead of allowing.
  • D3-2 seatbelt default on — shell_start defaults seatbelt=true across 4 layers.
  • D3-3 seatbelt FS subpath match — file-write deny scoped correctly.
  • D3-8 socket permission hardening — fail-loud on permission errors.
  • D3-5/D3-10 secret redaction in command logs.
  • IMPL-7 prompt-injection sanitize — single chokepoint in slice(): sanitize_file_path / sanitize_raw_trace / sanitize_error_type with size caps (1KB/4KB/256B).

Runtime hardening

  • D3-4 per-task RSS watchdog — fe-sandbox sysinfo polls child-process-tree RSS; over-threshold kill (exit -124, oom_killed=true). Darwin RLIMIT_AS is a no-op, so watchdog replaces rlimit.
  • RUN-4/RUN-10 rlimit — seatbelt profile + non-seatbelt setrlimit NOFILE(1024)/NPROC(512).
  • RUN-9 ppid-tree kill — kill_tree killpg + sysinfo ppid-tree traversal fallback (defends against setsid-orphaned grandchildren).
  • RUN-6 git timeout + worktree gitdir — git() wrapped in tokio::time::timeout(30s); resolve_git_dir via rev-parse --git-common-dir (worktree .git is a file, ENOTDIR fix).
  • RUN-3 stream/exec sem split — exec_sem=16 (non-stream execute) + stream_sem=64 (streaming); long streams no longer starve short commands.
  • RUN-1 py.detach — all block_on sites release GIL.
  • RUN-12 default bundle allowlist — GuiConfig::default() non-empty safe set (Terminal/TextEdit/Finder); disable_bundle_allowlist opt-in for unrestricted.
  • IMPL-9 screenshot TCC split — Screen Recording TCC probed separately from Accessibility; early-return before AX gate.

Operations

  • D6-01 launchd plist + pidfile template.
  • D6-02 latency histograms p50/p95/p99.
  • D6-03 snapshot inventory list_snapshots + retention.
  • M-OPS structured logging — JSON fmt layer + daily-rolling fe.log tee stderr, runtime-reloadable EnvFilter.
  • M-OPS Prometheus metrics — executor.metrics_prometheus UDS text export (no HTTP port, M-SEC-01 UDS-only).
  • trace_id cross-layer — ExecutionRequest/Result carry trace_id (auto-gen uuid v4) + tracing::span! context.
  • SIGHUP hot-reload — log level + whitelist extras reload without restart.

Architecture

  • ARCH-1 seatbelt default True 4-layer (Python run/run_streaming/shell_start + Rust serde).
  • ARCH-4 in-process metrics — execute_sync counts into the global recorder.
  • ARCH-6 feature flags — fe-core [features] default=["gui","telemetry","diagnostics"]; headless --no-default-features.
  • IMPL-1 default socket ~/.fusion-executor/fe.sock 4-layer (M-SEC-01 private 0o700 dir).
  • IMPL-2 deny_unknown_fields Rust serde aligned with Python extra=forbid.
  • IMPL-3 Subscription crash marker — unexpected disconnect → ConnectionError not silent StopIteration.

Docs / integration

  • examples/08_integrate_fusion_code.py — one-way integration skeleton (consumes executor API, does not import fusion-code) + max_consecutive_failures circuit-breaker demo.
  • ARCH-7 caller-circuit contract documented (reserved field; caller owns consecutive-failure count).

Stats

  • 476 Rust tests green (22 suites)
  • 200 Python tests green (1 TCC skip — manual GUI permission path)
  • clippy --all-targets -D warnings clean (only upstream block v0.1.6 future-incompat)
  • fmt / ruff clean
  • maturin develop --release builds fusion_executor._native

Audit remediation

This release supersedes the prior v0.2.3 enterprise-hardening release by resolving the product-readiness audit's full CRITICAL + MAJOR/MINOR set. Audit reports (read-only reference):

  • audit/fusion-executor-audit-result-product-0827.md — product-readiness (this release's target)

Deferred: cross-project Issue #23 (fusion-guard Phase 3) — out of scope for this repo.

Assets 2
Loading