security.md drift: Console missing from the threat model, stale FR-J08 label, fictional env probing

[dichovsky]

Three gaps in docs/design/security.md:

• The Console is absent from the threat model. The doc covers launcher config, injection, symlinks, SQLite, cleanup, and secrets — but has no section on the product's only network listener. src/ui/server.ts implements loopback-only binding, a per-run token compared in constant time (tokenEquals), and a Host-header allowlist; none of these protections are reviewable against the security doc.
• Stale requirement ID: the redaction rule is labeled "FR-J08", but the current docs/design/srs.md defines FR-J08 as "Human sanitization" and the redactor as FR-J12–J15 (the split is recorded in the SRS mapping). Code agrees with the SRS: src/format.ts cites FR-J08 for sanitizeHuman and "FR-J14 redaction rule" for redaction.
• Fictional mechanism: the doc says doctor/setup report "whether the variables they check are set or unset, never a value", but no code reports any env variable's state — src/doctor.ts and src/setup/index.ts probe only executable presence via isExecutableOnPath. The credential-name list exists only as CREDENTIAL_KEY in src/format.ts for keyed-pair redaction, with a different word set.

Impact: the threat-model doc omits the one component that accepts network requests, mislabels traceability into the SRS, and describes a leak-prevention mechanism that doesn't exist (the no-leak property holds, but for a different reason), making audits against it misleading.

Acceptance: a Console section covering token auth, loopback binding, Host allowlist, and the secret-URL caveat; the redaction rule relabeled FR-J12–J15; the env-probing passage rewritten to the actual mechanisms (executable-presence probing plus redactSecrets' real pattern list).

[dichovsky]

Triage: re-verified against main @ d311767. Confirmed as-is — all three gaps reproduce, and the code is the authoritative side of each.

1. Console absent from the threat model. grep -n '^#' docs/design/security.md returns sixteen headings; the "Threats and controls" section covers launcher config, prompt injection, identity spoofing, control-sequence injection, setup-file overwrite, symlink/traversal, SQLite, destructive cleanup, and secret leakage. There is no Console or HTTP section anywhere in the 224-line file, and no occurrence of crew ui. The protections exist and are unreviewable against the doc: loopback-only bind (src/ui/server.ts:767, server.listen(options.port, '127.0.0.1', …), FR-U02), a per-run 64-hex-character token from randomBytes (src/ui/index.ts:21,98, FR-U04) compared with timingSafeEqual in tokenEquals (src/ui/server.ts:192-200) and required on every request before routing (:648-651), a Host-header allowlist admitting only 127.0.0.1:<port> / localhost:<port> (:630-634), and Cache-Control: no-store on every response (:233, :244).
2. Stale requirement ID. docs/design/security.md:140 reads "Redaction rule (FR-J08)." Current FR-J08 is "Human sanitization" (docs/design/srs.md:677); the redactor is FR-J12–FR-J15 (srs.md:686-699), and the SRS's own mapping table records the split — | FR-J08 | FR-J12, FR-J13, FR-J14, FR-J15 | split | (srs.md:1312). The code already uses the post-split ids: src/format.ts:81 cites FR-J08 for sanitizeHuman, :108, :120, :133, :151, :157, :215 cite FR-J14 for redaction.
3. Fictional mechanism. security.md:142-146 says doctor and setup report "whether the variables they check are set or unset", and that a credential-named variable is "reported as set/unset, never by value". No such code path exists. src/doctor.ts reads the environment only through isExecutableOnPath (:78, :96); src/setup/index.ts calls it once (:410) and otherwise reads HOME/USERPROFILE solely to derive a path (:58, :81). Neither emits any variable's set/unset state. The word list in the doc exists only as CREDENTIAL_KEY (src/format.ts:122-123), a keyed-pair regex for free-text redaction — a different mechanism serving a different surface.

Two deltas against the body (noted here, body left as written):

1. The documented word list is also materially wrong, not just mis-framed. security.md:146-148 gives TOKEN, KEY, SECRET, PASSWORD, PASSWD, CREDENTIAL, AUTH, SESSION, COOKIE, PRIVATE, "or ends with _PAT". CREDENTIAL_KEY (src/format.ts:122-123) also matches pwd, authorization, bearer, and the compounds api[-_]?key, access[-_]?key, client[-_]?secret, and its (?:^|[_-])…pat$ branch accepts -pat and a bare pat, not only _PAT. The Acceptance's "redactSecrets' real pattern list" covers this, but it is a correction rather than a re-framing and should be stated as one.
2. src/format.ts:120 cites the fiction from the code side: "The credential-word set mirrors the name-based env-guardrail set documented in security.md (FR-J14)." Once the env-guardrail passage is rewritten, that comment points at nothing. It is a source comment, so fixing it here would break the docs-only scope — filed separately as Redaction: format.ts comment cites a "name-based env-guardrail set" that no code implements #68.

Not a security disclosure. This issue reports drift in the security document, not a vulnerability: every control it asks to be written down is already shipped and already public in src/ui/server.ts, and the issue itself records that "the no-leak property holds, but for a different reason". So the .github/ISSUE_TRIAGE.md security exception does not apply and normal handling continues.

Verdict: IMPLEMENT.

• Blast radius — docs/design/security.md only. Nothing under src/, tests/, bin/, web/, or docs-site/, so no module boundary in CLAUDE.md is crossed and no runtime behavior moves. tests/unit/docs-facts.test.ts extracts the Participant roster, schema version, command surface, and ADR index — not threat-model prose — so no drift guard is touched. The "Security acceptance tests" list at security.md:188-210 already covers the redaction and no-credential-leak properties and needs no new entry, because no test changes. docs/ is not in package.json's files; nothing reaches the published tarball.
• Reversibility — a single-file text revert. No migration, no schema change, no published artifact. The Console section documents already-released 0.1.x behavior, so CURRENT_SCHEMA_VERSION stays 7 and no SchemaMigration is involved.
• Contract impact — none in the binding sense. security.md is a build-packet document that sits outside the four-rank authority order in docs/README.md (ADRs → SRS → CLI contract + data model → architecture); it restates obligations, it does not define them. All three edits move it toward what the ranks above already say: the Console section restates ADR-0012 and FR-U01–FR-U04, FR-U24, FR-U25; the relabel adopts the SRS's own recorded FR-J08 → FR-J12–J15 split; the env passage is replaced by the mechanisms src/doctor.ts, src/setup/index.ts, and src/format.ts actually implement. No accepted ADR, FR-*/NFR-* id, CLI grammar, data model, or State Store schema changes, and no requirement is added or renumbered.

Explicitly out of scope, tracked separately: the dangling src/format.ts:120 comment — #68; docs-site prose drift — #42; architecture.md §4.1 staleness — #35.

---

Generated by Claude Code