custody: role isolation behind [security].role_isolation (X-1, N-6, N-7, G-5; ADR-2122)

.github/workflows/browsercontainer.yml

@@ -0,0 +1,64 @@
+# browsercontainer.yml
+#
+# W9 (custody-isolation 2026-10-03): the browser sidecar ships the pinned Podkey
+# CI artefact and keeps its Chrome profile on a named volume. These tests guard
+# the pin (sha256, upstream repo, content), the launch flags per browser, the
+# load-once rule and the profile volume. The image itself is built on the host
+# (`agentbox.sh browsercontainer rebuild`), never here.
+
+name: Browsercontainer
+
+on:
+  pull_request:
+    paths:
+      - 'browsercontainer/**'
+      - 'docker-compose.browsercontainer.yml'
+      - 'tests/browsercontainer/**'
+      - '.github/workflows/browsercontainer.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'browsercontainer/**'
+      - 'docker-compose.browsercontainer.yml'
+      - 'tests/browsercontainer/**'
+      - '.github/workflows/browsercontainer.yml'
+
+concurrency:
+  group: browsercontainer-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  podkey:
+    name: Podkey pin, launch args, profile volume
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '22'
+
+      # Best effort: populates browsercontainer/vendor/ so the real-artefact cases
+      # run. If the token cannot read the upstream artefact (or it has expired),
+      # those cases SKIP and the fixture cases still gate.
+      - name: Fetch pinned Podkey artefact (best effort)
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bash browsercontainer/scripts/fetch-podkey.sh fetch
+
+      - name: fetch-podkey.sh (pin, sha256, content, fetch paths)
+        run: bash tests/browsercontainer/fetch-podkey.test.sh
+
+      - name: launch-chromium.sh flags
+        run: bash tests/browsercontainer/launch-args.test.sh
+
+      - name: podkey-ctl.js (id derivation, load-once, output hygiene)
+        run: node --test tests/browsercontainer/podkey-ctl.test.cjs
+
+      - name: compose profile volume
+        run: node tests/browsercontainer/compose-profile-volume.test.cjs

.github/workflows/contract-tests.yml

@@ -17,6 +17,9 @@ on:
       - 'schema/federation-kinds.json'
       - 'tests/sovereign/chain-info.node-test.js'
       - 'tests/sovereign/pod-sovereign-signer.node-test.js'
+      - 'tests/sovereign/role-secret.node-test.js'
+      - 'management-api/lib/role-secret.js'
+      - 'config/hooks/lib/operator-key.cjs'
       - 'management-api/lib/pod-signer.js'
       - 'management-api/lib/agent-identity.js'
       - 'mcp/servers/nostr-bridge.js'
@@ -36,6 +39,18 @@ on:
       - 'management-api/routes/system.js'
       - 'scripts/activation/sidechain-witness.cjs'
       - 'scripts/activation/sidechain-demo-witness.sh'
+      # Custody X-1 (ADR-2122): the identity port (nostr-pod-bridge) and the
+      # activation rehearsal, job `custody` below.
+      - 'services/nostr-pod-bridge/**'
+      - 'lib/nostr-pod-bridge.nix'
+      - 'tests/sovereign/identity-port.node-test.js'
+      - 'config/custody/**'
+      - 'config/role-accounts.json'
+      - 'agentbox.toml'
+      - 'scripts/activation/role-isolation-rehearsal.sh'
+      - 'scripts/activation/role-isolation-rehearsal.host.sh'
+      - 'tests/config/role-isolation-rehearsal.test.sh'
+      - 'docs/estate-closeout/schema/x1-rehearsal.schema.json'
       - 'agentbox/schemas/adapter-contracts/**'
       - '.github/workflows/contract-tests.yml'
   push:
@@ -54,6 +69,9 @@ on:
       - 'schema/federation-kinds.json'
       - 'tests/sovereign/chain-info.node-test.js'
       - 'tests/sovereign/pod-sovereign-signer.node-test.js'
+      - 'tests/sovereign/role-secret.node-test.js'
+      - 'management-api/lib/role-secret.js'
+      - 'config/hooks/lib/operator-key.cjs'
       - 'management-api/lib/pod-signer.js'
       - 'management-api/lib/agent-identity.js'
       - 'mcp/servers/nostr-bridge.js'
@@ -73,6 +91,18 @@ on:
       - 'management-api/routes/system.js'
       - 'scripts/activation/sidechain-witness.cjs'
       - 'scripts/activation/sidechain-demo-witness.sh'
+      # Custody X-1 (ADR-2122): the identity port (nostr-pod-bridge) and the
+      # activation rehearsal, job `custody` below.
+      - 'services/nostr-pod-bridge/**'
+      - 'lib/nostr-pod-bridge.nix'
+      - 'tests/sovereign/identity-port.node-test.js'
+      - 'config/custody/**'
+      - 'config/role-accounts.json'
+      - 'agentbox.toml'
+      - 'scripts/activation/role-isolation-rehearsal.sh'
+      - 'scripts/activation/role-isolation-rehearsal.host.sh'
+      - 'tests/config/role-isolation-rehearsal.test.sh'
+      - 'docs/estate-closeout/schema/x1-rehearsal.schema.json'
       - '.github/workflows/contract-tests.yml'
 
 concurrency:
@@ -126,6 +156,12 @@ jobs:
         working-directory: management-api
         run: NODE_PATH="$PWD/node_modules" node --test ../tests/sovereign/pod-sovereign-signer.node-test.js
 
+      # Custody X-1 W2: the <NAME>_FILE role-secret loader (management-api/lib/role-secret.js)
+      # and its consumers (operator-key, pod-signer, agent-identity). invariants.yml points here.
+      - name: Role-secret loader and consumers (custody W2)
+        working-directory: management-api
+        run: NODE_PATH="$PWD/node_modules" node --test ../tests/sovereign/role-secret.node-test.js
+
       # ADR-2097 (amended 2026-10-02): the sidestr rail — k_spend/k_id binding
       # known-answer test and the /v1/chain/pay pipeline, also under node:test.
       - name: sidestr rail (k_spend binding KAT, /v1/chain/pay, /v1/chain/payments)
@@ -149,3 +185,90 @@ jobs:
           name: contract-test-results
           path: management-api/coverage/
           retention-days: 14
+
+  # Custody X-1 step 1 (ADR-2122): the identity port and the activation rehearsal.
+  # nostr-pod-bridge resolves nostr-bbs-core and solid-pod-rs through
+  # ../../../../<repo> path dependencies, so the job rebuilds the layout
+  # lib/nostr-pod-bridge.nix assembles: agentbox at project/agentbox, the two
+  # public siblings beside project/, at the revisions that file pins (read from
+  # it, so the pins move in one place).
+  custody:
+    name: Custody — identity port and activation rehearsal
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: project/agentbox
+
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          path: project/agentbox
+
+      - name: Read the sibling pins from lib/nostr-pod-bridge.nix
+        id: pins
+        run: |
+          forum="$(sed -n 's/^ *forumRev *= *"\([0-9a-f]\{40\}\)";.*/\1/p' lib/nostr-pod-bridge.nix)"
+          solid="$(sed -n 's/^ *solidRev *= *"\([0-9a-f]\{40\}\)";.*/\1/p' lib/nostr-pod-bridge.nix)"
+          [ -n "$forum" ] && [ -n "$solid" ] || { echo "::error::forumRev/solidRev not found in lib/nostr-pod-bridge.nix"; exit 1; }
+          echo "forum=$forum" >>"$GITHUB_OUTPUT"
+          echo "solid=$solid" >>"$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          repository: DreamLab-AI/nostr-rust-forum
+          ref: ${{ steps.pins.outputs.forum }}
+          path: nostr-rust-forum
+
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          repository: DreamLab-AI/solid-pod-rs
+          ref: ${{ steps.pins.outputs.solid }}
+          path: solid-pod-rs
+
+      - name: Set up Node 22 (matches the runtime image — nodejs_22 in flake.nix)
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: project/agentbox/management-api/package-lock.json
+
+      - name: Install dependencies
+        working-directory: project/agentbox/management-api
+        run: npm ci
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87
+        with:
+          toolchain: stable
+
+      - name: Cache cargo registry and build
+        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6
+        with:
+          workspaces: project/agentbox/services/nostr-pod-bridge
+
+      # The whole crate: tests/identity_port.rs (port transport, SO_PEERCRED ACL,
+      # receipts), the lib's identity_port unit tests, tests/role_isolation.rs
+      # and the bootstrap/identity suites the port's keys come from.
+      - name: nostr-pod-bridge tests (identity port, role isolation, bootstrap)
+        working-directory: project/agentbox/services/nostr-pod-bridge
+        run: cargo test --locked
+
+      - name: Build the nostr-pod-bridge binary for the node-side port test
+        working-directory: project/agentbox/services/nostr-pod-bridge
+        run: cargo build --locked --bin nostr-pod-bridge
+
+      # Without NOSTR_POD_BRIDGE_BIN every case skips; here the binary is built,
+      # so a skip would mean the job is not testing the port.
+      - name: Identity port end to end (sign-request client against serve-identity)
+        working-directory: project/agentbox/management-api
+        run: |
+          NOSTR_POD_BRIDGE_BIN="$GITHUB_WORKSPACE/project/agentbox/services/nostr-pod-bridge/target/debug/nostr-pod-bridge" \
+          NODE_PATH="$PWD/node_modules" node --test ../tests/sovereign/identity-port.node-test.js | tee "$RUNNER_TEMP/port.tap"
+          ! grep -Eq '^# skipped [1-9]' "$RUNNER_TEMP/port.tap"
+
+      # The rehearsal's checks (a)-(f) against a scratch root with fake
+      # /proc, supervisorctl, stat, docker, sudo and curl; (c) signs with
+      # throwaway keys and verifies with NostrBridge.verifyNip98 (nostr-tools
+      # from management-api, as the pods signer step does).
+      - name: Role-isolation rehearsal decides correctly (custody W6a/W10)
+        run: NODE_PATH="$PWD/management-api/node_modules" bash tests/config/role-isolation-rehearsal.test.sh

.github/workflows/invariants.yml

@@ -9,6 +9,9 @@ on:
       - 'docker-compose*.yml'
       - 'docs/adr/**'
       - 'docs/PROTOCOL-registry.md'
+      - 'docs/SECURITY-profiles.md'
+      - 'config/egress-policy.json'
+      - 'docs/LAN-door-threat-model.md'
       - 'config/seccomp-agentbox.json'
       - 'config/entrypoint-unified.sh'
       - 'management-api/**'
@@ -21,6 +24,12 @@ on:
       - 'tests/config/protocol-registry-lint.test.mjs'
       - 'tests/config/declared-vs-running.test.js'
       - 'tests/config/fixtures/runtime-state.json'
+      # Custody X-1 W0/W2 runtime contracts (RC-X1-01..06) and what they read
+      # beyond config/entrypoint-unified.sh and flake.nix (both listed here).
+      - 'tests/runtime-contract/RC-X1-*'
+      - 'config/docker-read-proxy.cjs'
+      - 'config/bake-devuser-privilege.sh'
+      - 'config/custody/**'
       - 'flake.nix'
       - 'skills/**'
       - 'mcp/**'
@@ -72,6 +81,39 @@ jobs:
       - name: check-secret-not-in-env (AGENTBOX_BRIDGE_SK scrubbed before exec)
         run: sh scripts/ci/check-secret-not-in-env.sh
 
+      # Custody X-1 step 1, W2 (bypass 3): every env var name the boot path and
+      # the role-secret consumers read is classified ROLE / DEVUSER_CLASS /
+      # NON_SECRET (config/custody/env-classes.json); ROLE vars leave PID 1's
+      # environment under [security].role_isolation and are read by file.
+      - name: env-secret-inventory (custody W2 — every env name classified; names only)
+        run: node scripts/ci/env-secret-inventory.js --check
+      # The <NAME>_FILE loader and its consumers run in contract-tests.yml, step
+      # "Role-secret loader and consumers (custody W2)" (it needs management-api's
+      # node_modules). Until 2026-10-03 this label claimed that step and none existed.
+      - name: env-secret-inventory unit tests (custody W2)
+        run: node --test tests/security/env-secret-inventory.node-test.js
+      - name: compose-role-env (custody W10 — no ROLE-class variable under a compose environment key)
+        run: node --test tests/security/compose-role-env.test.mjs
+
+      # Custody X-1 step 1 runtime contracts. Each extracts the real functions from
+      # config/entrypoint-unified.sh (or reads flake.nix / config/docker-read-proxy.cjs)
+      # and runs them against a scratch root: no Docker, no root. RC-X1-03's live half
+      # (AGENTBOX_RC_LIVE=1) needs a rebuilt image and stays off here.
+      - name: RC-X1-01 root boot runs no binary from a devuser-writable dir (custody W0)
+        run: bash tests/runtime-contract/RC-X1-01.sh
+      - name: RC-X1-02 Stage B is one-shot per container start (custody W0)
+        run: bash tests/runtime-contract/RC-X1-02.sh
+      - name: RC-X1-03 devuser is not in group root (custody W0; static half)
+        run: bash tests/runtime-contract/RC-X1-03.sh
+      - name: RC-X1-04 docker socket widened only with role isolation off (custody W0)
+        run: bash tests/runtime-contract/RC-X1-04.sh
+      - name: RC-X1-05 read-only docker proxy for devuser (custody W0)
+        run: node --test tests/runtime-contract/RC-X1-05.node-test.cjs
+      - name: RC-X1-06 role-secret scrub contract (custody W2; no Docker needed)
+        run: bash tests/runtime-contract/RC-X1-06.sh
+      - name: RC-X1-07 devuser has no sudo route under role isolation (custody W10; bake + boot check)
+        run: bash tests/runtime-contract/RC-X1-07.sh
+
       - name: check-single-metrics (exactly one collectDefaultMetrics call)
         run: node scripts/ci/check-single-metrics.js
 
@@ -136,6 +178,13 @@ jobs:
       - name: check-adr-index (ADR-2001 — docs/adr/README.md matches the records on disk)
         run: node scripts/adr-index-gen.js docs/adr --check-index
 
+      # N-7: the prompt egress register is rendered from config/egress-policy.json
+      # `.register` into docs/SECURITY-profiles.md. --check fails on a hand edit to
+      # the table, an unrendered JSON change, an unmarked gap (gate or accepted
+      # record "none" without its marker) or a path:line citation outside its file.
+      - name: check-egress-register (N-7 — SECURITY-profiles.md table matches config/egress-policy.json)
+        run: node scripts/ci/render-egress-register.js --check
+
       - name: adr-ratchet self-test (an ADR added already decided is not backlog)
         run: bash tests/config/adr-ratchet.test.sh
 

.github/workflows/manifest-validate.yml

@@ -23,6 +23,9 @@ on:
       - 'tests/config/**'
       - 'tests/tui/**'
       - 'config/sidechain/**'
+      - 'config/role-accounts.json'
+      - 'config/lib/**'
+      - 'config/entrypoint-unified.sh'
       - 'scripts/dream-inbox.mjs'
       - 'management-api/lib/system-manifest.js'
       - '.github/workflows/manifest-validate.yml'
@@ -44,6 +47,9 @@ on:
       - 'management-api/lib/system-manifest.js'
       - 'tests/config/knots_header_v2.py'
       - 'config/sidechain/**'
+      - 'config/role-accounts.json'
+      - 'config/lib/**'
+      - 'config/entrypoint-unified.sh'
       - '.github/workflows/manifest-validate.yml'
 
 concurrency:
@@ -124,6 +130,27 @@ jobs:
       - name: Assert JSON Schema is well-formed
         run: python3 -c "import json; json.load(open('schema/agentbox.toml.schema.json'))"
 
+      - name: The two supervisor configs cannot drift (ADR-2122)
+        # Today's rendered config vs the isolated one derived from it: only the role
+        # programs' user= and environment= lines differ; secret paths are per-role.
+        run: bash tests/config/role-isolation-supervisor.test.sh
+        env:
+          AGENTBOX_MANIFEST_BIN: services/agentbox-manifest/target/release/agentbox-manifest
+
+      - name: /run/secrets delivery builds the right owner/mode tree (ADR-2122)
+        # The real plan against a scratch root; chown is a recording stub (no root in CI).
+        run: bash tests/config/role-secrets-delivery.test.sh
+        env:
+          AGENTBOX_MANIFEST_BIN: services/agentbox-manifest/target/release/agentbox-manifest
+      - name: at-rest custody migrate/revert and sidechain state seed (ADR-2122, design 3.2-3.4, W2b/W4)
+        # The real registry rows against a scratch root; chown is a recording stub (no root in CI).
+        run: bash tests/config/role-custody-migrate.test.sh
+        env:
+          AGENTBOX_MANIFEST_BIN: services/agentbox-manifest/target/release/agentbox-manifest
+
+      - name: With [security].role_isolation off the boot is today's (ADR-2122)
+        run: bash tests/config/role-isolation-boot.test.sh
+
       - name: Sealed chain documents are well-formed and gated (ADR-2103)
         # The block file is not in the repository, so the on-disk hash case skips here;
         # the document invariants, the P21 mainnet gate and the no-key-in-git check run.