audit-1 (critical 1): mandatory operator signatures bound to content+deployment

- signing module: canonical content hashes + approval_message sha256(cayce-ops:<type>:<deployment_id>:<id>:<content_hash>) - approve/approve-draft/publisher-approve REQUIRE signature; without CAYCE_OPS_OPERATOR_PUBKEY+DEPLOYMENT_ID the daemons refuse to execute/send/publish (no degraded mode) - run-time re-verification at execute/send/publish: unsigned rows (raw SQL approval) or edited content revert to pre-approval state, audited as error - FULL signatures stored on rows (operator_signature, migration 0003) and in audit detail — never truncated - signature failures audited from CLI wrappers too (1f) - AUTONOMOUS_MODE approval path removed (D13): no non-human approvals tests: SQL-approved row refused at execute/send/publish; to_addr change blocks send; foreign deployment/content signatures refused; full-signature persistence. 65 tests green.
2026-10-20 02:20:09 +00:00
parent 61d5cfd67d
commit 40453aadb4
13 changed files with 1209 additions and 273 deletions
@@ -2,7 +2,10 @@

 from __future__ import annotations

-from types import SimpleNamespace
+import os
+
+from coincurve import PrivateKey
+from coincurve import PublicKey as _PK

 from cayceops.components.maild import classify as clf
 from cayceops.components.maild import maild
@@ -16,9 +19,20 @@ from cayceops.models import (
    ProposalStatus,
 )

+# test operator keypair (matches conftest default pubkey; invented)
+OPERATOR_SECRET = bytes.fromhex("22" * 32)
+OPERATOR_PUBKEY = _PK.from_secret(OPERATOR_SECRET).format().hex()[2:]
+
 OUTBOUND_MSGID = "<cayce-draft-1-1000@cayce-co.xyz>"

-STUB_CFG = SimpleNamespace(mail_from="agent@cayce-co.xyz")
+# the signing gate reads env at runtime — make sure every path in this module
+# (fixtures included) sees a signed deployment
+os.environ.setdefault("CAYCE_OPS_DEPLOYMENT_ID", "itest")
+os.environ.setdefault("CAYCE_OPS_OPERATOR_PUBKEY", OPERATOR_PUBKEY)
+from cayceops.config import load as _load  # noqa: E402  (env set above)
+
+STUB_CFG = _load()  # a real, signed Config (replaces the old SimpleNamespace)
+


 def _eml(subject, body, in_reply_to=None, msgid=None) -> bytes:
@@ -34,9 +48,24 @@ def _eml(subject, body, in_reply_to=None, msgid=None) -> bytes:
    return "\r\n".join(lines).encode()


+def _sign(msg: bytes, secret: bytes = OPERATOR_SECRET) -> str:
+
+    return PrivateKey(secret).sign_schnorr(msg, aux_randomness=b"\x00" * 32).hex()
+
+
+def _approve_signed(sess, mail_id: int) -> str:
+    """Approve with a valid operator signature over the row's current content."""
+    from cayceops.signing import approval_message, mail_content_hash
+
+    record = sess.get(MailMessage, mail_id)
+    to_addr = record.from_addr if record.direction == MailDirection.INBOUND else record.to_addr
+    chash = mail_content_hash(to_addr, record.subject, record.draft_reply)
+    return _sign(approval_message("mail", "itest", mail_id, chash))
+
+
 def _proposal_with_sent_draft(sess) -> Proposal:
    """A proposal whose first-contact mail went through the REAL path:
-    compose -> approve -> send (creating a true OUTBOUND row)."""
+    compose -> approve (signed) -> send (creating a true OUTBOUND row)."""
    p = Proposal(
        kind="partnership",
        title="Acme hotel affiliate program",
@@ -47,7 +76,10 @@ def _proposal_with_sent_draft(sess) -> Proposal:
    mail_id = maild._compose(
        p.id, "partners@acme.example.org", "[cayce] partnership inquiry", "Hello!", sess
    )
-    assert maild._approve_draft(mail_id, "gustavo", sess) == 0
+    assert (
+        maild._approve_draft(mail_id, "gustavo", sess, signature=_approve_signed(sess, mail_id))
+        == 0
+    )
    assert maild._send_one(STUB_CFG, sess, mail_id, sender=lambda *a, **k: None) == "sent"
    out = (
        sess.query(MailMessage)
@@ -72,8 +104,15 @@ def test_rules_classification(cfg):
        clf.classify("Your application was approved, welcome to the program", config)[0]
        is MailClassification.APPROVAL
    )
+    # negation present -> approval is vetoed to needs_review (round-2 rule;
+    # the human decides between rejection and other)
    assert (
        clf.classify("Unfortunately we cannot accept new partners", config)[0]
+        is MailClassification.NEEDS_REVIEW
+    )
+    # plain rejection (no approval word involved) still classifies directly
+    assert (
+        clf.classify("We regret to inform you that your application was declined", config)[0]
        is MailClassification.REJECTION
    )
    assert (
@@ -84,10 +123,16 @@ def test_rules_classification(cfg):
    assert kind is MailClassification.OTHER or kind is MailClassification.NEEDS_REVIEW


-def test_negated_approvals_are_rejections(cfg):
-    """Critical finding 4: 'cannot accept'/'not approved' read as approvals."""
+def test_negated_approvals_never_classify_approval(cfg):
+    """Round-2 point 2: any negation vetoes `approval` -> needs_review."""
    config = cfg()
    cases = [
+        "We cannot currently accept new affiliates",
+        "We will never accept crypto businesses",
+        "Approval was not granted for your site",
+        "We are no longer accepting applications",
+        "Your application hasn't been approved",
+        "We have decided not to move forward with your application",
        "We cannot accept your application",
        "We are not accepting new partners at this time",
        "Your application was not approved",
@@ -95,9 +140,8 @@ def test_negated_approvals_are_rejections(cfg):
        "We do not accept external affiliates",
    ]
    for text in cases:
-        kind, confidence = clf.classify(text, config)
-        assert kind is MailClassification.REJECTION, f"{text!r} -> {kind}"
-        assert confidence >= 0.9
+        kind, _ = clf.classify(text, config)
+        assert kind is not MailClassification.APPROVAL, f"{text!r} -> {kind}"


 def test_llm_prompt_format_survives_json_braces():
@@ -197,7 +241,12 @@ def test_send_requires_explicit_human_approval(cfg, sess):
    inbound = sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()
    original_id = inbound.message_id

-    assert maild._approve_draft(inbound.id, "gustavo", sess) == 0
+    assert (
+        maild._approve_draft(
+            inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+        )
+        == 0
+    )

    sent = []
    config = cfg(CAYCE_OPS_MAIL_FROM="agent@cayce-co.xyz")
@@ -237,7 +286,12 @@ def test_double_approve_is_rejected(cfg, sess):
    maild._poll(cfg(), sess, fetcher=_fetcher([raw]))
    inbound = sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()

-    assert maild._approve_draft(inbound.id, "gustavo", sess) == 0
+    assert (
+        maild._approve_draft(
+            inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+        )
+        == 0
+    )
    assert maild._approve_draft(inbound.id, "gustavo", sess) == 1


@@ -256,7 +310,10 @@ def test_send_failure_does_not_resurrect_sent_mails(cfg, sess):
        mail_id = maild._compose(
            p.id, f"desk{i}@acme.example.org", f"[cayce] inquiry {i}", "Hello!", sess
        )
-        assert maild._approve_draft(mail_id, "gustavo", sess) == 0
+        assert (
+            maild._approve_draft(mail_id, "gustavo", sess, signature=_approve_signed(sess, mail_id))
+            == 0
+        )
        assert maild._send_one(STUB_CFG, sess, mail_id, sender=lambda *a, **k: None) == "sent"
        sess.flush()
        out = sess.get(MailMessage, mail_id)
@@ -272,7 +329,12 @@ def test_send_failure_does_not_resurrect_sent_mails(cfg, sess):
            .filter_by(direction=MailDirection.INBOUND, message_id=f"<acme-{i}@acme.example.org>")
            .one()
        )
-        maild._approve_draft(inbound.id, "gustavo", sess)
+        assert (
+            maild._approve_draft(
+                inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+            )
+            == 0
+        )
    sess.commit()  # per-message factory sessions only see committed rows

    calls = {"n": 0}
@@ -304,7 +366,12 @@ def test_edited_draft_refuses_to_send(cfg, sess):
    raw = _eml("Re: inquiry", "Approved, welcome to the program.", in_reply_to=OUTBOUND_MSGID)
    maild._poll(cfg(), sess, fetcher=_fetcher([raw]))
    inbound = sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()
-    assert maild._approve_draft(inbound.id, "gustavo", sess) == 0
+    assert (
+        maild._approve_draft(
+            inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+        )
+        == 0
+    )

    inbound.draft_reply = "TOTALLY EDITED TEXT after approval"  # tamper

@@ -314,7 +381,7 @@ def test_edited_draft_refuses_to_send(cfg, sess):
    assert stats["sent"] == 0 and stats["hash_mismatch"] == 1
    assert sent == []
    assert inbound.draft_status is DraftStatus.DRAFTED  # needs fresh approval
-    action = sess.query(AuditEntry).filter_by(action="send_refused_hash_mismatch").one()
+    action = sess.query(AuditEntry).filter_by(action="send_refused").one()
    assert action.result == "error"


@@ -334,7 +401,10 @@ def test_compose_creates_first_contact_draft(cfg, sess):
    assert out.proposal_id == p.id

    # approve + send -> an inbound reply can now thread to this proposal
-    assert maild._approve_draft(mail_id, "gustavo", sess) == 0
+    assert (
+        maild._approve_draft(mail_id, "gustavo", sess, signature=_approve_signed(sess, mail_id))
+        == 0
+    )
    stats = maild._send_approved(STUB_CFG, sess, sender=lambda *a, **k: None)
    assert stats["sent"] == 1
    sess.flush()
@@ -349,3 +419,112 @@ def test_mark_seen_returned_for_post_commit_processing(cfg, sess):
    stats, nums = maild._poll(cfg(), sess, fetcher=_fetcher([raw]))
    assert stats["processed"] == 1
    assert nums == [b"0"]  # caller marks seen only after commit
+
+
+# --- round-2 signature gate (mail) ------------------------------------------------
+
+
+def _approved_reply(sess, cfg) -> MailMessage:
+    _proposal_with_sent_draft(sess)
+    raw = _eml("Re: inquiry", "Approved, welcome to the program.", in_reply_to=OUTBOUND_MSGID)
+    maild._poll(cfg(), sess, fetcher=_fetcher([raw]))
+    return sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()
+
+
+def test_unsigned_sql_approved_draft_is_refused(cfg, sess):
+    """Round-2 required test: raw-SQL approved row (no signature) not sent."""
+    _proposal_with_sent_draft(sess)
+    raw = _eml("Re: inquiry", "Approved, welcome to the program.", in_reply_to=OUTBOUND_MSGID)
+    maild._poll(cfg(), sess, fetcher=_fetcher([raw]))
+    inbound = sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()
+    # raw-SQL style approval: status flips, no signature
+    sess.execute(
+        MailMessage.__table__.update()
+        .where(MailMessage.id == inbound.id)
+        .values(draft_status=DraftStatus.APPROVED)
+    )
+    sess.expire(inbound)
+
+    sent = []
+    stats = maild._send_approved(STUB_CFG, sess, sender=lambda *a, **k: sent.append(a))
+    assert stats["sent"] == 0 and stats["hash_mismatch"] == 1
+    assert sent == []
+    assert inbound.draft_status is DraftStatus.DRAFTED  # reverted
+    refused = sess.query(AuditEntry).filter_by(action="send_refused").one()
+    assert refused.result == "error"
+
+
+def test_changed_to_addr_after_approval_blocks_send(cfg, sess):
+    """Round-2 required test: to_addr edited after approval -> refused."""
+    _proposal_with_sent_draft(sess)
+    raw = _eml("Re: inquiry", "Approved, welcome to the program.", in_reply_to=OUTBOUND_MSGID)
+    maild._poll(cfg(), sess, fetcher=_fetcher([raw]))
+    inbound = sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()
+    assert (
+        maild._approve_draft(
+            inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+        )
+        == 0
+    )
+
+    inbound.from_addr = "attacker@evil.example.org"  # redirect target
+
+    sent = []
+    stats = maild._send_approved(STUB_CFG, sess, sender=lambda *a, **k: sent.append(a))
+    assert stats["sent"] == 0 and stats["hash_mismatch"] == 1
+    assert sent == []
+    assert inbound.draft_status is DraftStatus.DRAFTED
+
+
+def test_foreign_deployment_signature_refused(cfg, sess):
+    """Round-2 required test: a valid signature for another deployment_id (or
+    other content) is refused."""
+    from cayceops.signing import approval_message, mail_content_hash
+
+    _proposal_with_sent_draft(sess)
+    raw = _eml("Re: inquiry", "Approved, welcome to the program.", in_reply_to=OUTBOUND_MSGID)
+    maild._poll(cfg(), sess, fetcher=_fetcher([raw]))
+    inbound = sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()
+    chash = mail_content_hash(inbound.from_addr, inbound.subject, inbound.draft_reply)
+
+    # signature valid for ANOTHER deployment
+    other_dep = _sign(
+        OPERATOR_SECRET, approval_message("mail", "other-deploy", inbound.id, chash)
+    )
+    assert maild._approve_draft(inbound.id, "gustavo", sess, signature=other_dep) == 2
+    assert inbound.draft_status is DraftStatus.DRAFTED
+
+    # signature valid for OTHER CONTENT
+    other_content = _sign(
+        OPERATOR_SECRET, approval_message("mail", "itest", inbound.id, "00" * 32)
+    )
+    assert maild._approve_draft(inbound.id, "gustavo", sess, signature=other_content) == 2
+    assert inbound.draft_status is DraftStatus.DRAFTED
+
+
+def test_send_failures_audited_and_exit_code(cfg, sess, monkeypatch):
+    """Round-2 point 5: failures audited + surfaced; non-zero exit handled by CLI."""
+    import cayceops.db as appdb
+
+    _proposal_with_sent_draft(sess)
+    raw = _eml("Re: inquiry", "Approved, welcome to the program.", in_reply_to=OUTBOUND_MSGID)
+    maild._poll(cfg(), sess, fetcher=_fetcher([raw]))
+    inbound = sess.query(MailMessage).filter_by(direction=MailDirection.INBOUND).one()
+    assert (
+        maild._approve_draft(
+            inbound.id, "gustavo", sess, signature=_approve_signed(sess, inbound.id)
+        )
+        == 0
+    )
+
+    def boom(cfg, to, subject, body, message_id, in_reply_to=None):
+        raise OSError("relay down")
+
+
+    sess.commit()  # per-message factory sessions only see committed rows
+    stats = maild._send_approved(
+        STUB_CFG, sess, sender=boom, factory=appdb.session_factory()
+    )
+    assert stats["error"] == 1 and stats["sent"] == 0
+    failed = sess.query(AuditEntry).filter_by(action="send_failed").one()
+    assert failed.result == "error"