security: define user data isolation redline

docs/releases/V1R4C5-acceptance-evidence.md

@@ -1,212 +0,0 @@
-# V1R4C5 Acceptance Evidence
-
-Date: 2026-07-11
-
-Status: release candidate evidence in progress
-
-Current active baseline: V1R4C3
-
-V1R4C5 has not been promoted yet.
-
-## Owner Decision
-
-Owner approved continued V1R4C5 work under the following constraints:
-
-```text
-允许无 force-push 的分支 reconcile
-memory search 保持关闭
-先完成 SR-01/SR-02/数据隔离验收
-再进入 merge/deploy/tag owner gate
-```
-
-## Scope
-
-V1R4C5 release candidate scope:
-
-1. SR-01 Gitea reliability and branch consistency guardrails.
-2. SR-02 watcher/stuck command cleanup.
-3. User data isolation redline and enforcement gates.
-4. SR-04 admin workbench read-only visibility preparation only.
-
-Explicitly excluded from V1R4C5 activation:
-
-- memory search activation;
-- full SR-04 portal production rollout;
-- bulk merge of old test/smoke/auth branches;
-- force push reconciliation;
-- Gitea DB mutation without owner/admin approval.
-
-## Runtime Acceptance Evidence
-
-### Runtime status
-
-Observed:
-
-```json
-{
-  "service": "aios-gitops-model-api",
-  "status": "active",
-  "workspace_branch": "patch/v1r4c5-runtime-acceptance-clean-20260711-01"
-}
-```
-
-### Baseline
-
-Observed:
-
-```json
-{
-  "current_baseline": "V1R4C3",
-  "previous_baseline": "V1R3C1",
-  "promoted_by": "openclaw"
-}
-```
-
-### Clean createBranch acceptance
-
-Branch:
-
-```text
-test/v1r4c5-runtime-acceptance-clean-20260711-01
-```
-
-Result:
-
-```text
-status: ok
-commit: 6ae7058
-sync: synced
-```
-
-### Clean createPatch acceptance
-
-Patch:
-
-```text
-patch/v1r4c5-runtime-acceptance-clean-20260711-01
-```
-
-Patch id:
-
-```text
-patch-1783706123789-f5ca8b69
-```
-
-Commit:
-
-```text
-ba0391e
-```
-
-Result:
-
-```text
-synced
-```
-
-## SR-01 Evidence
-
-Known accepted evidence:
-
-- Gitea branch consistency sentinel deployed.
-- Sentinel reports:
-
-```json
-{
-  "status": "healthy",
-  "unhealthy_checks": []
-}
-```
-
-- systemd timer runs every 5 minutes.
-- service runs with:
-
-```text
---emit-safe-mode --json
-```
-
-- broken symlink issue resolved by replacing the external reliability symlink with workspace-local files.
-
-Required before final promotion:
-
-- confirm latest sentinel report remains healthy after acceptance writes.
-
-## SR-02 Evidence
-
-Known accepted evidence:
-
-```text
-11 / 11 tests pass
-```
-
-Fix summary:
-
-- stuck command detection reads parsed timestamps through `data.get('ts', 0)`;
-- `.md` fixture mtime is aligned with stored stuck timestamp via `os.utime(path, (ts, ts))`;
-- behavior is consistent across `.json` and `.md` state formats.
-
-Required before final promotion:
-
-- re-run SR-02 tests on the final integration candidate.
-
-## User Data Isolation Evidence
-
-Implemented controls:
-
-- user data isolation redline;
-- memory scope guard;
-- provider gate;
-- activation gate;
-- audit service/timer;
-- CI acceptance scripts;
-- memory search activation check.
-
-Required safety state:
-
-```text
-AIOS_MEMORY_ENABLED=false
-```
-
-Required before memory/search activation:
-
-- isolation audit healthy;
-- no denied records;
-- no invalid records;
-- provider filters by scope before ranking;
-- provenance required;
-- global index disabled;
-- activation gate returns allowed;
-- explicit owner approval.
-
-V1R4C5 does not approve memory search activation.
-
-## SR-04 Admin Workbench Evidence
-
-Current user-visible gap is confirmed:
-
-- administrator cannot yet see task progress;
-- administrator cannot yet see flow/process diagrams;
-- SR-04 remains activation-ready but gated.
-
-V1R4C5 scope allows only read-only visibility preparation and acceptance design, not full production rollout.
-
-Required before SR-04 deployment:
-
-- SR-01 green;
-- SR-02 green;
-- user data isolation gate accepted;
-- admin RBAC read-only check green.
-
-## Remaining Required Gates Before Promotion
-
-- [ ] Latest Gitea sentinel report remains healthy.
-- [ ] SR-02 watcher tests pass on final candidate.
-- [ ] User data isolation acceptance passes.
-- [ ] Admin workbench read-only RBAC acceptance passes or remains explicitly deferred.
-- [ ] No force-push was used.
-- [ ] Memory search remains disabled.
-- [ ] Owner approves merge/deploy/tag/promotion.
-
-## Promotion Rule
-
-V1R4C5 may not be promoted until all required gates are green or explicitly deferred with owner approval.

docs/security/user-data-isolation-redline.md

@@ -0,0 +1,193 @@
+# User Data Isolation Redline
+
+Status: mandatory
+
+Decision date: 2026-07-10
+
+Baseline at decision: V1R4C3
+
+## Redline
+
+User data isolation is a hard system-design requirement.
+
+No component may read, write, search, rank, summarize, cache, or report data from another user, tenant, project, session, workspace, branch, agent, or task context unless explicit authorization and context binding exist.
+
+This applies to memory search, filesystem logs, vector indexes, search gateways, autonomous controller state, task records, audit logs, artifacts, and any fallback provider.
+
+## Incident Class
+
+Any cross-context data contamination is a security and reliability incident, not a normal feature bug.
+
+Examples:
+
+- memory search returns records from another project;
+- shared workspace logs are used as current-session evidence;
+- global `memory/` state mixes unrelated users or tasks;
+- fallback provider uses unscoped records;
+- agent reports status based on stale or unrelated context;
+- shared cache leaks content across users, groups, or sessions.
+
+## Core Rule
+
+A query may only access records satisfying all required scope dimensions:
+
+```text
+user_id
+  AND tenant_id / group_id
+  AND session_id or conversation_id
+  AND project_id
+  AND workspace_id
+  AND branch or baseline scope
+  AND agent_id / tool_context when applicable
+```
+
+If a dimension is unavailable, the safe behavior is deny-by-default or text-only fallback.
+
+## Forbidden Design
+
+The following are forbidden in production paths:
+
+1. Global shared memory directories without per-scope namespace.
+2. Search over untagged records.
+3. Search over records whose owner/scope cannot be proven.
+4. Trusting filesystem location alone as authorization.
+5. Treating memory search results as authoritative without provenance.
+6. Cross-session fallback without explicit allowlist.
+7. Auto-reporting from memory results that are not bound to the current runtime/baseline/task.
+8. Using stale context from unrelated branches or projects as current-state evidence.
+
+## Required Design
+
+Every persisted memory/state record must include immutable metadata:
+
+```text
+record_id
+user_id
+tenant_id or group_id
+session_id / conversation_id
+project_id
+workspace_id
+branch
+baseline
+agent_id
+source_tool
+created_at
+schema_version
+sensitivity
+retention_class
+```
+
+Every read/search request must include a scope envelope:
+
+```text
+request_user_id
+request_tenant_id / group_id
+request_session_id / conversation_id
+request_project_id
+request_workspace_id
+allowed_branches / current_branch
+allowed_baselines / current_baseline
+purpose
+```
+
+A record is readable only if its metadata matches the request scope policy.
+
+## Enforcement Layers
+
+### 1. Storage namespace isolation
+
+Memory/state paths must be namespaced:
+
+```text
+memory/{tenant_id}/{user_id}/{project_id}/{session_id}/...
+state/{tenant_id}/{project_id}/{workspace_id}/...
+```
+
+No production component may write unrelated contexts into a single global `memory/` directory.
+
+### 2. Metadata enforcement
+
+Untagged records are unreadable by default.
+
+Records without owner/scope metadata may be archived for forensic review but must not be searched or used for live reasoning.
+
+### 3. Query-time ACL
+
+Search must apply a mandatory scope filter before ranking or summarization.
+
+The ranking stage must never receive out-of-scope records.
+
+### 4. Provenance requirement
+
+Every memory/search result used for operational reporting must carry provenance:
+
+```text
+record_id
+scope metadata
+source path or source index
+match reason
+created_at
+```
+
+Responses must prefer current runtime truth sources over memory:
+
+```text
+getRuntimeStatus
+getBaseline
+listPatches
+explicit user-provided current context
+current branch files
+```
+
+Memory search is advisory only after scope validation.
+
+### 5. Fallback safety
+
+If provider search cannot prove scope isolation, the system must use text-only fallback or no-memory fallback.
+
+Fallback must not silently broaden the scope.
+
+### 6. Write-path isolation
+
+Writers must not append current-session records into shared directories.
+
+Writers must derive the target path from the scope envelope, not from a global default.
+
+### 7. Audit and detection
+
+The system must produce audit events when:
+
+- a record is denied due to scope mismatch;
+- untagged memory is encountered;
+- fallback disables memory search;
+- a provider tries to return out-of-scope records;
+- cross-context contamination is detected.
+
+## Acceptance Criteria
+
+A memory/search provider is allowed only if all tests pass:
+
+1. Same user, same project, same session -> records are visible.
+2. Same user, same project, different session -> visible only if policy permits.
+3. Same user, different project -> denied by default.
+4. Different user, same project -> denied unless explicitly shared by group policy.
+5. Different tenant/group -> denied.
+6. Untagged record -> denied.
+7. Stale branch/baseline record -> not used as current evidence.
+8. Provider fallback without scope support -> memory disabled.
+9. Search result provenance is returned and logged.
+10. Out-of-scope records are filtered before ranking/summarization.
+
+## Runtime Rule
+
+If memory search is enabled without these controls, recurrence is possible.
+
+Therefore, memory search must remain disabled or in scoped allowlist mode until the isolation acceptance suite is green.
+
+## Owner Gate
+
+Any change that enables shared memory search, cross-session recall, global vector indexes, or cross-agent memory reuse requires owner/admin approval.
+
+## Final Rule
+
+User data isolation is a redline. Reliability, convenience, or recall quality may not override it.