Wire R4 (Ed25519 author signatures) into the worker dialect-install path #6

New issue

Open

opened 2026-05-11 13:10:19 +00:00 by hugooconnor · 0 comments

hugooconnor commented

2026-05-11 13:10:19 +00:00

(Migrated from codeberg.org)

cbcl-rs has type-level support for R4 (Ed25519 signatures on dialect bodies) — Signer trait, verify_r4(d, signer). But hark's DialectCache::try_install does not call it. Today any define that passes R1+R2+R3+R5 lands in the cache regardless of whether the author signed it or whether the worker trusts that author.

Under the threat model "honest workflow easy, dishonest no wire harm," dialect-name squatting and forged-author defines are the most acute open vector. R4 enforcement on the worker install side, combined with a worker-side trusted authors policy, collapses squatting to "spoof an Ed25519 key" — the hard cryptographic case, which is exactly where you want the trust horizon.

Mitigation

Two layered changes:

Wire verify_r4 into the install path. Extend DialectCache::try_install to accept a &dyn Signer (or a Vec<TrustedAuthor>) and reject defines whose :signature clause doesn't verify against any trusted author. Honest-actor install path passes a real signer; today's tests pass a permissive stub.
Trusted-authors config. Workers declare which authors they trust in config.toml (e.g. [trusted_authors] anuna = "ed25519:abc…"). Pushed defines from unknown authors are logged and dropped, not installed.

Acceptance

DialectCache::try_install takes an &impl Signer (or trusted-author registry) and runs R4 in addition to R1-R5.
Config grows [trusted_authors] section: name → hex-encoded Ed25519 pubkey.
Daemon constructs a registry-backed Signer from config at startup; passes to every cache instance.
Defines lacking :signature are rejected when any trusted_authors are configured (open mode when none configured — backwards-compatible for current dev flows).
CLI surface: hark dialect query <name> shows the author + signature status alongside <digest> <name>.
New error code r4_signature_unverified mapped to exit 8.
Tests: signed-by-trusted installs; signed-by-untrusted rejected; unsigned rejected when in strict mode; unsigned accepted in open mode.

Out of scope

Author key distribution / rotation protocol (out-of-band for now).
Quoram / multi-signature authoring.
Revocation of previously-installed defines on author key compromise.

See discussion in hark conversation on the dialect-distribution threat model.

cbcl-rs has type-level support for R4 (Ed25519 signatures on dialect bodies) — `Signer` trait, `verify_r4(d, signer)`. But hark's `DialectCache::try_install` does not call it. Today any define that passes R1+R2+R3+R5 lands in the cache regardless of whether the author signed it or whether the worker trusts that author. Under the threat model "honest workflow easy, dishonest no wire harm," dialect-name squatting and forged-author defines are the most acute open vector. R4 enforcement on the worker install side, combined with a worker-side **trusted authors** policy, collapses squatting to "spoof an Ed25519 key" — the hard cryptographic case, which is exactly where you want the trust horizon. ## Mitigation Two layered changes: 1. **Wire `verify_r4` into the install path.** Extend `DialectCache::try_install` to accept a `&dyn Signer` (or a `Vec<TrustedAuthor>`) and reject defines whose `:signature` clause doesn't verify against any trusted author. Honest-actor install path passes a real signer; today's tests pass a permissive stub. 2. **Trusted-authors config.** Workers declare which authors they trust in `config.toml` (e.g. `[trusted_authors] anuna = "ed25519:abc…"`). Pushed defines from unknown authors are logged and dropped, not installed. ## Acceptance - [ ] `DialectCache::try_install` takes an `&impl Signer` (or trusted-author registry) and runs R4 in addition to R1-R5. - [ ] Config grows `[trusted_authors]` section: name → hex-encoded Ed25519 pubkey. - [ ] Daemon constructs a registry-backed `Signer` from config at startup; passes to every cache instance. - [ ] Defines lacking `:signature` are rejected when any trusted_authors are configured (open mode when none configured — backwards-compatible for current dev flows). - [ ] CLI surface: `hark dialect query <name>` shows the author + signature status alongside `<digest> <name>`. - [ ] New error code `r4_signature_unverified` mapped to exit 8. - [ ] Tests: signed-by-trusted installs; signed-by-untrusted rejected; unsigned rejected when in strict mode; unsigned accepted in open mode. ## Out of scope - Author key distribution / rotation protocol (out-of-band for now). - Quoram / multi-signature authoring. - Revocation of previously-installed defines on author key compromise. See discussion in hark conversation on the dialect-distribution threat model.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

anuna-research/hark#6

No description provided.

Rows
Columns