# Hardening Checklist (Demo Readiness)

This checklist defines **pass/fail criteria** for calling the demo “fully hardened,”
including the goal of a static envelope around a dynamic agent.
Each item includes a current status and evidence pointer.

Status key: `DONE`, `PARTIAL`, `TODO`.

## 1) Enforcement Path (Policy -> Physics)

- **All side effects go through nucleus-tool-proxy**
  - Pass: CLI/tool adapters can only execute file/command/network ops via the proxy API.
  - Current: `DONE` (CLI uses node + MCP; no unsafe direct mode).
  - Evidence: `crates/nucleus-cli/src/run.rs`
- **CLI hard-fail if not enforced**
  - Pass: No unsafe flags; enforced mode is the default path.
  - Current: `DONE` (unsafe flag removed).
  - Evidence: `crates/nucleus-cli/src/run.rs`
- **Node API requires signed requests**
  - Pass: nucleus-node rejects unsigned HTTP/gRPC calls.
  - Current: `DONE` (auth secret required).
  - Evidence: `crates/nucleus-node/src/main.rs`, `crates/nucleus-node/src/auth.rs`

## 2) Network Egress Control

- **Default-deny enforced for Firecracker pods**
  - Pass: netns iptables default DROP even without `spec.network`.
  - Current: `DONE`.
  - Evidence: `crates/nucleus-node/src/main.rs`, `crates/nucleus-node/src/net.rs`
- **IPv6 is denied or disabled**
  - Pass: ip6tables mirrors default-deny OR guest IPv6 is disabled.
  - Current: `DONE` (guest IPv6 disabled at boot).
  - Evidence: `crates/nucleus-node/src/main.rs`
- **DNS allowlisting**
  - Pass: explicit hostname allowlist enforced (ipset/dnsmasq or equivalent).
  - Current: `DONE` (dnsmasq proxy with pinned hostname resolution).
  - Evidence: `crates/nucleus-node/src/net.rs`, `crates/nucleus-spec/src/lib.rs`

## 3) Approvals (AskFirst)

- **Approvals are cryptographically signed**
  - Pass: approvals require signed tokens with nonce + expiry, verified in proxy.
  - Current: `DONE` (approval secret required; nonce + expiry enforced).
  - Evidence: `crates/nucleus-tool-proxy/src/main.rs`
- **Approval replay protection**
  - Pass: nonce cache + expiry enforced for all approvals.
  - Current: `DONE` (nonce required for approvals).
  - Evidence: `crates/nucleus-tool-proxy/src/main.rs`

## 4) Isolation (VM Boundary)

- **Rootfs is read-only**
  - Pass: image configured read-only; scratch is explicit and limited.
  - Current: `DONE` (when image spec requests it).
  - Evidence: `scripts/firecracker/build-rootfs.sh`, `crates/nucleus-node/src/main.rs`
- **Guest has no extra services**
  - Pass: init runs tool-proxy only.
  - Current: `DONE`.
  - Evidence: `crates/nucleus-guest-init/src/main.rs`
- **Seccomp enforced**
  - Pass: seccomp profile configured and verified post-spawn.
  - Current: `DONE` (config applied via `apply_seccomp_flags`; post-spawn `/proc/{pid}/status` verification checks mode=2).
  - Evidence: `crates/nucleus-node/src/main.rs` (verify_seccomp_active, apply_seccomp_flags), `crates/nucleus-spec/src/lib.rs` (SeccompSpec)

## 4.5) Monotone Security Posture (Immutability)

- **No privilege relaxation after creation**
  - Pass: permission state can only tighten or the pod is terminated.
  - Current: `DONE` (Lean 4 + Kani-proven E1-E3 enforcement boundary + runtime debug_assert).
  - Evidence: `crates/portcullis/src/kani.rs` (E1: exposure monotonicity, E2: trace monotonicity, E3: denial monotonicity), `crates/portcullis-core/lean/` (Lean theorems), `crates/portcullis/src/guard.rs` (debug_assert in execute_and_record)
- **Network policy drift detection**
  - Pass: host checks iptables drift and fails closed on deviation.
  - Current: `DONE`.
  - Evidence: `crates/nucleus-node/src/net.rs`, `crates/nucleus-node/src/main.rs`
- **Seccomp immutability documented**
  - Pass: docs explicitly state seccomp is fixed at Firecracker spawn.
  - Current: `DONE`.
  - Evidence: `docs/architecture/overview.md`, `README.md`

## 5) Audit + Integrity

- **Audit log signatures**
  - Pass: log entries are signed; verification tool exists.
  - Current: `DONE` (signatures enforced; verifier available).
  - Evidence: `crates/nucleus-tool-proxy/src/main.rs`, `crates/nucleus-audit/src/main.rs`
- **Remote append-only storage**
  - Pass: logs shipped to append-only store (or immutability proof).
  - Current: `DONE` (S3AuditBackend with `if_none_match("*")` append-only semantics; behind `remote-audit` feature flag).
  - Evidence: `crates/portcullis/src/s3_audit_backend.rs`, `crates/nucleus-spec/src/lib.rs` (AuditSinkSpec)

## 6) Formal Assurance Gates

- **ν laws proven in CI**
  - Pass: Lean/Kani proof jobs run in CI and block merges on failure.
  - Current: `DONE` (113 Kani harnesses + ~277 Lean 4 theorems; both gated on main — Kani via count-regression per-PR + full nightly, Lean via `sorry`-rejection on the Aeneas-bridged core).
  - Evidence: `.github/workflows/kani-nightly.yml`, `.github/workflows/lean-build.yml`, `.github/workflows/aeneas-ifc-scoped.yml`, `crates/portcullis/src/kani.rs`, `crates/portcullis-core/lean/`
- **Fuzzing in CI**
  - Pass: cargo-fuzz targets run with time budget; known bypasses blocked.
  - Current: `DONE` (3 fuzz targets × 30s; Fuzz is a required merge check on main).
  - Evidence: `fuzz/`, `.github/workflows/ci.yml`

## 6.5) Web Ingress Control

- **MIME type gating on web_fetch**
  - Pass: only text and structured data MIME types are allowed; binary formats blocked.
  - Current: `DONE` (allowlist: text/*, application/json, application/xml, etc.).
  - Evidence: `crates/nucleus-tool-proxy/src/main.rs` (web_fetch handler)
- **Exposure provenance on fetched content**
  - Pass: all web-fetched content is tagged with `X-Nucleus-Exposure: UntrustedContent` + source domain.
  - Current: `DONE`.
  - Evidence: `crates/nucleus-tool-proxy/src/main.rs` (response headers)
- **URL pattern allowlisting**
  - Pass: per-pod URL pattern allowlist via `NetworkSpec.url_allow`.
  - Current: `DONE` (glob-style matching; empty = allow all permitted domains).
  - Evidence: `crates/nucleus-spec/src/lib.rs` (NetworkSpec), `crates/nucleus-tool-proxy/src/main.rs`

## 7) Demo Verification Script

- **Network policy test**
  - Pass: `scripts/firecracker/test-network.sh` passes with allow/deny.
  - Current: `DONE` (manual).
  - Evidence: `scripts/firecracker/test-network.sh`

## Exit Criteria (Full Hardened Demo)

All items above at `DONE`, and:
- Enforced CLI path is the default.
- IPv6 + DNS allowlisting are covered.
- Signed approvals + audit verification are implemented.
- CI gates (Kani + fuzz + integration tests) are in place.
