69 lines
4.1 KiB
Markdown
69 lines
4.1 KiB
Markdown
# Criticality and Risk Analysis of werkregie
|
|
|
|
The section "Required Checks" of [agentic-workflow.md](agentic-workflow.md) requires this document.
|
|
Only the human sets or changes the criticality.
|
|
|
|
## Criticality
|
|
|
|
**high**, set by the human on 2026-10-13.
|
|
|
|
- The server is reachable from the internet, at https://werkregie.javagil.de.
|
|
- It holds credentials of other systems: Gitea tokens, the Taiga password, Werkator's control token.
|
|
- It shows excerpts of private work: Claude Code transcripts, Matrix messages, private repositories.
|
|
|
|
So a known vulnerability of a dependency fails the build from CVSS 4.
|
|
|
|
## What werkregie Handles
|
|
|
|
- **Server on mih09:**
|
|
- data: pull requests, builds, review costs, Taiga items, the relays' reports, the Werkjournal of 400 days;
|
|
- credentials: the access token, Gitea tokens, the Taiga password, Werkator's control token, the OpenRouter key.
|
|
- **Werkator on mih09:** the deploy key, which opens nothing but the receiver of the runtime bundle.
|
|
- **Relay on think:**
|
|
- data: Claude Code and Codex sessions, the ends of their transcripts, Matrix messages;
|
|
- credentials: the relay's copy of the access token, the Matrix device session and its keys, the Jev key.
|
|
- **Browser:** the last state of the dashboard in `localStorage`, and the access token as cookie.
|
|
|
|
Texts leave the machines only to the server, to Jev (at most 3000 characters of a message),
|
|
and to OpenRouter (tooltip texts over 160 characters).
|
|
|
|
## Who Reaches It
|
|
|
|
- Anyone on the internet reaches the server through Hostsharing's Apache, which terminates TLS.
|
|
Without the access token, the server shows invented demo data only.
|
|
- The access token is 24 random bytes, compared in constant time; the relay endpoint refuses the cookie.
|
|
- The server binds to 127.0.0.1; the relay only sends, nothing from the network reaches into it.
|
|
- werkregie only reads the tools it shows; it writes only its own state,
|
|
and reactions and messages into Matrix by `matrix react` and `matrix send`,
|
|
which only a process of the user on the relay's machine can run, as `matrix read`:
|
|
the relay takes them on the socket `control.sock` in the directory of the device's keys (0700, the socket 0600),
|
|
and only these three commands.
|
|
- Werkator's build `deploy` reaches the server's user over ssh, with a key whose forced command is the receiver;
|
|
it installs only a commit of `main` whose build was green.
|
|
|
|
## What a Breach Would Cost
|
|
|
|
- Read access to the Gitea instances, Taiga and Werkator in the name of the user.
|
|
- Disclosure of private work, of customers' names in the Werkjournal, and of Matrix messages.
|
|
- No money and no production data of customers: werkregie writes to no other system but Matrix, and there only reactions.
|
|
|
|
## Risks
|
|
|
|
| Risk | Measure |
|
|
|------|---------|
|
|
| a vulnerable dependency, e.g. of Jackson, Ktor or Trixnity | OWASP Dependency-Check from CVSS 4: a PR's own, main each night |
|
|
| a dependency under a license the user cannot accept | license check against the allowlist in each build |
|
|
| the access token leaks, e.g. through a script on the page | no foreign scripts, each text escaped; rotate by deleting |
|
|
| a cross-site request with the cookie of a logged-in browser | writing endpoints take the token only as bearer header |
|
|
| native code, sqlite-jdbc and vodozemac | both under OWASP Dependency-Check; updated with the other libraries |
|
|
| a wrong reaction in a Matrix room, e.g. on the wrong announcement | only own messages, the text not followed by a letter or digit; no reaction twice |
|
|
| another process on the relay's machine sends reactions or messages, or reads rooms, through `control.sock` | only processes of the user reach the socket, which could run the commands themselves; it takes only `react`, `send` and `read` |
|
|
| an agent sends a wrong message into a room | plain text only, sent in the user's name; the agent asks the human before each message |
|
|
| a change whose tests do not check it | mutation tests with werkcrappit: the changed classes in each build, all of main each night |
|
|
|
|
Open risk: the server sends no security headers, e.g. Content-Security-Policy or Strict-Transport-Security.
|
|
|
|
## Deviations from the Defaults of the Required Checks
|
|
|
|
- None.
|