Framework trust-boundary model and adversarial assurance

Clean Framework · DOCUMENTATION

Framework trust-boundary model and adversarial assurance

Bounded candidate reference — 2026-10-20: 0.2.0-rc.1 is committed locally through 84f415b3098af5653577b2c65eea31fca21df79c, unpublished and not production-approved; stable PHP >=8.5.11 <8.6.0 is required. This is documentation, not adoption: this knowledge base retains its installed 0.1.0-rc.1 dependency and PHP 8.2.11 local profile. Dated PHP 8.2 evidence is historical; earlier dirty-source reports retain their original test provenance, not retroactive clean-commit proof. Candidate examples are illustrative: API signatures were reviewed, but candidate code was not executed by this editorial update. See current checkpoint, open criteria and adoption boundary.

Recorded 2026-10-17. This is a maintainer/agent source review and test plan, not independent review, penetration testing, compliance certification or production acceptance. Scope is the neutral framework; the legacy bridge is quarantined, not implicitly security-qualified by compilation.

Trust model

untrusted browser / machine / signed provider / generated content
  -> bounded HTTP parsing -> explicit authentication / signature / CSRF
  -> application object/tenant policy -> use case / approved action
  -> bound SQL + transaction / private bytes / queue + outbox
  -> trusted adapter config -> outbound transport + deployment egress policy

all boundaries -> bounded safe events -> private logs / append-only audit

Only application composition chooses credentials, trusted proxies, routes, provider origins, roles, schemas, file ownership and registered action handlers. Model output, route input and document contents never grant execution authority. Public derivative caches are not private storage. A PHP guard is not server hardening; an approved hostname is not proof of its current IP address.

Threat and ownership register

Boundary / abuse	Severity if exploited	Control and evidence	Owner / remaining acceptance
Anonymous/forbidden request constructs privileged controller	High	Ordered middleware before controller factories; deterministic and native HTTP tests	Framework routing; application route-policy review
Cross-tenant object or wrong-owner file access	High	Exact policy/resource/context, protected denial before path resolution, concealed 404/range checks	Application owns real tenant/object rules
CSRF, fixation, stale identity, step-up bypass	High	Rotated IDs/proofs, idle/absolute/version state, recent-auth timestamp checks; native/fake tests	Framework mechanics; deployment cookie/shared-session policy
Replayed or expanded high-risk approval	High	Assisted Action digest/revision/scope binding and optimistic execution claim; replay denied	Application durable store and authoritative reconciliation
Machine credential leak/expired scope	High	Digest storage, environment/lifecycle/scopes, bearer-header only; redacted safe metadata	Application rotation/revocation/operator access
Browser spoofed forwarded headers	High	Immediate-peer CIDR policy; walk from trusted peer, bounded malformed-chain rejection	Deployment maintains trusted proxy list; never trust all by convenience
OAuth state replay/expiry/PKCE substitution	High	Private digest-indexed state, one-time consume, exact provider/environment, S256 verifier	Application callback/session/redirect registration; real provider sandbox separate
Changed webhook bytes/replayed event	High	Signature over exact timestamp/body, freshness, receipt key, explicit unknown events	Application signature adapter and atomic receipt/outbox composition
Path traversal, symlink, MIME confusion, oversized derivative	High	Opaque keys, realpath containment, policy-before-read, fileinfo allowlist, predecode image ceilings	Private filesystem ownership/scanner/native-tool gates still required
Malformed headers/body/framing and resource amplification	Medium/High	Count/byte/value/depth bounds, CTL rejection, repeated framing/TE+CL denial; deterministic corpus	HTTP server must independently reject wire-level request smuggling
Outbound URL/redirect/proxy authority expansion	High	Optional exact-origin transport denies unknown origins/redirects/proxies/insecure TLS; cURL ignores implicit proxy env	Config review plus DNS/IP egress firewall; allowlist is not DNS pinning
Secrets/private payload/PII in logs or log-exhaustion	High/Medium	Sensitive-key rejection/redaction, stable event codes, finite depth/nodes/record bytes, no object hooks	Applications classify unknown values and use opaque IDs; key filtering is not a universal PII detector
SQL injection, migration drift, partial DDL, unknown commit	High	Bound values, allowlisted identifiers, locks/ledger, TEST guard/PROD checkpoint, conservative reconciliation	Operators own matched backup/code and production restore; real fixture proves only its scope
Lease expiry, stale worker completion or duplicated effect	High	Dedicated WP-04 epoch/expiry/process drills required; at-least-once guarantee only	Framework lease mechanics; application idempotency/reconciliation
Prompt-injection selects handler or expands scopes	High	Closed registered schemas/actions, source scopes, independent approvals, step-up, immutable proposal revision, no blind unknown retry	Application trusted prompt/action policy; no paid model or browser executor enabled

Severity describes impact, not a claim that every row has a demonstrated flaw. Deployment/application owners must assign named primary and backup reviewers before enabling the corresponding capability. No actual private account/data was used to create this model or its fixtures.

Demonstrated source findings and disposition

ID	Finding	Severity	Disposition
CF-S01	OAuth accepted state at the exact expiry instant	Medium	Exclusive expiry comparison; exact-boundary/consume/replay regression
CF-S02	Log filtering missed private payload/PII key variants and had unbounded recursion	Medium (higher with sensitive caller inputs)	Bounded shared filter; stable event codes/size ceiling; audit rejects matching sensitive keys
CF-S03	HTTP field controls/count/bytes were incompletely bounded; duplicate framing could be hidden by case normalization	Medium (wire-level impact depends on upstream)	Typed 400/431 checks, canonical source merging, CTL/ambiguity corpus; host proxy chain not certified
CF-S04	Array-valued CSRF proof was coerced and could emit a diagnostic	Low	Reject non-string proof as 419 without coercion or handler invocation
CF-S05	cURL implicitly inherited process proxy environment	Medium in misconfigured runtime	Explicit configured proxy or disabled proxy; documented compatibility change
CF-S06	Asset source was decoded before compressed-byte/source-pixel bounds	Medium (source directory must already be trusted)	20 MiB compressed/12 million pixel/12,000 dimension ceilings before GD; synthetic huge-header denial
CF-S07	Multipart filename regex was invalid and could miss forbidden characters	Medium (trusted outbound adapter input)	Separate delimiter-free control/quote and path separator checks; negative regression; static analyzer catches invalid regex

No discovered live credential or production incident is implied. Fixes remain subject to full candidate tests and independent review. Do not describe an unreviewed high-risk deployment as safe merely because its unit tests pass.

Independent review protocol

The Urgent candidate adds account-scoped atomic receipt/outbox intake, stable queue handoff, SQL-only completion and reference-aware payload recovery. The bounded reviewer packet maps these changes together with auth/RBAC/object policy, CSRF/OAuth, approvals, logs/storage/recovery and exact local reproductions. Local INT-09/10 PASS does not close SEC-16: independent reviewer assignment/disposition remains absent.

Owner assigns an actual reviewer not responsible for the implementation; record identity, date, exact candidate artifact/source hashes and scope.
Review boundary configuration, authorization/object isolation, redaction, cryptography/key lifecycle, input/native-tool limits and concurrency/recovery.
Reproduce positive and negative cases in a designated disposable fixture; never test another application or hosted system without separate permission.
Record findings with severity, reproducer, owner, fix, regression and explicit residual risk. Critical/high findings require independent disposition before enabling the affected production capability.
Retest the exact corrected artifact; sign-off is a recorded human decision, not an agent-authored claim of independence.

Current independent review: TO VERIFY; Daniel Horowitz is owner-assigned, but independence confirmation and dated disposition are not supplied. Local work may continue, but no production promotion can bypass this external gate.

Deployment and test checklist

Enforce host request/body/time limits; TLS, trusted proxy and real bearer forwarding; public-only document root and script/private-file denial.
Keep configuration/keys/session/upload/log/backup directories non-public; select shared stores before multi-node claims and test permissions/failure.
Bind endpoint origins from trusted config, deny user-controlled fetch URLs, configure network egress and DNS ownership; never turn redirects into policy.
Default optional native media/providers/AI/action executors to disabled until their specific isolation, quotas, native-tool and application tests pass.
Run composer verify, explicit Apache acceptance and approved real SQL/ durable-process suites; tests use synthetic inputs and contain their artifacts.
Complete external review, backup/restore, named operator and final-host gates separately. No source test authorizes a deployment.

The bounded corpus is regression/property-style testing, not an exhaustive fuzzer. Existing 55 framework scenarios cover authentication-before-construction, object policy, state rotation, step-up and Assisted Action authority/replay; tests/security_assurance.php expands malformed/framing/proxy/redaction/OAuth/ webhook/private-file/MIME cases. Native-tool decompression and distributed store proof belong to their later packages and must not be inferred here.

Design references: OWASP logging and OWASP SSRF prevention.

Editorial provenance

Source: docs/SECURITY_THREAT_MODEL.md. Source SHA-256: 22d97a0c60fc78b4005ddfdbbdc10e22061880f83c481d60ee667da96563b9bc.

Framework candidate reference; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.