SECURITY.md
Rama main · réplica de lectura del repositorio original.
# Security Policy — Aegis Latent Core
This policy defines the vulnerability-reporting path, support boundary, production security baseline, runtime evidence rules and release security gates. It is for security researchers, customers, maintainers and operators. It is not a contractual SLA, certification, legal opinion or guarantee of future remediation.
**Last verified:** 2026-10-01 UTC
**Release baseline:** published release (`5.0.2`, keeping the terms it shipped with); latest published release `5.0.2`
**Current source line:** `5.0.2` with fourteen synchronized anchors — the published release that keeps the terms it shipped with, read back on GitHub Release, PyPI and npm (`docs/RELEASE_STATUS.md` §1.0d); the previous release is `v5.0.0`, published 2026-09-16 on every surface except PyPI `aegis-latent-core` — see `docs/RELEASE_STATUS.md` §1.0
**Most recent published line:** `5.0.2`, read back on 2026-10-01 across GitHub Release, PyPI and npm; GHCR was not readable from this environment
**External baseline:** signed annotated `v4.1.2` tag at `860f14177d94c194e5ae7156017d6fa74264e429`, with GitHub Release (31 assets), PyPI `aegis-latent-core` `4.1.2`, PyPI `aegis-latent-sdk` `4.1.2`, npm `aegis-latent-sdk` `4.1.2`, and GHCR gateway and dashboard images, all read back on 2026-09-04
**Historical external baseline:** signed annotated `v4.0.2` tag at `a6eb58dcc03f8b638c8f3e35f0300f5443a926ca`, with GitHub Release and GHCR gateway/dashboard images read back on 2026-09-02; before it, lightweight `v4.0.1` at `6469904380218584ae0b5221334bc9a46500f5ba` with failed tag workflows; PyPI/npm observed at `4.0.0` without attributed provenance
**Private reporting path:** GitHub Private Vulnerability Reporting
## Scope and support posture
Aegis Latent Core is security-sensitive infrastructure. The repository provides defensive controls and evidence paths; it does not certify a deployment, replace customer security governance, or establish legal admissibility.
| Version line | Support status |
|---|---|
| `5.0.x` | Current published line. `5.0.2` is the release read back on GitHub Release, PyPI and npm, and it keeps the terms it shipped with; GHCR was not read back here. |
| `5.0.1` | Previous published line; see the dated readback in `docs/RELEASE_STATUS.md`. |
| `4.0.x` | Previous published line (`v4.0.2` tag, GitHub Release and GHCR images). Its SDK publish jobs were skipped, so neither registry received `4.0.2`. |
| `3.1.x` | Historical v3.1.0 market-hardening line; fixes remain subject to the project's actual operating capacity and supported-version policy. |
| `3.0.x` | Published v3.0.1 baseline. Upgrade to the candidate line for new hardening; security fixes remain subject to the project’s actual operating capacity. |
| `<3.0.0` | Historical releases. Upgrade before requesting support; no default security-fix commitment is made. |
The current source line is `5.0.2`, with `5.0.2` as the latest published release, which keeps the terms it shipped with. The checked-out source is the published release; publication state is recorded only in `docs/RELEASE_STATUS.md` and must be read back from each external surface. The previous release is `5.0.0`: fourteen synchronized anchors, published on 2026-09-16 to the tag, the GitHub Release, PyPI `aegis-latent-sdk`, npm `aegis-latent-sdk` and both GHCR images, but **not** to PyPI `aegis-latent-core`; `cosign verify` and `gh attestation verify` were not run for it. The historical `4.1.2` release and earlier baselines remain documented as history. Release support must be evaluated from published artifacts, while source behavior must be evaluated from the named commit, tests, and deployment prerequisites.
## Distribution channels and what each one enforces
`pip install aegis-latent-core` installs one package carrying both deployment
shapes: the `aegis` / `aegis-server` console scripts that run the gateway as a
separate process, and `aegis.wrap()` that runs the same controls inside the
calling process. `pip install aegis-latent-sdk` and `npm install
aegis-latent-sdk` install proof verifiers only — they enforce nothing and hold
no key. The published core wheel is `py3-none-any`, so the full feature set runs
without the optional `aegis_rust` extension.
**The two shapes are not equivalent security boundaries, and the difference is
the point.** The gateway is a separate process the application cannot bypass:
an application that is itself untrusted still cannot reach the provider without
passing through admission, redaction and the ledger. The embedded engine
governs calls made through the client object it wrapped, and nothing else. Code
in the same process can hold a second unwrapped client, call the provider
directly over its own socket, read or edit the WAL, or read plaintext out of
process memory before redaction ever runs.
Embedded mode is therefore an evidence and policy layer for **cooperative**
application code — it makes the governed path the easy path and produces
records that verify identically to the gateway's. It is not a sandbox, not a
containment boundary against its own process, and not a control you can cite
against an insider or a compromised dependency inside that process. Where the
application is the thing being constrained, deploy the gateway.
## Reporting a vulnerability
**Do not open a public GitHub issue for a security vulnerability.** Use [GitHub Private Vulnerability Reporting](https://github.com/JuanLunaIA/aegis-latent-core/security/advisories/new) when available. If that path is unavailable, use the maintainer contact shown in the repository profile and include only the minimum reproduction data required for triage. Do not send credentials, customer data, live targets, or secrets.
Please include the affected release or commit, deployment boundary, prerequisites, reproducible steps in an authorized environment, impact, and any safe mitigation. Reports may be credited in release notes unless anonymity is requested.
The following are target response objectives for coordinated disclosure, not a contractual SLA until a support agreement names an accountable operations owner:
| Milestone | Target |
|---|---|
| Acknowledgment | 2 business days |
| Initial severity assessment | 5 business days |
| Mitigation or remediation plan | 14 days; 7 days for confirmed critical impact where a safe mitigation exists |
| Public disclosure | After a fix or coordinated disclosure decision |
## Dependency and supply-chain policy
The repository uses pinned dependency resolution, an SBOM, vulnerability scans, and release provenance. CI should block on known critical/high vulnerabilities when a fix is available and must record justified exceptions when upstream remediation does not yet exist. Each exception requires an owner, rationale, compensating control, review date, and removal condition.
Release reviewers should verify `requirements.lock`, `Cargo.lock`, the SPDX SBOM, action references, container base images, and the release asset manifest. A clean scan is evidence about the scanned dependency set at a point in time; it is not a perpetual absence-of-vulnerability guarantee.
## Production security baseline
Strict mode is the production-oriented posture. It requires authentication, durable evidence, strong signing, bounded request bodies, distributed rate limiting, durable storage, and the configured kernel controls. Development or sandbox modes must be explicit and must not be used as production evidence.
The minimum deployment controls are:
```env
AEGIS_SECURITY_ENFORCEMENT_MODE=strict
AEGIS_API_KEYS=<secret-manager-managed-value>
AEGIS_REQUIRE_DURABLE_EVIDENCE=true
AEGIS_REQUIRE_DISTRIBUTED_LIMITER=true
AEGIS_RATE_LIMIT_BACKEND=redis
AEGIS_REDIS_URL=rediss://redis.internal:6380/0
AEGIS_REQUIRE_LSM=true
AEGIS_REQUIRE_SECCOMP=true
AEGIS_MAX_REQUEST_BODY_BYTES=1048576
AEGIS_DEBUG_MODE=false
```
Use a secret manager or approved HSM/Vault integration. Never commit `.env` files, PEM files, bearer tokens, provider credentials, raw WAL records, or customer payloads. Restrict WAL and keyring files to the service owner and preserve them read-only during incident handling.
## Signing and key rotation
HMAC-SHA256 is symmetric and classical. It is suitable only when the deployment accepts shared-secret verification and has a documented custody model. For key rotation, use [`docs/operations/KEY_ROTATION_RUNBOOK.md`](docs/operations/KEY_ROTATION_RUNBOOK.md) and the versioned keyring implementation. The keyring uses one active key, historical verify keys with explicit expiry, atomic reload, and non-secret `key_id` metadata. A malformed replacement must leave the prior valid snapshot active or fail closed; it must never produce an unsigned record.
The native ML-DSA-65 path is available only when the real Rust extension is present. It does not silently return a simulated signature. Native availability is not a claim of constant-time execution, FIPS 140 validation, or legal admissibility. The timing assessment boundary is documented in [`docs/security/PQC_CONSTANT_TIME.md`](docs/security/PQC_CONSTANT_TIME.md).
## Network and ingress boundary
Terminate TLS at a controlled ingress or at Aegis and document which component owns HTTP/2 parsing and normalization. Use mTLS where the customer threat model requires caller certificates. Configure upstream TLS validation and egress allowlists. Application-layer endpoint validation does not replace firewall policy, network namespaces, Kubernetes NetworkPolicy, cloud IAM, or provider-side controls.
The WAF operates at the application boundary. The pinned local corpus and its limitations are documented in [`docs/security/WAF_TESTING.md`](docs/security/WAF_TESTING.md). HTTP/2 fragmentation and ingress parser differential tests remain a separate acceptance requirement.
## Runtime evidence and sample material
Aegis runtime evidence must come from live control paths, test fixtures, or retained benchmark artifacts. `Samples/01-overview.html` is a static dashboard demo and may contain synthetic display values to illustrate layout and interaction. Its values, hashes, counts, provider names, and timestamps must never be presented as production telemetry, customer activity, cryptographic proof, or release evidence.
The repository’s real-vs-unavailable contract is fail-closed for security-sensitive capabilities. When a dependency such as native ML-DSA, Seccomp, an HSM, a TPM, or an external audit tool is absent, the capability must report unavailable or refuse the operation. A demo sample is not an exception to this rule because it is not on the governed runtime path.
## Security-relevant release gates
A release is blocked when a governed accepted response lacks durable evidence in the declared scope, chain verification fails, a critical WAF corpus case bypasses, a valid rotation loses or invalidates a record, a security scan fails without a reviewed exception, a runtime control is absent in strict mode, or public documentation overstates the evidence. Release artifacts must include tests, SBOM, provenance, hashes, rollback instructions, and residual risks.
## Security assurance roadmap
The external-assurance sequence is maintained in [`docs/SECURITY_ASSURANCE_ROADMAP.md`](docs/SECURITY_ASSURANCE_ROADMAP.md). It separates repository evidence from independent code review, penetration testing, crypto review, disaster-recovery evidence, customer pilot results, and certification or attestation work owned by qualified external parties.
## License and disclosure caveat
From v5.0.3 the gateway, the control plane and the dashboard are licensed under the Aegis Commercial License 1.0 (`LicenseRef-Aegis-Commercial-1.0`; [`LICENSE`](LICENSE), [`NOTICE`](NOTICE)); releases published before v5.0.3 keep the terms they shipped with; the SDKs in `sdk/python` and `sdk/typescript` stay under their own Apache licence; and [`COMMERCIAL.md`](COMMERCIAL.md) describes what is sold. License interpretation, contractual remedies, regulatory obligations and legal strategy require counsel in the applicable jurisdiction.
## Related documents
- [`README.md`](README.md)
- [`docs/CLAIMS_MATRIX.md`](docs/CLAIMS_MATRIX.md)
- [`docs/security/THREAT_MODEL.md`](docs/security/THREAT_MODEL.md)
- [`docs/security/WAF_TESTING.md`](docs/security/WAF_TESTING.md)
- [`docs/security/PQC_CONSTANT_TIME.md`](docs/security/PQC_CONSTANT_TIME.md)
- [`docs/operations/ROLLBACK_RUNBOOK.md`](docs/operations/ROLLBACK_RUNBOOK.md)
- [`COMMERCIAL.md`](COMMERCIAL.md)