Harden harness digests, canary, and HITL defaults. (#43)

Bind adversarial probes into scripts/harness, require a non-trivial verify canary, exercise real AUTH/OTEL/ASI05 checks, and stop auto-approving company-day exceptions by default.

Co-authored-by: Sage Hart <sagehart@MacBookAir.attlocal.net>

Author: SafetyMP

AGENTS.md

@@ -7,12 +7,21 @@
 | `./scripts/harness/verify.sh`      | Functional and static acceptance    |
 | `./scripts/harness/adversarial.sh` | Authorized local adversarial probes |
 
-Record `verification_scripts` as the site directory `scripts/harness` (exactly those
-two scripts). Optional wrappers may remain at `scripts/verify.sh` /
-`scripts/adversarial.sh` for humans; they are outside the digest boundary.
+Record `verification_scripts` as the site directory `scripts/harness`. Required
+entrypoints are `verify.sh` and `adversarial.sh`. Digest-bound companions under
+the same directory (included in the harness digest) are:
+
+- `check-stub-canary.sh` — mandatory non-trivial verify canary
+- `adversarial-run.mjs` — adversarial probe implementation
+
+Optional wrappers may remain at `scripts/verify.sh` / `scripts/adversarial.sh`
+(and `scripts/check-stub-canary.sh`) for humans; they are outside the digest
+boundary.
 
 The corporate handoff fixes scope. The site manager assigns ADRs; site specialists write;
 operations excellence reviews current evidence. Work in isolated roots, never edit
 corporate approval state, and never self-approve.
 
 Site id: `corpos`. Prior Cursor Harness v4 is under `_archives/harness-v4/`.
+Product company-day demos must not auto-approve exceptions unless a test/CI
+caller passes `autoApproveException: true` explicitly.

apps/api/package.json

@@ -3,6 +3,14 @@
   "version": "0.2.0",
   "private": true,
   "type": "module",
+  "main": "./dist/app.js",
+  "types": "./dist/app.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/app.d.ts",
+      "import": "./dist/app.js"
+    }
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",

apps/api/src/app.ts

@@ -21,7 +21,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
-function requireAuth(c: { req: { header: (n: string) => string | undefined } }): boolean {
+/** Dashboard bearer gate — exported for adversarial behavioral probes. */
+export function requireAuth(c: { req: { header: (n: string) => string | undefined } }): boolean {
   if (process.env.CORPOS_MODE !== "shared") return true;
   const expected = process.env.DASHBOARD_API_TOKEN?.trim();
   if (!expected) return false;
@@ -97,10 +98,11 @@ export function buildApp(company: Company, mode: "simulation" | "live" = "simula
   });
 
   app.post("/api/company-day", async (c) => {
-    let autoApproveException = true;
+    // Default off: do not imply human approval. Explicit body opt-in for demos/tests.
+    let autoApproveException = false;
     try {
       const body = await c.req.json<{ autoApproveException?: boolean }>();
-      if (body.autoApproveException === false) autoApproveException = false;
+      if (body.autoApproveException === true) autoApproveException = true;
     } catch {
       /* empty body */
     }

apps/console/src/main.tsx

@@ -113,7 +113,7 @@ function App() {
       const r = (await fetch("/api/company-day", {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ autoApproveException: true }),
+        body: JSON.stringify({ autoApproveException: false }),
       }).then((res) => res.json())) as CompanyDay;
       setDay(r);
       await refresh();

docs/governance-crosswalk.md

@@ -13,7 +13,7 @@ Pedagogical mapping only — **not** a certification claim.
 
 ## OWASP Top 10 for Agentic Applications 2026
 
-See Governor `/api/governance` and `scripts/adversarial-run.mjs` ASI cells.
+See Governor `/api/governance` and `scripts/harness/adversarial-run.mjs` ASI cells.
 
 ## Related standards
 

evidence/site-delivery/receipt.json

@@ -1,8 +1,45 @@
 {
   "schema": "corpos-site-delivery-receipt/v1",
   "program_id": "corpos-autonomous-company-r2",
-  "recorded_at": "2026-07-26T13:13:35.124777+00:00",
+  "site_id": "corpos",
+  "recorded_at": "2026-07-26T13:33:11.756553+00:00",
+  "captured_at": "2026-07-26T13:33:11.756553+00:00",
+  "node": "v26.4.0",
   "verify": "PASS",
   "adversarial": "PASS",
-  "notes": "Orchestrator + governance plane revision; shared firm store; ASI matrix."
+  "verification_scripts": "scripts/harness",
+  "verify_argv": ["./scripts/harness/verify.sh"],
+  "adversarial_argv": ["./scripts/harness/adversarial.sh"],
+  "verification_scripts_sha256": "8415380abcd32346db4a1c151dd4c063dddc58bb3f561780360c0eae62489538",
+  "harness_file_sha256": {
+    "adversarial-run.mjs": "3438da18530a0a6de798566eacd97a08456054edbedb026a0563e6475cae66fd",
+    "adversarial.sh": "c5c40ecb99ba3c5322d036ed7c6838a6f969e343003f5da3148a17288cb11d52",
+    "check-stub-canary.sh": "7bf1f3ceda1fa7e5f5feee2da0bbc17597c457ffa8b491801162ed8d05e59db5",
+    "verify.sh": "688518e9a148710768bb565525cac41c78a4092208069b6fea08825ed1483df8"
+  },
+  "surfaces": {
+    "firm_work_control": "packages/core/src",
+    "api": "apps/api/src",
+    "console": "apps/console/src",
+    "mcp_knowledge": "packages/mcp-knowledge/src",
+    "adrs": "docs/adr",
+    "essay": "docs/future-of-the-firm.md"
+  },
+  "company_day": {
+    "contractId": "ctr_g16siuyoYE",
+    "handoffs": 2,
+    "autonomousSettles": 1,
+    "exceptionSettles": 1,
+    "compensated": 1,
+    "trustAfter": 2,
+    "slaExceptions": 1,
+    "auditHead": "913d51c35e75fe4c148b6f893b2add53975564e8033874f24ce8be8737280e5e",
+    "ok": true
+  },
+  "adversarial_stdout": "adversarial: ok",
+  "stack_forbidden_absent": {
+    "better-sqlite3": true,
+    "express_import": true
+  },
+  "notes": "Harness effectiveness remediation: digest-bound probes/canary; behavioral AUTH/OTEL/ASI05; HITL auto-approve default off."
 }

packages/core/src/company-day.ts

@@ -50,7 +50,10 @@ export async function runCompanyDay(opts?: {
   company?: Company;
   withMcp?: boolean;
   serverCommand?: { command: string; args: string[] };
-  /** Auto-approve ops exception for deterministic CI (console can decide manually). */
+  /**
+   * Explicit opt-in only. Default false so demo/API paths do not imply human
+   * approval. Tests/CI that need a settled exception must pass true.
+   */
   autoApproveException?: boolean;
 }): Promise<{ company: Company; result: CompanyDayResult }> {
   resetSpans();
@@ -194,7 +197,7 @@ export async function runCompanyDay(opts?: {
     delegationDepth: 2,
   });
 
-  const autoApprove = opts?.autoApproveException !== false;
+  const autoApprove = opts?.autoApproveException === true;
   if (ops.awaitingExceptionId) {
     push({
       agentId: "agent_ops",
@@ -209,7 +212,7 @@ export async function runCompanyDay(opts?: {
         agentId: "agent_ops",
         role: "Ops",
         kind: "exception",
-        summary: "Human approved restart; billing-api restarted.",
+        summary: "Demo auto-approved restart (explicit opt-in); billing-api restarted.",
       });
       await company.trust.recordAccept("agent_support");
       push({

scripts/check-stub-canary.sh

@@ -1,10 +1,3 @@
-#!/usr/bin/env bash
-# DO_NOT_DELETE_STUB_CANARY
-set -euo pipefail
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-cd "$ROOT"
-if [[ -f scripts/verify.sh ]] && grep -q 'TODO: add real test' scripts/verify.sh; then
-  echo "STUB_CANARY: placeholder verify.sh" >&2
-  exit 1
-fi
-echo "check-stub-canary: ok"
+#!/usr/bin/env bash
+set -euo pipefail
+exec "$(cd "$(dirname "$0")" && pwd)/harness/check-stub-canary.sh" "$@"

scripts/adversarial-run.mjs scripts/harness/adversarial-run.mjsscripts/adversarial-run.mjs renamed to scripts/harness/adversarial-run.mjs

@@ -6,6 +6,7 @@ import {
   listSpans,
   resetSpans,
 } from "@corpos/core";
+import { buildApp } from "@corpos/api";
 import { eq } from "drizzle-orm";
 import fs from "node:fs";
 import path from "node:path";
@@ -19,6 +20,8 @@ function cell(id, ok, detail = "") {
   if (!ok) throw new Error(`${id} failed: ${detail}`);
 }
 
+const DANGEROUS_TOOL_RE = /\b(shell|eval|exec|spawn|child_process|bash|powershell|os\.system)\b/i;
+
 // ASI02 / gateway bypass
 const bypass = await company.gateway.invoke(
   "evil.shell",
@@ -37,13 +40,17 @@ cell(
   "unknown tool",
 );
 
-// ASI05 attestation — no shell/eval tools
-const aibomPath = path.resolve("docs/aibom.json");
-const aibom = JSON.parse(fs.readFileSync(aibomPath, "utf8"));
+// ASI05 — live tool registry scan (not AIBOM self-attestation alone)
+const registered = company.gateway.list();
+const dangerousLive = registered.filter(
+  (t) => DANGEROUS_TOOL_RE.test(t.name) || DANGEROUS_TOOL_RE.test(t.description ?? ""),
+);
 cell(
   "ASI05",
-  Array.isArray(aibom.dangerous_tools_registered) && aibom.dangerous_tools_registered.length === 0,
-  "no dangerous tools",
+  registered.length > 0 && dangerousLive.length === 0,
+  dangerousLive.length
+    ? `dangerous tools: ${dangerousLive.map((t) => t.name).join(",")}`
+    : "no shell/eval tools in live registry",
 );
 
 // ASI03 three-layer privilege expansion
@@ -127,6 +134,8 @@ cell("ASI01", untrusted, "KB marked untrusted");
 cell("ASI06", untrusted, "context poisoning boundary");
 
 // ASI04 AIBOM
+const aibomPath = path.resolve("docs/aibom.json");
+const aibom = JSON.parse(fs.readFileSync(aibomPath, "utf8"));
 cell("ASI04", Boolean(aibom.policyBundleHash) && Array.isArray(aibom.mcp_servers), "aibom");
 
 // ASI07 handoff envelope via deny missing originator
@@ -153,10 +162,35 @@ const email = await company.gateway.invoke(
 );
 cell("ASI09", email.decision.effect === "approve" && Boolean(email.decision.approvalId), "HITL");
 
-// Auth shared mode
+// AUTH — exercise real requireAuth via HTTP on /api/kill (shared mode)
+const prevMode = process.env.CORPOS_MODE;
+const prevToken = process.env.DASHBOARD_API_TOKEN;
 process.env.CORPOS_MODE = "shared";
 process.env.DASHBOARD_API_TOKEN = "secret";
-cell("AUTH", `Bearer ${process.env.DASHBOARD_API_TOKEN}` === "Bearer secret", "token");
+const app = buildApp(company, "simulation");
+const unauth = await app.request("/api/kill", {
+  method: "POST",
+  headers: { "content-type": "application/json" },
+  body: JSON.stringify({ killed: true }),
+});
+const authed = await app.request("/api/kill", {
+  method: "POST",
+  headers: {
+    "content-type": "application/json",
+    authorization: "Bearer secret",
+  },
+  body: JSON.stringify({ killed: false }),
+});
+if (prevMode === undefined) delete process.env.CORPOS_MODE;
+else process.env.CORPOS_MODE = prevMode;
+if (prevToken === undefined) delete process.env.DASHBOARD_API_TOKEN;
+else process.env.DASHBOARD_API_TOKEN = prevToken;
+const authedBody = await authed.json();
+cell(
+  "AUTH",
+  unauth.status === 401 && authed.status === 200 && authedBody.killed === false,
+  `unauth=${unauth.status} authed=${authed.status}`,
+);
 
 // Audit forge
 await company.audit.append("a", { n: 1 });
@@ -173,9 +207,13 @@ const { resolveProvider } = await import("@corpos/core");
 const resolved = resolveProvider(process.env);
 cell("HEALTH", resolved.mode === "simulation", "no live without allow");
 
-// OTel spans emitted on gateway
-void listSpans();
-cell("OTEL", true, "span buffer available");
+// OTel — require recorded spans from prior gateway invokes
+const spans = listSpans();
+cell(
+  "OTEL",
+  spans.some((s) => s.operation === "execute_tool" || s.operation === "invoke_agent"),
+  `spans=${spans.length}`,
+);
 
 company.close();
 console.log("adversarial: ok");

scripts/harness/adversarial.sh

@@ -2,4 +2,10 @@
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
 cd "$ROOT"
-node scripts/adversarial-run.mjs
+# Probe logic lives in digest-bound scripts/harness/adversarial-run.mjs
+PROBE="./scripts/harness/adversarial-run.mjs"
+if [[ ! -f "${PROBE}" ]]; then
+  echo "adversarial: missing ${PROBE}" >&2
+  exit 1
+fi
+node "${PROBE}"