Add generic information-flow control core - #7293
Conversation
🔐 Codex Security Review
|
Signed-off-by: Jordan Mecom <jm@squareup.com>
wpfleger96
left a comment
wpfleger96
left a comment
There was a problem hiding this comment.
The IFC core is compact and matches the design paper: reverse reader-set inclusion governs flow, join intersects readers, meet unions them, and unknown or cross-universe observations permanently fail closed. The production crate has no dependencies, its public API is documented, and the paper keeps the security claim correctly scoped to broker-mediated paths.
CI is green at 91ea86e94e799a4204d317717df6e8cd9fb4d1b0. Independent external-consumer verification also passed exhaustive finite-domain oracles for flow ordering, join/meet, two-input accumulation, public/restricted combinations, unknown and cross-universe poisoning, and empty restricted-label rejection.
One non-blocking diagnostic issue: FlowState::check_egress() reports a destination from another universe as EgressError::DestinationWidensReaders. The operation denies correctly, but the message says the audience widened when the actual cause is a universe mismatch. Consider adding a distinct cross-universe egress variant so the future adapter can diagnose policy/configuration errors accurately.
Signed-off-by: Jordan Mecom <jm@squareup.com>
…n (5 commits: block#7134 sidebar unread, block#7293 IFC core, block#7335 Pi launcher, block#7338 mention chips, block#7336 video speed) Conflict: crates/buzz-acp/src/lib.rs — fork session_store init and upstream pi_launcher/base_prompt block were both added at the same point in main(); resolved by keeping both (fork block first, upstream block second). Signed-off-by: Michael Feth <mfethe1@gmail.com>
* origin/main: fix(desktop): keep packaged frontendDist relative so Windows embeds assets (#7177) fix(sidebar): simplify unread indicators and emphasize priority activity (#7134) Add generic information-flow control core (#7293) feat(buzz-acp): update base prompt; add buzz context and skills to Pi agents (#7335) fix(desktop): restore mention chip identity icons (#7338) Persist video playback speed preference (#7336) Verify ACP relay events before prompt routing (#7010) fix(buzz-acp): bound busy-owner hold to prevent cross-channel starvation (#7337) feat(desktop): invite owned agents from standalone forums (#7125) fix(desktop): authorize remote mentions at publication (#7124) fix(acp): rename system tag to agent-instructions (#7332) fix(desktop): bind duplicate mention selections to exact recipients (#7133) refactor(relay): extract NIP-29 membership authorization (#7285) chore(release): release Buzz Desktop version 0.5.22 (#7308) feat(desktop): preserve mentions across copy and paste (#7228) test(desktop): await Bestie drag and profile hover endpoints (#7294) Signed-off-by: Fizz <400e8babadcee6a7f420103f10a2849d84c4a9c71d5bd04f3948c814216648a3@buzz.block.builderlab.xyz>
2 participants
Adds a dependency-free
ifc-corecrate implementing reader-set confidentiality labels and monotonic per-computation flow state.The crate deliberately contains no Buzz, Nostr, channel, membership, or grant policy; those remain in the Buzz adapter.