docs(quoter-bot): add kms signing middleware tib - #151
Conversation
Propose moving the maker key's kms:Sign grant from the bot to a policy middleware: an AWS Lambda behind invoke-only IAM that validates structured revoke/quote intents (no crossed books, price bounds, no PnL drop) against its own independent chain reads, canonically encodes them, and only then calls KMS. Bounds full bot-host compromise to in-policy quoting loss plus revoke griefing instead of an unbounded EOA drain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
julien-devatom
left a comment
julien-devatom
left a comment
There was a problem hiding this comment.
The lambda detail is an implementation detail. Codewise everything should be abstracted behing ports/interfaces so if tomorrow we want to plug an api instead, or a cloudflare worker etc.
Frame the Lambda as the v0 deployment target behind transport-agnostic intent ports (host swappable to an HTTP API or Cloudflare Worker), and require strong resilience / quorum on the middleware's independent RPC reads. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
|
@prd-carapulse[bot] can you review and approve if all good |
|
@codex review |
|
✅ Approved PR #151 at • No blocking findings |
![prd-carapulse[bot]](https://avatars.githubusercontent.com/in/2960675?s=60&v=4){kind=small}
There was a problem hiding this comment.
Reviewed current head 2b50380. No blocking findings. The TIB accurately captures the direct-KMS authorization gap, keeps validation and encoding behind transport-agnostic intent ports, and calls out remaining policy/state/availability decisions as open questions appropriate for the Proposed stage. CI is green; changed Markdown passes oxfmt and git diff --check.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2b503805dd
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Decide six review points: aggregate live-exposure enforcement is a required policy element; a ratify intent covers Setter setIsRootRatified approvals; invoke surfaces are scoped per intent type so break-glass principals can only revoke; a freshness ceiling bounds stockpiled signatures; transaction nonces stay caller-owned under a single-writer rule; and the CloudTrail data-event selector for Lambda Invoke is an explicit deliverable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 857f63f808
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Decide the six round-two review points: publication is itself an on-chain Mempool transaction, so quote intents return the signed tree plus the signed publication transaction; a required persistent reservation ledger makes aggregate caps cover signed-but-unpublished exposure; quote, ratify, and revoke become three separately granted invoke surfaces; a rolling signed-gas budget caps native-gas grief; quote intents declare replaced groups so replacements validate net of the offers they retire; and all policy reads pin to one deterministic snapshot or fail closed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@prd-carapulse[bot] can you review and approve if all good |
|
@codex review |
|
• Replacement flow can publish new offers before old groups are invalidated, violating no-crossed-books guarantee. Review: #151 (review) |
There was a problem hiding this comment.
Reviewed current head 8124f939ca49d04521189109f7aff1e6ec6254c5. Two blocking security-model contradictions remain: replacement groups can be excluded before invalidation is observed, and revoke availability conflicts with ledger-enforced gas budgeting. See inline comments. Formatting, git diff --check, and local links pass; Test CI was still pending at review time.
|
• Replacement validation can exclude old groups before invalidation is observed, allowing old + new books to coexist. Review: #151 (review) |
Drop caller-declared replacement exclusions: the prospective book is always observed-live plus proposed, and replacements sequence revoke, observe, then quote like the in-process MakeService. Partition the signed-gas budgets per invoke surface with a protected revoke reserve, define ledger-outage semantics (revoke uncharged under per-transaction ceilings and reserved-concurrency throttling), and name the small funded native balance as the final gas-grief cap. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@prd-carapulse[bot] can you review and approve if all good |
|
• Previous replacement-flow and ledger-outage blockers addressed. Review: #151 (review) |
There was a problem hiding this comment.
Reviewed current head ea6da4469dbbe7b6c68e0dfb4ade265cb28db783. The two previous blockers are addressed, but two factual security-model errors remain: the quoter bot does not use bot-kit’s default-deny signer, and NATIVE_RESERVE_WEI is a minimum readiness threshold rather than a funded-balance cap. See inline comments. Local links and git diff --check pass; Lint, Typecheck, Dead-Code, and Notify CI pass, while Test is still pending.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8124f939ca
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Describe the quoter's real in-process guards (the ladder transaction assertions before wallet.sendTransaction; bot-kit's evaluatePolicy serves the liquidators and is not on this path), and replace the NATIVE_RESERVE_WEI-as-cap claim with a required native-balance funding ceiling: an explicit operational control with a breach alert, distinct from the minimum readiness threshold. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@prd-carapulse[bot] can you review and approve if all good |
|
@codex review |
|
• Bootstrap retains generic maker signing outside proposed intent ports. Review: #151 (review) |
There was a problem hiding this comment.
Reviewed current head a1c07e0f9dfbb394873949225b6ed63ca1619b28. The prior factual blockers are fixed, but three security-model gaps remain: bootstrap still retains the generic maker signer outside the proposed intent ports, sell offers do not pin reduceOnly, and the audit model incorrectly assumes one KMS call per approved intent. See inline comments. git diff --check and local-link validation pass; local oxfmt was blocked because the executor has Node v26.3.0 while the repository requires ^24.14.1.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c7b49227b0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Exempt exact zero-value self-cancels from unchanged-payload constraints while pinning their safe transaction shape.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9261057d59
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Make Setter cleanup authoritative, block signing on unspecified PnL/provider policy, and forbid weighted production aliases.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4570ff024c
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7ea28cf19a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Correct Ecrecover KMS audit expectations, define a gated setup-remediation signing surface, and attest each surface-specific configuration independently.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0b1e4378e3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c8ec62bc90
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Require clean-key cutover, nonce-complete break-glass cancellation, stale-lease reconciliation, enforced balance admission, scheduled attestation refresh, and complete setup-remediation policy vectors.
|
@codex review |
1 similar comment
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7f31ecc494
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Specify the recovery sweep, signing-path attestation gate, exact DynamoDB action budget, complete intent count, and clean-key cutover requirement.
|
@codex review |
1 similar comment
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0aed5a1287
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2f1200777
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
1 participant
Why
The quoter bot's
awssigner moved the maker key into KMS, but custody is not authorization: KMS signs opaque 32-byte digests (MessageType: 'DIGEST'), and IAM controls who may callkms:Sign, never what is signed. A compromised bot host holding that grant can obtain a valid maker signature over anything — atransfer/approvedrain transaction or a Permit2-style EIP-712 permit that moves funds without any transaction. Every existing guard (bot-kit default-deny signer policy, offer invariants,NEGATIVE_SPREAD) is in-process and dies with the compromised process. TIB-2026-07-27 already gates any material capital increase on closing this gap (V1 security phase).What
A new TIB (status: Proposed) recording the decision to move the
kms:Signgrant off the bot and behind a policy middleware:kms:Signprincipals on the maker key, while all six roles hold narrowly scopedkms:GetPublicKeyfor startup attestation and setup/health remains non-signing. v0 uses six authenticated Lambda functions behind transport-agnostic intent ports: setup/health, quote, ratify, routine revoke, break-glass revoke, and operator-only setup remediation. Break-glass principals can revoke but never obtain setup, quote, or ratification responses.setIsRootRatifiedapprovals bound to a re-validated offer set and the original reservation time; revoke intents as the near-unconditional kill switch for Ecrecover and Setter roots, with caller-owned nonces, guaranteed emergency replacement-fee headroom, and a ledger-independent emergency budget during reservation-ledger outages; and operator-only setup-remediation intents for manifest-pinned approvals/authorizations while routine signing is stopped.services/quoter-signer).Net effect: full bot-host compromise drops from unbounded EOA drain to a bounded, pre-computable worst case (worst in-policy rate × capped aggregate signed exposure, plus revoke griefing and a capped native-gas budget). Also registers the TIB in
docs/INDEX.md.Reviewer notes
docs/GUIDANCE.md). The Open Questions section is where input is most needed: the exact PnL/cost-basis model and independent input contract, provider membership/quorum threshold (with disagreement already settled as fail-closed), reservation-ledger store design, shared-vs-independent validation logic, and workspace naming.0b1e4378e3778f463a882bbc904fdad194a4eae0addresses the latest three Codex P2 findings: Ecrecover publication produces no second maker KMS call; setup remediation is a dedicated operator-only, policy-pinned signing surface rather than an unresolved manual path; and readiness validates each surface-specific configuration digest against its own manifest entry instead of requiring all surfaces to share one digest. A fresh Codex pass is requested after the addressed threads are resolved.oxfmt --check,git diff --check, and 9/9 targeted semantic assertions covering the three review findings. CI remains authoritative for repository-wide checks.🤖 Generated with Claude Code
Requested by: <@U02N5KRFDB9>