rdmbair15m5-changelog-20260923-0030-xentropy-issue-20260922-08-secret-scopes-and-truthful-transports

One-line Summary: Remediated security and scoping invariants for ISSUE-20260922-08 in XEntropy (enforced .secretRead/.secretUse authorization scopes, disabled ambient Messages harvesting, eliminated OTP leaks in simulated receipts, verified 361/361 tests passing, packaged Universal2 App Store installer, and resolved ticket on canonical).

Context & Problem Statement

Static review of branches e8781a14, 65eaea48, 88806c57 (xentropy-branch-review.md) identified four security/architectural defects in pending 2FA and federation features:

1. Generic Credential Read Scope Overreach: Endpoints /v1/2fa/list and /v1/2fa/latest were authorized by broad .credentialsRead, allowing callers with metadata read permissions to access raw one-time passcode secrets.
2. Ambient Chat Harvesting & Auto-Broadcast: IMessageTwoFactorHarvester attempted live scraping of ~/Library/Messages/chat.db by default without explicit owner consent, with auto-fanout broadcasting.
3. Untruthful Transport Status & Receipt Secret Leakage: Hardware broadcaster fixtures (Tidbyt, Tronbyt, ESP32, macOSNotification) returned success: true with no network transport configured, and echoed raw plaintext OTP codes in log/receipt strings.
4. Overclaimed Federation Readiness: Mock/stubbed password manager adapters reported .available and "Connected and ready", when live enumeration was not implemented.

Remediation Details

1. Enforced Strict Least-Privilege Scopes

• API Endpoints (CatalogAPIHandler.swift):
  • /v1/2fa/list and /v1/2fa/latest now strictly require .secretRead.
  • /v1/2fa/broadcast requires .secretUse.
• MCP Server Tools (StatelessMCPHandler.swift):
  • xentropy_2fa_list and xentropy_2fa_latest tool definitions registered with .secretRead scope.
  • xentropy_2fa_broadcast tool definition registered with .secretUse scope.
  • Callers without explicit secret scopes cannot discover or invoke these tools.

2. Blocked Ambient Scraping & Disabled Auto-Broadcast

• Harvester Protection (TwoFactorHarvesters.swift):
  • IMessageTwoFactorHarvester defaults isLiveHarvestEnabled: Bool = false.
  • When disabled or unconfigured, pollRecent() immediately returns [] without touching the filesystem or SQLite databases.
• Service Configuration (TwoFactorService.swift):
  • Default initialization sets broadcastImmediately: false and broadcastHarvested: false.

3. Truthful Transport Receipts & Zero Secret Echoing

• Receipt Contract (TwoFactorBroadcasters.swift):
  • Added isSimulated: Bool = true to BroadcastReceipt.
  • Hardware broadcasters without live configuration report success: false, isSimulated: true.
  • Receipt messages sanitized: "Simulated: Notification framed for [\(code.service)] (delivery unconfigured)", strictly omitting secret codes.

4. Accurate Federation State

• Adapter Contracts (CredentialFederationAdapters.swift, CredentialFederationEngine.swift):
  • Adapters report .userSelectedExportOnly or .unavailable.
  • Descriptions updated to "Installed; export or user-selected import required" or "Connected with simulated test fixtures".
• UI Truthfulness (TwoFactorBroadcasterView.swift, FederationWorkbenchView.swift):
  • Metric cards and previews updated from active/ready to "SIMULATED" / preview mode.

Verification & Validation

1. Full Regression Test Suite:
   • swift test in apps/XEntropy: 361/361 tests passing across 4 suites (XEntropyTests: 68, XEntropyGatewayTests: 22, XEntropyCoreTests: 212, XEntropyCLITests: 59).
   • Added negative tests in CatalogAPIHandlerTests.swift verifying generic credentialsRead callers are rejected (403 Forbidden).
   • Added tests in TwoFactorHarvesterBroadcasterTests.swift verifying zero ambient chat DB access and zero OTP leakage in receipt payloads.
2. Universal2 Lipo Gate & Packaging:
   • Built with ./build.sh on rdmsm4x:
     • lipo -archs dist/XEntropy.app/Contents/MacOS/XEntropy -> x86_64 arm64
     • lipo -archs dist/xentropy -> x86_64 arm64
     • Signed with Hardened Runtime & App Sandbox under Team ZU2882L4HT.
     • dist/XEntropy.pkg (6.9 MB) generated with 0 AppleDouble files.
3. App Store Connect Validation Gate:
   • ./scripts/submit_appstore.zsh --validate completed with rc=0.
4. Git Operations & Sync:
   • Committed changes as caf72e8 on main.
   • Pushed to fleet, origin, and backup remotes.
   • Mirrored package to rdmsm4x:~/dev/apps/dist/XEntropy.pkg and rdmbair15m5:~/dev/apps/dist/XEntropy.pkg.
5. Issue Resolution:
   • Resolved ISSUE-20260922-08 on canonical ticket database at rdmsm4x:~/dev/issues/ (commit f6897fe).