Autonomous remediation — threat model and operations (Arena 5)

• Parent: README.md
• Related: AUTONOMOUS_MUTATION_ZERO_TRUST.md

Assets

• Merge bot identity — the only principal allowed to promote bundles satisfying verify(bundle).
• Verification bundle — schemas/verification-bundle.schema.json.
• Reference verifier — src/verify-bundle.ts (pure function).

Threats

1. Forged bundle — attacker submits JSON with fake log_hash / exit: 0. Mitigation: CI must recompute hashes from raw logs; verifier checks structure only—CI is part of TCB unless logs are cryptographically bound.
2. Stolen merge-bot credentials — Mitigation: short-lived OIDC/Sigstore, hardware-backed signing, audit log of every promote.
3. Poisoned container — malicious ci_config_id resolves to evil CI. Mitigation: allowlisted digests, reproducible builds.
4. Gamed metrics — canary reports healthy while production burns. Mitigation: independent probes, multi-party telemetry, RollbackController.
5. Dependency confusion — Mitigation: lockfiles, SBOM, pnpm integrity.

Kill switches

• Global freeze on autonomous merge (HUMAN_OVERRIDE flag in policy store).
• Per-tenant quarantine revision cap at 0% traffic.

Audit log (minimum)

• Timestamp, patch_content_id, verify outcome, actor OIDC subject, ci_config_id, rollback events with reason enum.

Human-out-of-loop policy

Document when enabled (incident commander approval, cooling mode, maintenance window). Default off for production unless explicitly configured. Ethics: unsupervised mode is operational, not moral default.

Related

• EntropyBridge README — same sorry vs axiom discipline for trust boundaries.