fix(security): fence model broker request replay

Author: misunders2d

RELEASE_MANIFEST.json

@@ -4,7 +4,7 @@
   "snapshot_date": "2026-07-20",
   "release": {
     "name": "agentnet",
-    "version": "0.1.16",
+    "version": "0.1.17",
     "profile": "self_hosted_local_conformance_candidate",
     "status": "BLOCKED",
     "production_ready": false,
@@ -32,12 +32,12 @@
   },
   "dependency_lock": {
     "path": "uv.lock",
-    "sha256": "03de85562ae717ec09ded113eb5cac8d05d2a3ee57b0159bb58a534dda4b30b2",
+    "sha256": "40a34a5230d048109935765a4de262f9e262fee6e290f241faadcd01b14a740b",
     "format_version": 1,
     "revision": 3,
     "pyproject": {
       "path": "pyproject.toml",
-      "sha256": "b0094024230e458536f0293d9671aa1179237d6039a2ed056167703398780f76"
+      "sha256": "8eac2b19a00c0dc86210a48ac2593f7563479dcb1597943ca46985cc929590d9"
     },
     "direct_dependencies": {
       "build": {
@@ -197,7 +197,7 @@
     },
     "REQUIREMENTS_STATUS.md": {
       "path": "REQUIREMENTS_STATUS.md",
-      "sha256": "e0eba2aef6f2de9715d29e5b6bb86513d2875274184e727a68eb81f7be54e24f"
+      "sha256": "9fbeb8c532c71fd421226c6148f897d10fdaa08ddba6ef22e67728e5a769bfa7"
     },
     "deploy/Dockerfile": {
       "path": "deploy/Dockerfile",
@@ -217,11 +217,11 @@
     },
     "docs/GATE_EVIDENCE.md": {
       "path": "docs/GATE_EVIDENCE.md",
-      "sha256": "584f0bcdcacfa3057b7d60ff7d3eb5c9980ce8d16d2118b0537343eac811dd61"
+      "sha256": "b07cd5162de2a280f7b782b45e7a0da7e603505f9ce1effc96ccd1af93d324dd"
     },
     "docs/RELEASE_MANIFEST.md": {
       "path": "docs/RELEASE_MANIFEST.md",
-      "sha256": "fa59aeb2c1aa477ef2cda6a84da754ffb9b8ec1ecf05620e57502cd3e93c7cb0"
+      "sha256": "2423c0e96c0ab460efab842f37998f555db5924159661c1f86f60390af7be36f"
     },
     "evidence/gates/G01/2026-07-13-installed-harnesses/manifest.json": {
       "path": "evidence/gates/G01/2026-07-13-installed-harnesses/manifest.json",
@@ -245,13 +245,13 @@
     },
     "scripts/verify_release.py": {
       "path": "scripts/verify_release.py",
-      "sha256": "87fda265fdcb1a83aee67d949c5fe36ed993ea62ae5b0277f73bf8dcb29d585b"
+      "sha256": "93ddc54340e9615199ee7f1b9405d9782a2043663ce8befd6f80ececaa4e5623"
     }
   },
   "release_source_tree": {
     "path": "src",
     "algorithm": "sha256(path NUL bytes NUL)",
-    "sha256": "bf51c0a858728d00508bcc2427a6662c3c5e5668d3ef45a8af7b7da339feaf56"
+    "sha256": "be2e5b6fe6989266721bd8627173ed8e76abd5f0b6049d985a1973544178fb3c"
   },
   "protocols": {
     "a2a": {
@@ -410,7 +410,7 @@
     },
     "supervisor_harness_lifecycle": {
       "status": "BUILD_OWN_INTEGRATION",
-      "pin": "agentnet-0.1.16",
+      "pin": "agentnet-0.1.17",
       "boundary": "Exact human plus harness binding and foreground isolation remain owned."
     },
     "a2a_gateway": {

REQUIREMENTS_STATUS.md

@@ -132,7 +132,7 @@ Status vocabulary:
 | SEC-002 — transport, at-rest, and optional end-to-end encryption policy | partial-external | `src/agentnet/security/envelope.py`; `src/agentnet/rooms/mls.py`; `deploy/nginx-agent.conf`; `src/agentnet/operations/policy_defaults.py` | Encrypted stores, TLS topology, sealed-room adoption failure, and policy floors: `tests/delivery/test_mailbox.py`; `tests/production/test_deployment_config.py`; `tests/rooms/test_room_authority.py`; `tests/operations/test_runtime_policy_enforcement.py` | Independent KMS/key ceremony, maintained MLS lifecycle, and real TLS deployment evidence are absent. |
 | SEC-003 — tamper-evident enrollment/access/effect/federation audit | partial-external | `src/agentnet/audit/service.py`; `src/agentnet/authorization/policy.py`; `src/agentnet/organization/relationships.py`; `src/agentnet/artifacts/service.py` | Hash chain/checkpoint, release/effect rollback, enrollment/federation audit paths, and exact completed local relationship-activation intent/tamper denial: `tests/audit/test_audit_chain.py`; `tests/organization/test_relationships.py`; `tests/artifacts/test_staged_artifact.py`; `tests/effects/test_effect_reservation.py`; `tests/federation/test_bilateral_guest.py` | Relationship activation has durable local provenance only. Independent witness, omission/fork reconciliation, restore, and production retention evidence are absent. |
 | SEC-004 — privacy/minimization for content and metadata | owner-blocked | `src/agentnet/privacy/classes.py`; `src/agentnet/operations/telemetry.py`; `src/agentnet/attention/policy.py` | Sensitive-label rejection, aggregate persistence, content-free status, stricter classification behavior: `tests/operations/test_privacy_budgets_attention.py`; `tests/operations/test_runtime_policy_enforcement.py`; `tests/supervisor/test_background_queue.py` | Signed PD-006/007/010/011 retention, indexing, residency, and disclosure policy is absent. |
-| SEC-005 — nonce/time/sequence freshness and replay windows | local-tested | `src/agentnet/security/freshness.py`; `src/agentnet/security/replay.py`; `src/agentnet/bindings/ipc.py` | Clock/target/replay, signed mailbox-ack proof replay with mutation-free rejection, persistent IPC restart, root/session fencing, and A2A duplicate behavior: `tests/security/test_signatures_and_replay.py`; `tests/integration/test_mailbox_acknowledgement_http.py`; `tests/security/test_ipc_capability.py`; `tests/a2a/test_signed_native_gateway.py` | Local freshness/replay semantics are executable. |
+| SEC-005 — nonce/time/sequence freshness and replay windows | local-tested | `src/agentnet/security/freshness.py`; `src/agentnet/security/replay.py`; `src/agentnet/bindings/ipc.py`; `src/agentnet/supervisor/model_egress.py` | Clock/target/replay, signed mailbox-ack proof replay with mutation-free rejection, persistent IPC restart, root/session fencing, model-egress per-capability request-nonce consumption/race rejection, and A2A duplicate behavior: `tests/security/test_signatures_and_replay.py`; `tests/integration/test_mailbox_acknowledgement_http.py`; `tests/security/test_ipc_capability.py`; `tests/supervisor/test_clean_workers_and_model_broker.py`; `tests/a2a/test_signed_native_gateway.py` | Local freshness/replay semantics are executable. |
 | SEC-006 — compromise containment, quarantine, rotation, safe restoration | partial-external | `src/agentnet/identity/revocation.py`; `src/agentnet/identity/recovery.py`; `src/agentnet/operations/outage.py`; `src/agentnet/operations/backup.py`; `src/agentnet/artifacts/service.py` | Revoke/recover/rotate, scanner quarantine, outage, signed exact SQLite backup/restore, forged/stale/revoked seal and filesystem-race negatives, and crash recovery: `tests/identity/test_revocation.py`; `tests/identity/test_recovery.py`; `tests/operations/test_backup_restore.py`; `tests/artifacts/test_staged_artifact.py`; `tests/operations/test_runtime_policy_enforcement.py` | Catastrophic root rebuild, independently administered backup custody/KMS, PostgreSQL locked restore runner, external kill-switch SLO, and production restore drill are absent. |
 | SEC-007 — extension signing/update/supply-chain/sandbox trust | partial-external | `src/agentnet/security/update.py`; `src/agentnet/security/distribution.py`; `src/agentnet/supervisor/workers.py`; `src/agentnet/windows_security.py`; `deploy/Dockerfile` | Threshold/expiry/rollback/freeze/equivocation, atomic signed lifecycle contracts, durable anti-rollback, cleanup recovery, pinned health execution, private Windows DACL/reparse rejection, and worker isolation: `tests/security/test_update_verifier.py`; `tests/security/test_distribution_lifecycle.py`; `tests/platform/test_host_support.py`; `tests/adapters/test_clean_worker_boundaries.py` | Real-host package/local contracts exist for Linux/macOS/Windows. Independent signing/root ceremony, SBOM/provenance publication, signed native installer/update/uninstall, rollback, and privileged hostile-host lifecycle evidence remain external. |
 | OPS-001 — separable, replaceable ordinary-agent authority/mailbox/policy/artifact/effect/gateway/audit roles | partial-external | `src/agentnet/core/app.py`; `src/agentnet/storage/postgres.py`; `src/agentnet/relay/service.py`; `src/agentnet/interfaces/contracts.py` | Main composition, one real-PostgreSQL cross-instance mailbox case, two-agent relay, and symmetric deployment tests: `tests/integration/test_product_http_api.py`; `tests/production/test_postgres_runtime.py`; `tests/relay/test_server_agent_relay.py`; `tests/production/test_deployment_config.py` | Real-PostgreSQL lifecycle, redundant failure domains, independent role credentials, failover, and replacement drills are absent. |
@@ -141,7 +141,7 @@ Status vocabulary:
 | OPS-004 — privacy-safe health/queue/latency/error/denial/security observability | partial-external | `src/agentnet/operations/telemetry.py`; `src/agentnet/audit/service.py`; `src/agentnet/product_http.py` | Fixed-label counters, bounded latency buckets, gauges, outage denials, scanner/audit/cost/adapter results, and protected content-free operator status: `tests/operations/test_privacy_budgets_attention.py`; `tests/integration/test_product_http_api.py`; `tests/production/test_postgres_runtime.py` | Production dashboard, alert delivery, retention, and load-SLO evidence remain external/owner-governed. |
 | OPS-005 — quotas, rate limits, backpressure, abuse and loop controls | partial-external | `src/agentnet/operations/quotas.py`; `src/agentnet/supervisor/model_egress.py`; `src/agentnet/operations/policy_defaults.py` | Persistent multidimensional fairness, atomic authoritative pressure reservations, circuit-breaker CAS/reclaim, loop fencing, safety reserve, relay/effect composition, and real-PostgreSQL one-winner race: `tests/operations/test_privacy_budgets_attention.py`; `tests/relay/test_server_agent_relay.py`; `tests/effects/test_effect_reservation.py`; `tests/production/test_postgres_runtime.py` | Production flood/soak/capacity tuning remains external and owner-governed. |
 | OPS-006 — portable self-hosted install/config/credentials/deployment | partial-external | `npm/bin/agentnet.mjs`; `src/agentnet/host.py`; `src/agentnet/host_security.py`; `src/agentnet/windows_security.py`; `src/agentnet/_terminal_handoff.py`; `src/agentnet/cli.py`; `src/agentnet/storage/sqlite.py`; `src/agentnet/security/distribution.py`; `deploy/compose.production.json` | Linux/macOS/Windows package install/launch, canonical state roots, owner-mode/protected-DACL state, reparse/link rejection, portable SQLite reopen/replay, signed HTTP client availability, config rebinding, backup/restore, anti-rollback, and POSIX private-TTY/no-TTY/control-byte/partial-write behavior: `tests/platform/test_host_support.py`; `tests/conformance/test_npm_package.py`; `tests/cli/test_terminal_handoff.py`; `tests/production/test_deployment_config.py`; `tests/operations/test_backup_restore.py`; `tests/security/test_distribution_lifecycle.py` | GitHub real-host evidence covers named local/package contracts only. Windows terminal mode intentionally fails closed; signed native installer/update/uninstall/rollback, privileged hostile-path trials, live Google/WebAuthn, PostgreSQL locked restore, KMS/off-host custody, and independently signed production artifacts remain external. |
-| OPS-007 — conformance/security/recovery/federation/harness tests and reuse bake-off | partial-external | `src/agentnet/components/bakeoff.py`; `src/agentnet/components/registry.py`; `scripts/verify_release.py`; `.github/workflows/cross-platform.yml`; `docs/BAKEOFF_PLAN.md` | `0.1.12` real-host platform contracts and packed launch pass on Ubuntu/macOS/Windows in run `29610467753`; current `0.1.16` unfiltered local `1142 passed/15 expected skips`; source/gen1/gen2 each `1063 passed/15 expected skips`; release verifier, package check, recursive package gate, reproducible Python builds, and exact installed deterministic harness probe pass: `tests/platform/test_host_support.py`; `tests/conformance/test_release_manifest.py`; `tests/production/test_postgres_runtime.py`; `tests/components/test_bakeoff_evidence.py`; `evidence/local/2026-07-20-v0.1.16/manifest.json` | Official A2A remains non-green; current mutation-authorized PostgreSQL, new real-host `0.1.16` cross-platform packaging, completed live cross-device ceremony, independent component bake-offs, adaptive red-team, privileged host trials, and production chaos remain external. |
+| OPS-007 — conformance/security/recovery/federation/harness tests and reuse bake-off | partial-external | `src/agentnet/components/bakeoff.py`; `src/agentnet/components/registry.py`; `scripts/verify_release.py`; `.github/workflows/cross-platform.yml`; `docs/BAKEOFF_PLAN.md` | `0.1.12` real-host platform contracts and packed launch pass on Ubuntu/macOS/Windows in run `29610467753`; current `0.1.17` unfiltered local `1147 passed/15 expected skips`; source/gen1/gen2 each `1068 passed/15 expected skips`; release verifier, package check, recursive package gate, reproducible Python builds, and exact installed deterministic harness probe pass: `tests/platform/test_host_support.py`; `tests/conformance/test_release_manifest.py`; `tests/production/test_postgres_runtime.py`; `tests/components/test_bakeoff_evidence.py`; `evidence/local/2026-07-20-v0.1.17/manifest.json` | Official A2A remains non-green; current mutation-authorized PostgreSQL, new real-host `0.1.17` cross-platform packaging, completed live cross-device ceremony, independent component bake-offs, adaptive red-team, privileged host trials, and production chaos remain external. |
 
 ## Accountable policy decisions (separate from the 85 requirements)
 

docs/ARCHITECTURE.md

@@ -458,5 +458,5 @@ component must not migrate principal IDs or rewrite signed/event history.
 | Artifacts | encrypted immutable filesystem | selected replicated self-hosted backend, scanner/WORM/restore |
 | Policy | reference single-revision evaluator | pinned Cedar or measured single-engine replacement |
 | A2A | SDK-backed local routes/mapping | pinned TCK, negative suite, cross-SDK/public peers |
-| Workers | deterministic-only unless exact sandbox evidence | per-harness clean worker and credential-free model broker |
+| Workers | deterministic-only unless exact sandbox evidence | per-harness clean worker and credential-free model broker with persistent one-use request nonces |
 | Federation/C3/mesh | schemas and disabled seams | bilateral/MLS/quorum evidence plus owner decisions |