[zjncs]

Layer (b) of the authoring platform split (iflytek#934 on iflytek/skillhub), stacking on iflytek#935. This is the layer that wants the dedicated security review.

Note: this PR is stacked on the fork while iflytek#935 (layer a) is under review upstream; it will be retargeted to iflytek/skillhub main as soon as (a) lands. The diff below is exactly the (b)-only slice.

What this layer adds

Runtime bindings + validation layers

• RuntimeBinding per draft: agent type (local-script, openai-compatible), config, tool allowlist, MCP server declarations — validated at save time, persisted as JSONB, managed via GET/PUT /drafts/{id}/runtime
• CONFIG layer: validation.yaml spec parsing (defensive YAML), binding validation, MCP servers probed for real (initialize → tools/list) with tool discovery in the event stream; unknown toolFilters warn without failing
• BEHAVIOR layer: script tasks through the runtime adapters — inline (cleared environment, isolated workspace, interpreter allowlist, path confinement) or docker (locked-down container: no network, dropped capabilities, read-only root, memory/cpu/pids caps, tmpfs); prompt tasks via the OpenAI-compatible adapter with an MCP tool loop; assertion evaluation (exit code, stdout/stderr contains, timeout)

Security policies

• Shared AuthoringSecurityPolicy gates OpenAI-compatible and http/sse MCP endpoints at save time and again at connect time: cloud-metadata/link-local/multicast always rejected; loopback/RFC1918/ULA/CGNAT/RFC 2544 behind per-surface allow-private-endpoints flags (default off); unresolvable hosts rejected
• stdio MCP: off by default; in docker execution-mode its command runs inside a hardened container torn down on close; envRefs limited to the operator-configured allowlist (default empty = all rejected)
• execution-mode defaults to docker; inline fails startup outside local/dev/test (AuthoringStartupGuard)
• HTTP redirects never followed; response bodies and stdio lines capped at 2 MiB

Verification

• Security/MCP/adapter unit tests: policy classification per surface (hermetic DNS via an injected resolver), redirect refusal against the metadata range, response/line caps, envRef allowlist filtering, docker-wrapped command construction, real-container isolation checks, OpenAI tool-loop with MCP execution
• AuthoringRuntimeFlowIntegrationTest (Testcontainers PostgreSQL): three-layer validation with inline script execution, script stdout in the event stream, and save-time rejection of cloud-metadata endpoints, non-allowlisted envRefs and metadata-range LLM endpoints
• Full backend suite running on the branch (each layer green on its own)

Known limitation (documented): the policy resolves hostnames at check time; the HTTP client re-resolves at connect time, which mitigates but cannot fully eliminate DNS-rebinding races.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[zjncs]

Full-suite verification for this layer: clean mvnw clean test on the branch — 1101 tests, 0 failures, 0 errors (1 skip = the docker adapter test without a docker daemon). The earlier red run mentioned in passing was an artifact of a stale build directory (rebase leftovers), not the branch; this clean run is the authoritative result.

[zjncs]

Superseded by the split: layer b1 is under upstream review as iflytek#1003, and the security half (b2) is fork PR #7. Closing this pre-split PR to keep the queue unambiguous.