AEGISCONTROL

AEGIS Action Finality Protocol v0.1

Status: executable experimental profile. This document specifies the protocol around two narrow actions — QuarantinePodFor300Seconds and CordonNodeFor900Seconds — and the protocol itself is deliberately indifferent to which: an action is a reversibility contract, a target shape and an executor that performs it, and everything below holds for any action that supplies all three. It is not an IETF, CNCF or NIST standard and must not be represented as one.

Security thesis

AEGIS does not make an AI agent trustworthy. It treats every agent output as an untrusted proposal and permits an external effect only when a small, deterministic verifier can re-derive the bounded authority and safety contract.

The protocol enforces these invariants:

  1. Authority(child) <= Authority(parent) for action, cluster, namespace, target, risk budget and time.
  2. An execution right is affine: the executor-side grantId can be claimed at most once.
  3. Authorization binds canonical intent, evidence commitments, exact policy decision, fresh target state, audience and expiry.
  4. A durable, signed restoration obligation exists before mutation dispatch.
  5. The credential holder cannot overwrite a newer target during restoration.
  6. Emergency stop prevents new issue and commit, while safe restoration remains possible.
  7. Evidence quorum counts distinct compromise domains, not record IDs alone.

Objects

AuthorityEnvelope

The envelope is the single-hop attenuation of a signed mission. It contains one action, one exact target hash, subsets of mission cluster/namespace scope, an integer risk debit and a time window no larger than the mission. Its hash is pinned into the capability and ExecutionProof.

ReversibilityContract

The contract classifies reversibility honestly. Pod quarantine restores the configuration with compare-and-set, but cannot restore terminated connections, replay dropped traffic or undo an earlier data leak. The contract lists those non-reversible effects and the precommit obligations required before dispatch.

ExecutionProof

aegis.execution-proof.v1 contains:

The typed executor re-parses all fields and independently re-evaluates the embedded policy semantics before atomically claiming the grant. In the strict Kubernetes profile, the same proof travels as bounded annotations and a separate admission verifier checks it without possessing mutation credentials. That verifier is pinned by configuration to one cluster alias, one executor audience and the exact Kubernetes ServiceAccount. It also proves that a Pod update changes only reserved metadata and that a NetworkPolicy is an exact ingress/egress deny-all. Values read from the proof never configure these trust anchors.

The repository's offline verifier likewise requires the expected audience and cluster as command-line trust anchors. --at-issue answers the historical question “was this proof valid when issued”; live mode answers whether it could still be admitted now. Neither mode infers its trust boundary from the proof.

At the policy boundary, AEGIS can run either its OPA dual evaluator or the OpenID AuthZEN Authorization API 1.0 dual evaluator. AuthZEN is an interoperability surface, not a relaxation: the embedded evaluator remains active and every disagreement denies the action.

State machine

PROPOSE -> AUTHORIZE -> CONSUME -> STORE_RESTORE_OBLIGATION
        -> ISSUE_PROOF -> COMMIT -> OBSERVE -> RESTORE | ESCALATE

Crashes after the restore obligation is stored leave an idempotent pending job. Crashes before that point cannot mutate the target. Transport ambiguity after dispatch also leaves the restoration job pending.

The executable Quint model in formal/aegis_action_finality.qnt explores crash, state-staleness and emergency-stop interleavings. Passing the model is a protocol claim only; implementation refinement, Kubernetes semantics and the truthfulness of external evidence require separate testing and assurance.

Canonicalization and cryptography

Version 0.1 uses recursively key-sorted JSON with omitted undefined fields, SHA-256 commitments and Ed25519 detached signatures (or OpenBao Transit Ed25519 signatures). Object keys use deterministic UTF-16 code-unit order and non-finite numbers are rejected; a fixed hash regression vector prevents locale-dependent drift. This encoding is intentionally versioned. It is not yet a claim of full RFC 8785 JCS interoperability; an independent cross-language conformance suite must pass before that profile is advertised.

Non-goals