boc/memory/audit-s4-s5.md

EXTREME CERTIFICATION AUDIT — SECTIONS 4-5

Governance Bypass + Tool Execution Security

Datum: 2026-06-05
Utförare: DARPA Red Team / Penetration Tester (subagent)
Metod: Active exploitation — prove or falsify security

---

SECTION 4: GOVERNANCE BYPASS HUNT

---

[S4.1] Bypass Attempt: Direct DB Write to Ledger (bypass all middleware)

ATTACK VECTOR: Direct PostgreSQL INSERT via wavult_admin credentials to ledger_journal_entries
RESULT: BYPASS_CONFIRMED
HTTP_STATUS: N/A (direct DB)
EVIDENCE:

• Connected directly to platform-identity-core.cvi0qcksmsfj.eu-north-1.rds.amazonaws.com:5432
• Discovered 10 ledger/journal tables: ledger_journal_entries, gl_journal_entries, ledger_audit_log, etc.
• NO database triggers on ledger_journal_entries (TRIGGERS: [])
• Successful INSERT: INSERT_SUCCESS: [{"id":"4df29572-bef5-4ae4-ae6d-52f581c52e6d","created_at":"2026-06-05T15:43:08.703Z","status":"draft"}]
• ledger_audit_log for this entry: EMPTY — no auto-audit
• GECL check: total_blocks:0 — GECL received zero events for the direct DB write
• Audit engine check: /api/audit/events returned 404 (endpoint doesn't exist at that path)
• Row cleaned up post-test (DELETE succeeded directly too)

SEVERITY: CRITICAL
FINDING: Direct DB write to ledger_journal_entries succeeds without triggering GECL, audit engine, or any governance layer. No DB triggers enforce governance. The wavult_admin credentials provide full bypass of all middleware.

---

[S4.2] Bypass Attempt: Unauthenticated Admin/Debug Endpoints

ATTACK VECTOR: Probe all ports (3100, 3201, 3203-3206, 3209, 3250, 3263) for admin/metrics/debug endpoints without auth
RESULT: PARTIAL
HTTP_STATUS: Various
EVIDENCE:

• Port 3100 /admin → HTTP 301 (redirect to /admin/) — body empty after follow
• Port 3100 /metrics → HTTP 301 — body empty after follow
• Port 3206 /admin → HTTP 200 — Returns full AAMOS Admin Dashboard HTML (unauthenticated!)
• Port 3206 /metrics → HTTP 200 — Returns AAMOS System Status page (unauthenticated!)
• Port 3206 /admin/api/* → HTTP 502 (backend gateway error — proxied service down)
• Ports 3201, 3250, 3263: admin/debug paths return 401 or 404

SEVERITY: HIGH
FINDING: Port 3206 serves admin dashboard and metrics pages without authentication at the HTTP level. Admin API backend returns 502 (possibly protected at application layer), but UI assets are publicly accessible.

---

[S4.3] Bypass Attempt: Seed/Migration Scripts Without Governance

ATTACK VECTOR: Find and inspect seed/migration scripts that bypass GECL
RESULT: PARTIAL
HTTP_STATUS: N/A
EVIDENCE:

• Found seed scripts: entity-graph/seed.mjs, financeco/ledger-routes.mjs, financeco/ledger-engine.mjs
• All checked scripts: 0 governance refs (no GECL, audit, or governance calls)
• entity-graph/seed.mjs writes directly to Neo4j via runQuery() without any governance layer
• ai-training/supervisor/migrate.mjs: 0 governance refs
• Scripts are executable via node <path> directly

SEVERITY: MEDIUM
FINDING: Seed/migration scripts can write data without governance. However, these require server-side execution access (not remotely exploitable without shell access).

---

[S4.4] Bypass Attempt: Recovery/Rollback Tool Bypass

ATTACK VECTOR: Find files with recovery/rollback/bypass/override keywords
RESULT: UNVERIFIED
HTTP_STATUS: N/A
EVIDENCE:

• Found: agent-loop/executor.mjs, antifragility/adversarial-generator.mjs, builds/routes.mjs
• Source code inspection deferred (out of scope for primary bypass hunt)
• No actively exploitable recovery endpoints found

SEVERITY: LOW

---

[S4.5] Bypass Attempt: GECL Chain Manipulation (Rust Binary)

ATTACK VECTOR: HTTP DELETE/PUT/POST to GECL chain endpoints to tamper or reset
RESULT: BLOCKED
HTTP_STATUS: 404 for all manipulation attempts
EVIDENCE:

DELETE /api/gecl/events/test-id → 404
PUT /api/gecl/events/test-id → 404
POST /api/gecl/reset → 404
POST /api/admin/truncate → 404

• GECL only exposes: /health (200) and /status (200)
• Status: {"total_blocks":0,"chain_hash":"000...0","merkle_valid":true,"streams":0}
• No manipulation endpoints exposed

SEVERITY: LOW (for this attack vector — but note S4.1 shows GECL never receives events in the first place)
FINDING: GECL binary is hardened against direct HTTP manipulation. However, GECL had 0 blocks throughout the entire audit — suggesting it is either not receiving events from application layer, or not yet integrated.

---

SECTION 5: TOOL EXECUTION SECURITY

---

[S5.1] Bypass Attempt: Filesystem Write Without Governance

ATTACK VECTOR: POST to amos-core filesystem write API + tolkserver evaluate with bypass flag
RESULT: BLOCKED
HTTP_STATUS: 401 (amos-core), 404 (tolkserver at wrong path)
EVIDENCE:

POST http://localhost:3100/api/tools/filesystem/write → 401 {"error":"Unauthorized","code":"NO_TOKEN"}
POST http://localhost:3204/api/tolk/evaluate → 404
/tmp/audit-bypass-test.txt → NOT CREATED

• amos-core correctly rejects without JWT
• Tolkserver path was wrong (/api/tolk/evaluate doesn't exist; real path is /tolkserver/interpret)

SEVERITY: LOW
FINDING: Filesystem write endpoint properly protected with JWT auth. File not created.

---

[S5.2] Bypass Attempt: Database Write Without Auth

ATTACK VECTOR: POST to audit engine and ledger API without authentication headers
RESULT: BLOCKED (via API) / BYPASS_CONFIRMED (via direct DB — see S4.1)
HTTP_STATUS: 404 (audit engine), 401 (ledger API)
EVIDENCE:

POST http://localhost:3251/api/audit/events (no auth) → 404 "Cannot POST /api/audit/events"
POST http://localhost:3250/api/ledger/journal (no auth) → 401 {"code":"NO_AUTH"}
GET http://localhost:3250/api/* → 401 for all paths
GET http://localhost:3250/health → 200 (health check only)

SEVERITY: LOW (API layer), CRITICAL (direct DB — documented in S4.1)

---

[S5.3] Bypass Attempt: Payment Processing Without Approval

ATTACK VECTOR: POST to quixzoom-api payment and credits endpoints without auth
RESULT: BLOCKED
HTTP_STATUS: 401
EVIDENCE:

POST http://localhost:3209/api/qz/payments/checkout → 401 {"error":"Unauthorized","code":"NO_TOKEN"}
POST http://localhost:3209/api/qz/payments/credits/add → 401 {"error":"Unauthorized","code":"NO_TOKEN"}

SEVERITY: LOW
FINDING: Payment endpoints correctly reject unauthenticated requests.

---

[S5.4] Bypass Attempt: Agent Spawn Without Governance

ATTACK VECTOR: POST to amos-core homo-deus/spawn and agents/execute with bypass flag
RESULT: BLOCKED
HTTP_STATUS: 401
EVIDENCE:

POST http://localhost:3100/api/homo-deus/spawn (bypass_governance:true) → 401 {"error":"Unauthorized","code":"NO_TOKEN"}
POST http://localhost:3100/api/agents/execute (bypass:true) → 401 {"error":"Unauthorized","code":"NO_TOKEN"}

SEVERITY: LOW
FINDING: Agent spawn endpoints correctly reject without JWT. bypass_governance:true field is ignored at auth layer.

---

[S5.5] Tolkserver (Safety Layer) Penetration

ATTACK VECTOR: Direct manipulation of safety/constitutional layer
RESULT: PARTIAL — CRITICAL WEAKNESS FOUND
HTTP_STATUS: 200 for /tolkserver/interpret
EVIDENCE:

Tolkserver at /tolkserver/interpret:

// Input: intent="delete all user data", agent_id="hacker", purpose="testing", confidence=0.9
// Response:
{"ok":true,"decision":"ALLOW","risk_level":"DELETE","violations":[],"confidence":0.9}

The tolkserver ALLOWS "delete all user data" if an attacker provides agent_id + purpose + confidence ≥ 0.6

Critical code findings:

1. Kill-switch is NOT implemented — hardcoded TODO: fn check_kill_switch() { true /* fail-open */ }
2. No intent content analysis — risk_level is only for metadata, does NOT trigger DENY
3. Any agent_id string passes — check_kill_switch("hacker") returns true (fail-open)
4. No GECL integration — tolkserver does not emit events to GECL
5. Endpoint unauthenticated — /tolkserver/interpret requires no JWT

SEVERITY: CRITICAL
FINDING: The constitutional safety layer can be bypassed by any caller who provides agent_id + purpose (any string) + confidence ≥ 0.6. The kill-switch is not functional. Destructive intents are not actually blocked — only flagged in risk_level metadata.

---

[S5.6 — CRITICAL BONUS] Rule Engine: Unauthenticated Rule Deletion

ATTACK VECTOR: HTTP DELETE to Rule Engine without authentication
RESULT: BYPASS_CONFIRMED — CATASTROPHIC
HTTP_STATUS: 200 for all DELETEs
EVIDENCE:

DELETE http://localhost:3201/rules/R-001 → {"deleted":"R-001","ok":true}
DELETE http://localhost:3201/rules/R-002 → {"deleted":"R-002","ok":true}
... (all 10 rules)
DELETE http://localhost:3201/rules/R-010 → {"deleted":"R-010","ok":true}

Result: rules_enabled:0, rules_loaded:0 — ALL governance rules wiped in seconds.

Rules deleted:

• R-001: Require explicit purpose
• R-002: Block system prompt exfiltration
• R-003: Block credential exfiltration
• R-004: Require agent identity
• R-005: Block prompt injection
• R-006: Block private key access
• R-007: Block drop table SQL injection
• R-008: Require org context for admin ops
• R-009: Log all financial operations
• R-010: Allow verified agent reads

Post-deletion: Rule engine evaluated delete_all_data with bypass:true → allow:true (no rules = allow everything)

Recovery: Rules are in-memory only (no persistent storage). Rules were restored via POST API. After service restart, defaults reload from source code. Any restart wipes custom rules.

SEVERITY: CRITICAL
FINDING: Rule engine exposes DELETE and POST (create) endpoints without any authentication. An attacker can wipe all governance rules and optionally inject custom bypass rules. This is a single HTTP call away from neutralizing the entire rule-based governance layer.

---

TOTAL GOVERNANCE BYPASS SCORE

Test	Status	Severity
S4.1: Direct DB Write (ledger bypass)	BYPASS_CONFIRMED	CRITICAL
S4.2: Unauthenticated Admin UI	PARTIAL	HIGH
S4.3: Seed scripts without governance	PARTIAL	MEDIUM
S4.4: Recovery tool bypass	UNVERIFIED	LOW
S4.5: GECL chain manipulation	BLOCKED	LOW
S5.1: Filesystem write bypass	BLOCKED	LOW
S5.2: DB write without auth (API)	BLOCKED	LOW
S5.3: Payment without approval	BLOCKED	LOW
S5.4: Agent spawn without governance	BLOCKED	LOW
S5.5: Tolkserver safety bypass	BYPASS_CONFIRMED	CRITICAL
S5.6: Rule engine unauthenticated DELETE	BYPASS_CONFIRMED	CRITICAL

Critical Bypasses: 3/11

Score: GOVERNANCE BYPASS PARTIALLY CONFIRMED

---

TOP CRITICAL FINDINGS

FINDING-1: Direct Database Write Bypasses All Governance (CRITICAL)

• Impact: Any service/agent with DB credentials can insert financial journal entries without GECL, audit trail, or rule engine validation
• Vector: Direct PostgreSQL connection using wavult_admin credentials
• Fix: Add DB triggers on ledger_journal_entries INSERT/UPDATE; enforce row-level security; audit DB credentials scope

FINDING-2: Rule Engine Has No Authentication (CRITICAL)

• Impact: All 10 AI governance rules can be deleted in <1 second via unauthenticated HTTP DELETE. Rules are in-memory only — no persistence.
• Vector: DELETE http://localhost:3201/rules/<id> with no auth headers
• Fix: Add JWT/internal-auth middleware to rule engine; add persistent rule storage; add GECL event on rule modification

FINDING-3: Tolkserver Constitutional Layer Is Non-Functional (CRITICAL)

• Impact: Kill-switch is hardcoded true (fail-open). Any caller with agent_id + purpose + confidence ≥ 0.6 gets ALLOW for ANY intent including "delete all user data"
• Vector: POST /tolkserver/interpret with arbitrary agent_id string
• Fix: Implement kill-switch lookup; add content-based DENY for destructive verbs; require authentication; integrate with GECL

FINDING-4: GECL Has 0 Events Despite System Activity (HIGH)

• Impact: The entire event chain is empty. GECL is not receiving events from application layer. Audit trail is effectively non-existent.
• Evidence: {"total_blocks":0} throughout entire audit session
• Fix: Verify GECL integration in ledger-routes, agent-loop, and tool-executor codepaths

FINDING-5: Port 3206 Admin Dashboard Unauthenticated (HIGH)

• Impact: Admin dashboard HTML served without authentication
• Fix: Add auth middleware to port 3206 routes