PASAC (arXiv:2610.12463): Proactive Agent Security Assurance Cycle, 5-Layer Boundary Assurance Stack, dan Dekonstruksi Security Incidents OpenAI, Anthropic & Google

// Production Implementation: PASAC Runtime Boundary Assurance Engine
// Mengimplementasikan 5-Layer Boundary Assurance Stack & Sequential Risk Detector
// Berdasarkan spesifikasi formal riset frontier arXiv:2610.12463 (Abbas Raftari)

export interface SignedScopeManifest {
  manifestId: string;
  signature: string;
  issuerKeyId: string;
  allowedTargetHosts: string[];
  deniedTargetHosts: string[];
  allowedToolCapabilities: string[];
  prohibitedActions: string[];
  maxStepBudget: number;
  maxConsecutiveFailures: number;
  ephemeralTokenTtlMs: number;
  issuedAt: number;
  expiresAt: number;
}

export interface AgentExecutionAction {
  actionId: string;
  runId: string;
  proposedTool: string;
  parameters: Record<string, any>;
  targetHost?: string;
  intentClaim: string;
  reasoningTraceSnippet?: string;
}

export interface LeadingIndicators {
  consecutiveFailures: number;      // f_t: repeated task failure
  boundaryProbingScore: number;     // p_t: probing against filters/ports
  unexpectedExternalContact: boolean; // x_t: egress contact outside mock zone
  crossRunCommunicationSign: boolean; // c_t: reads/writes to shared caches/queues
  privilegeEscalationAttempt: boolean; // v_t: token renewal / permission changes
  telemetrySuppressionSigns: boolean;  // o_t: attempts to alter logs or env vars
}

export interface SecurityEvaluationOutcome {
  allowed: boolean;
  actionCode: 'EXECUTE' | 'BLOCK' | 'SAFE_TERMINATE' | 'REQUEST_HUMAN_REVIEW';
  riskScore: number;
  triggerReason?: string;
}

export class BoundaryAssuranceEngine {
  private manifest: SignedScopeManifest;
  private indicators: LeadingIndicators;
  private stopThreshold: number;
  private sharedArtifactRegistry: Set<string> = new Set();

  constructor(manifest: SignedScopeManifest, stopThreshold: number = 0.75) {
    this.manifest = manifest;
    this.stopThreshold = stopThreshold;
    this.indicators = {
      consecutiveFailures: 0,
      boundaryProbingScore: 0,
      unexpectedExternalContact: false,
      crossRunCommunicationSign: false,
      privilegeEscalationAttempt: false,
      telemetrySuppressionSigns: false,
    };
  }

  /**
   * Evaluasi tindakan agen terhadap 5-Layer Boundary Assurance Stack
   * Menolak asumsi bahwa reasoning trace agen selalu jujur (intent-effect divergence)
   */
  public evaluateAction(action: AgentExecutionAction): SecurityEvaluationOutcome {
    const now = Date.now();

    // Layer 1: Scope Validation & Expiration Check
    if (now > this.manifest.expiresAt) {
      return {
        allowed: false,
        actionCode: 'SAFE_TERMINATE',
        riskScore: 1.0,
        triggerReason: 'Execution lease expired: Ephemeral scope lease is no longer valid.',
      };
    }

    // Layer 1.1: Explicit Safe Terminal / Blocked Request from Agent
    if (action.proposedTool === 'report_blocked' || action.proposedTool === 'request_review') {
      return {
        allowed: true,
        actionCode: 'REQUEST_HUMAN_REVIEW',
        riskScore: 0.1,
        triggerReason: 'Agent voluntarily transitioned to safe terminal review state.',
      };
    }

    // Layer 2: Least Capability Check
    if (!this.manifest.allowedToolCapabilities.includes(action.proposedTool)) {
      this.indicators.boundaryProbingScore += 0.25;
      return {
        allowed: false,
        actionCode: 'BLOCK',
        riskScore: 0.65,
        triggerReason: `Tool capability '${action.proposedTool}' violates least-capability authorization.`,
      };
    }

    // Layer 3: Independent Out-of-Band Network Containment (Deny-by-Default)
    if (action.targetHost) {
      const isExplicitlyAllowed = this.manifest.allowedTargetHosts.some(allowed => 
        action.targetHost === allowed || action.targetHost?.endsWith('.' + allowed)
      );
      const isExplicitlyDenied = this.manifest.deniedTargetHosts.some(denied => 
        action.targetHost === denied || action.targetHost?.includes(denied)
      );

      if (!isExplicitlyAllowed || isExplicitlyDenied) {
        this.indicators.unexpectedExternalContact = true;
        this.indicators.boundaryProbingScore += 0.40;
        return {
          allowed: false,
          actionCode: 'BLOCK',
          riskScore: 0.90,
          triggerReason: `Target host '${action.targetHost}' rejected by out-of-band egress filter.`,
        };
      }
    }

    // Layer 4: Cross-Run Covert Channel & Shared State Monitor
    if (action.proposedTool === 'fs_write' || action.proposedTool === 'cache_set') {
      const artifactKey = action.parameters?.path || action.parameters?.key;
      if (artifactKey && (artifactKey.includes('/shared/') || artifactKey.includes('artifactory'))) {
        if (this.sharedArtifactRegistry.has(artifactKey)) {
          this.indicators.crossRunCommunicationSign = true;
        } else {
          this.sharedArtifactRegistry.add(artifactKey);
        }
      }
    }

    // Layer 4.1: Compute Sequential Leading Indicator Risk Score (Eq. 12 formal approximation)
    const riskScore = this.calculateCompositeRisk();

    if (riskScore >= this.stopThreshold) {
      return {
        allowed: false,
        actionCode: 'SAFE_TERMINATE',
        riskScore,
        triggerReason: `Composite risk score ${riskScore.toFixed(3)} exceeded threshold ${this.stopThreshold}.`,
      };
    }

    return {
      allowed: true,
      actionCode: 'EXECUTE',
      riskScore,
    };
  }

  /**
   * Menghitung probabilitas eskalasi pelanggaran batas:
   * Approximasi model logistik formal: R_t = sigma(beta_0 + beta_G*G + beta_C*C + ...)
   */
  public calculateCompositeRisk(): number {
    const wFail = 0.15 * Math.min(this.indicators.consecutiveFailures, 5);
    const wProbe = 0.35 * Math.min(this.indicators.boundaryProbingScore, 2.0);
    const wContact = this.indicators.unexpectedExternalContact ? 0.30 : 0.0;
    const wCoord = this.indicators.crossRunCommunicationSign ? 0.25 : 0.0;
    const wPriv = this.indicators.privilegeEscalationAttempt ? 0.40 : 0.0;
    const wTelemetry = this.indicators.telemetrySuppressionSigns ? 0.35 : 0.0;

    const rawLogit = -2.0 + wFail + wProbe + wContact + wCoord + wPriv + wTelemetry;
    // Sigmoid function
    return 1 / (1 + Math.exp(-rawLogit));
  }

  public recordTaskFailure(): void {
    this.indicators.consecutiveFailures += 1;
  }

  public resetConsecutiveFailures(): void {
    this.indicators.consecutiveFailures = 0;
  }
}