epic: enterprise hardening — trustworthy v0.4 release

[m-khan-97]

Goal

Make the next OpenShield release trustworthy, secure and operable for an enterprise deployment without adding product features for their own sake.

The current rule inventory is 95 unique rules with 95 matching playbooks. Rule count is not the release KPI: verified evidence coverage, explicit uncertainty, false-positive control and safe operation are.

Product boundary for this release

Recommended default: ship and document a securely enforced single-tenant enterprise deployment first. Do not claim multi-tenant SaaS until identity, ownership, tenant-scoped persistence and cross-tenant isolation tests exist.

Do not claim certification or "full compliance." Reports should describe versioned technical evidence coverage.

Phase 0 — containment and trust blockers

These block restoring or calling the current deployment enterprise-ready:

• security: remove the public demo bearer and establish real authorization boundaries #294 — remove the public demo bearer; establish real authorization/subscription boundaries
• security(website): remove the browser PAT flow and restore safe dynamic rendering #297 — remove the browser PAT flow and restore safe website rendering
• ci: enforce required checks and two-person promotion on dev and main #298 — enforce required checks and two-person branch promotion
• bug: stop the public readiness endpoint from exhausting the database pool #296 — fix the public readiness database-pool leak
• fix(platform): make the distributed image bootable and deployment verification non-skippable #299 — make the image bootable and deployment verification non-skippable
• feat: persist PASS/FAIL/ERROR/NOT_APPLICABLE per rule per resource, fix compliance score #263 — persist explicit PASS/FAIL/ERROR/NOT_APPLICABLE evaluations
• bug: handle CRITICAL consistently across scoring, APIs, reports, and frontend #295 — make CRITICAL consistent across the full stack
• bug(scanner): replace broken AZ-NET-012 NSG flow-log logic with VNet flow-log evidence #300 — replace broken AZ-NET-012 with VNet flow-log evidence
• bug(scanner): validate AZ-SC-001 through AZ-SC-004 against real ACR SDK models #301 — repair ACR rules against real Azure SDK models
• bug(compliance): make framework reports current, evidence-based, and non-certifying #302 — make framework reports current, evidence-based and non-certifying
• feat: publish per-collector permission and evidence manifest #265 — publish the collector permission/evidence manifest

Phase 1 — durable enterprise core

• core: harden scan transactions, leases, idempotency, and durable background work #303 — transactions, leases, fencing, idempotency and durable background work
• infra: establish one reproducible enterprise deployment and operations baseline #304 — one reproducible deployment and operations baseline
• feat: real drift history + detect repeated AZ-STOR-002 regressions as one campaign #264 — tenant/subscription-safe inventory and real drift history
• feat: define approval/idempotency/audit/rescan gate for agent-driven remediation #266 — approval, idempotency, audit and rescan gate for remediation
• feat: add recoverable error states to data-driven dashboard pages #281 — recoverable dashboard error/empty/auth states
• feat: add request timeout and cancellation support to the frontend API client #282 — frontend timeout and cancellation
• docs: complete OpenSSF Best Practices Silver criteria #199 — OpenSSF Silver work, aligned with the actual release design
• Establish cursor pagination, retention/purge and immutable scan/ruleset provenance
• Add PostgreSQL-backed transaction/concurrency tests and browser contract/e2e/a11y/XSS tests
• Align MAINTAINERS, CODEOWNERS, security contacts and access-continuity evidence with the real three-lead team

Phase 2 — validate, then expand scanner coverage

Existing rule-pack work should remain reviewable, but it must consume the Phase 0 evaluation and collector contracts before merge:

• Implement remaining enterprise network and perimeter security rules #253 — network/perimeter
• Implement enterprise application identity and OAuth security rules #254 — application identity/OAuth
• Implement enterprise AKS and container workload security rules #255 — AKS/workload
• Implement enterprise governance and tenant control rules #257 — governance/tenant controls
• Implement enterprise privileged access and identity security rules #258 — privileged identity
• Implement enterprise DevSecOps, supply chain, and AI service rules #259 — DevSecOps/supply chain/AI
• Implement enterprise data protection and database security rules #261 — data protection/database
• feat(scanner): compute rule quality pass — subnet NSGs, Defender health, real patch state #268 — compute quality pass

Every repaired or new rule must include:

• explicit applicability and PASS/FAIL/UNKNOWN/NOT_APPLICABLE behavior;
• required permissions and 403/429/5xx/partial-collection tests;
• real Azure SDK model contract tests and pagination coverage;
• authoritative evidence source, version, timestamp and fingerprint;
• false-positive analysis, exceptions and suppression expiry;
• versioned framework mapping rationale;
• preview-first, target-verified remediation with rollback and validation.

Enterprise release gates

The release stays blocked until all of the following are demonstrated:

• No reusable credential is present in public frontend or website assets.
• Authentication, RBAC and authorized subscription boundaries are integration-tested.
• Failed or incomplete evidence cannot produce PASS, a clean scan, or score 100.
• CRITICAL is consistent in scanner, database, APIs, reports and frontend.
• The published image starts, reaches database-aware readiness, and completes a worker-backed real scan.
• Required GitHub checks and two-person promotion are effective, not just documented.
• Framework editions/mappings are versioned, reviewed and presented as technical evidence coverage.
• SLOs, alerts, on-call ownership, backup restore and rollback drills have recorded evidence.
• Existing 95 rules have an evidence/permission/SDK validation matrix.
• No unresolved P0; every accepted P1 has named owner, rationale and expiry.

review model

• Programme/risk/claim gate: named lead plus cross-stream reviewer.
• Platform/release gate: named lead plus independent backup.
• Scanner/evidence gate: named lead plus cross-stream reviewer.
• Auth, scoring, compliance, infrastructure and release changes require review from two leads; authors do not self-approve.

Delivery order

1. Contain credentials and unsafe public surfaces.
2. Restore enforced merge controls.
3. Repair scanner truth and severity semantics.
4. Prove the runtime/deployment path end-to-end.
5. Harden persistence, operations and evidence provenance.
6. Validate all 95 rules.
7. Resume rule expansion in small quality-gated batches.

[m-khan-97]

First enterprise-hardening implementation batch is ready for lead review. Nothing has been merged yet.

• fix(api): return readiness connections to the pool #306 fixes the public /ready connection-pool leak. Draft, DCO-signed, mergeable, and all 20 checks are green.
• fix(core): enforce severity contract v1 #308 introduces severity contract v1 and repairs CRITICAL scoring across scanner, database, APIs, Sentinel, and dashboard. Draft, DCO-signed, mergeable, and all 20 checks are green. This needs a production-sized staging migration run before merge.
• fix(platform): enforce container runtime gate #309 makes the image migration-aware and bootable, adds a local-only API/worker/frontend/PostgreSQL Compose contract, and turns container boot/readiness/non-root/Trivy into a required CI gate. Draft, DCO-signed, mergeable, and all 21 checks are green. Runtime evidence: /ready passed, runtime UID was 999, and Trivy found no blocking CRITICAL/HIGH result on the tested tag.

Integration order:

1. Review and merge fix(api): return readiness connections to the pool #306 first.
2. Run fix(core): enforce severity contract v1 #308's migration against a production-sized staging copy, complete two-lead review, then merge it.
3. Rebase fix(platform): enforce container runtime gate #309 onto the resulting dev, rerun the container gate so it exercises the combined migration chain, then review and merge it.

Do not merge #309 before #306: its recurring Compose readiness probe depends on #306 returning probe connections to the pool.

This is progress on Phase 0, not an enterprise-ready declaration. Public auth/token containment (#294), website/PAT containment (#297), effective branch enforcement (#298), evidence semantics (#263), and the remaining #299 deployment/worker gates are still release blockers.

[m-khan-97]

Enterprise-hardening status update — 28 August 2026

Completed and merged into dev:

• fix(api): return readiness connections to the pool #306 — readiness connections are returned to the database pool.
• fix(platform): enforce container runtime gate #309 — container runtime, migration, readiness, non-root, and image scanning gates.
• fix(scanner): replace broken AZ-NET-012 NSG flow-log logic with VNet flow-log evidence #316 — replaced AZ-NET-012’s nonexistent NSG flow-log call with supported VNet flow-log evidence.
• fix(deps): move chromadb out of core install (CVE-2026-45830, CVE-2026-45833) #317 — removed vulnerable ChromaDB from the core install path.
• fix(core): enforce severity contract v1 #308 — severity contract v1, CRITICAL scoring, database/API/Sentinel/dashboard alignment.
• feat: add rule AZ-CMP-007 management ports open without JIT VM access #307 — AZ-CMP-007 management-port/JIT control.

Active release-hardening queue:

• Add enterprise network and perimeter security controls #277 — substantive review findings fixed and independently verified; final rebase onto current dev requested before lead approval.
• fix(compliance): make framework reports evidence-based and non-certifying #310 — migration chain and empty-scan scoring blockers fixed; waiting for TFT444 to clear the older blocking review.
• fix(api): rate-limit /ready and /metrics, expose db pool telemetry #319 / bug: stop the public readiness endpoint from exhausting the database pool #296 — readiness/metrics rate limiting and pool telemetry. Lead review found unbounded per-source limiter state; change requested with regression requirements.
• fix(website): remove browser PAT flow, sanitize dynamic rendering, restrict CSP (#297) #318 / security(website): remove the browser PAT flow and restore safe dynamic rendering #297 — browser PAT removal and XSS/CSP hardening. Lead review confirmed the main sanitization direction but requested real production-CSP browser coverage and removal of unsafe-inline from script-src.
• feat(scanner): add enterprise data protection and database rules #278, Feat (ci-rules) : Add AZ-CI-001..004 CI/CD workflow security rules (issue #259 PR 1/3) #280, feat: add enterprise governance and tenant controls #292, and feat: implement enterprise privileged access and identity security rules (AZ-IDN-016-025) #279 — rebases requested before further review; obsolete temporary ChromaDB audit exceptions must be removed where present.
• Add enterprise AKS and workload security controls #293 — still draft and waiting on the namespace-policy correction.

Unowned release blockers still requiring lead assignment:

• security: remove the public demo bearer and establish real authorization boundaries #294 — real authorization boundaries.
• ci: enforce required checks and two-person promotion on dev and main #298 — required checks and two-person promotion enforcement.
• core: harden scan transactions, leases, idempotency, and durable background work #303 — scan transactions, leases, idempotency, and durable work.
• infra: establish one reproducible enterprise deployment and operations baseline #304 — reproducible enterprise deployment and operations baseline.

The current priority remains stabilization of existing behavior and evidence correctness. Agent-automation issues #311–#315 should not displace these release blockers.

[m-khan-97]

Enterprise-hardening lead update — 31 August 2026

Merged into dev since the previous update:

• Add enterprise network and perimeter security controls #277 — enterprise network/perimeter controls, including the final UNKNOWN-state corrections.
• fix(api): enforce token expiry, role, and subscription authorization #320 — mandatory JWT expiry, role-based write authorization, and subscription scan allowlisting.
• docs: update learn page statistics and add CI/CD workflow #230 — generated rule/playbook statistics and documentation synchronization.

Lead reviews completed today:

• fix(api): rate-limit /ready and /metrics, expose db pool telemetry #319 approved after verifying bounded global probe-limiter state, deterministic eviction, expiry sweeping, Retry-After, and green regression coverage.
• fix(website): remove browser PAT flow, sanitize dynamic rendering, restrict CSP (#297) #318 approved after independent local execution: unit tests passed and all 37 Playwright/axe/CSP/XSS tests passed against the production-header harness. Browser PAT removal, DOMPurify routing, real CSP enforcement, and removal of inline script execution were verified.
• fix(compliance): make framework reports evidence-based and non-certifying #310 remains blocked: mapping provenance and no-data semantics are strong, but failed-rule outcomes are incorrectly preserved with the immutable mapping snapshot across same-scan retries. Requested an atomic replay regression and separation/update of per-attempt outcomes.
• Feat (ci-rules) : Add AZ-CI-001..004 CI/CD workflow security rules (issue #259 PR 1/3) #280 remains blocked: AZ-CI-002 checks only top-level permission values and treats any non-null job-level permissions as safe, allowing write-all job overrides to pass. Requested effective-permission evaluation and three regression cases.

Architecture coordination:

• feat(engine): add rule evaluation coverage contract (#263) #321 is the canonical feat: persist PASS/FAIL/ERROR/NOT_APPLICABLE per rule per resource, fix compliance score #263 rule-evaluation semantic contract.
• fix(core): harden scan durability and idempotency (#303) #325 is the canonical core: harden scan transactions, leases, idempotency, and durable background work #303 durability/fencing/admission/enrichment layer and must reuse or stack on feat(engine): add rule evaluation coverage contract (#263) #321 rather than define a competing evaluation table.
• feat(automation): finding lifecycle engine, scan outcome contracts, and pattern detection [1/5] #326 automation lifecycle work is paused. It currently overlaps both contracts, has failing backend CI, and must rebase onto the accepted feat(engine): add rule evaluation coverage contract (#263) #321/fix(core): harden scan durability and idempotency (#303) #325 foundation before lifecycle/pattern work continues.

Still blocked before review:

• feat(scanner): add enterprise data protection and database rules #278, feat: implement enterprise privileged access and identity security rules (AZ-IDN-016-025) #279, Fix/az net 003 az db 002 scanner correctness #291 and feat(automation): finding lifecycle engine, scan outcome contracts, and pattern detection [1/5] #326 have failing CI.
• feat: add enterprise governance and tenant controls #292 has merge conflicts.
• Add enterprise AKS and workload security controls #293 remains draft with its namespace-policy request unresolved.

Next lead focus after developer updates: rereview #319/#318 merge readiness if dev moves, review the reconciled #321/#325 stack, then return to #310 and #280 when their focused fixes land.