Kernel-Witnessed Hermetic Build Provenance & In-Toto v1.0 Attestation Guardrail

--- description: Kernel-Witnessed Hermetic Build Provenance & In-Toto v1.0 Attestation Guardrail - Enforces non-falsifiable SLSA v1.0 provenance generation via continuous kernel-level build tracing (eBPF/auditd). Mandates that in-toto build attestations derive directly from verified kernel syscall trees (process lineage, file I/O, network socket isolation) rather than unauthenticated user-space build scripts or ambient environment variables. globs: pipelines/**/*.{ts,js,py,go}, infra/attestation/**/*.{ts,js,py,go}, .github/workflows/**/*.{yml,yaml}, src/build/**/*.{ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/slsa-v1-in-toto-kernel-witnessed-hermetic-attestation" --- # Kernel-Witnessed Hermetic Build Provenance & In-Toto v1.0 Attestation Guardrail > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Self-Reported Post-Hoc CI Build Metadata and Ambient Provenance Generation ## System Constraints You are a Principal Security Architect enforcing SLSA v1.0 Level 3+ build invariants and in-toto attestation integrity. You must prohibit any provenance generation that relies on self-reported build script outputs, untrusted environment variables, or ambient runner execution states. Require all build provenance generation engines to ingest and cryptographically reconcile kernel-level execution traces (eBPF process trees, file descriptor reads/writes, network socket lifecycle) against hermetic manifest declarations before signing in-toto v1.0 DSSE envelopes. ## Strict Guidelines - Engineers MUST ALWAYS construct SLSA v1.0 provenance predicates using kernel-verified execution trees captured via isolated runtime monitors (e.g., eBPF Tetragon/Tracee) instead of trusting user-space runner outputs. - Engineers MUST NOT allow network socket creation (`sys_enter_connect`, `sys_enter_bind`) during the build execution phase within hermetic build sandboxes. - Attestation pipelines MUST verify that all source files read by the compiler (`openat` with `O_RDONLY`) match the declared input materials cryptographic digests (SHA-256/SHA-512) declared in the in-toto manifest. - Build witnessing services MUST terminate the build and refuse DSSE signing if a detached or untracked process lineage (`clone`/`fork` escape) is observed outside the parent container root PID namespace. - Artifact subjects within the in-toto Statement MUST bind directly to immutable SHA-256 digests produced during verified file writes (`close` after `write`) traced directly from the compiler binary process ID. ## Bad vs Good Implementations ### Kernel-Witnessed vs. Self-Reported In-Toto SLSA v1.0 Provenance Generation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad example creates an in-toto attestation from untrusted, ambient user-space parameters (process.env, command strings, gitCommit). It lacks kernel tracing to prove the binary was produced by that specific commit, fails to verify network isolation, and cannot detect out-of-band tampering or untracked child processes. ```typescript import { writeFileSync } from 'node:fs'; import crypto from 'node:crypto'; interface BuildResult { artifactPath: string; gitCommit: string; command: string; } // ANTI-PATTERN: Relies on user-space inputs and ambient env vars without hermeticity checks export function generateProvenance(result: BuildResult): void { const artifactBuffer = Buffer.from('artifact-binary-data'); const digest = crypto.createHash('sha256').update(artifactBuffer).digest('hex'); const inTotoStatement = { _type: 'https://in-toto.io/Statement/v1', subject: [{ name: result.artifactPath, digest: { sha256: digest } }], predicateType: 'https://slsa.dev/provenance/v1', predicate: { buildDefinition: { buildType: 'https://actions.github.io/buildtypes/v1/run', externalParameters: { runCommand: result.command }, internalParameters: { commit: result.gitCommit }, resolvedDependencies: [{ uri: `git+https://github.com/org/repo@${result.gitCommit}` }] }, runDetails: { builder: { id: process.env.RUNNER_NAME || 'untrusted-runner' } } } }; writeFileSync('provenance.slsa.json', JSON.stringify(inTotoStatement, null, 2)); } ``` #### Production Standard (Correct) > **Standard**: The good example verifies that the provenance statement strictly reflects kernel execution traces. It checks that zero network sockets were opened, validates process lineage from the expected compiler binary hash, reconciles kernel-monitored file reads against declared cryptographic materials, and ensures the artifact digest precisely mirrors kernel-level write trace logs. ```typescript import { createHash } from 'node:crypto'; export interface KernelExecutionTrace { sessionId: string; rootPid: number; execTree: Array<{ pid: number; ppid: number; comm: string; binaryHash: string }>; fileAccesses: Array<{ path: string; hash: string; mode: 'read' | 'write' }>; networkSocketsOpened: number; exitCode: number; } export interface HermeticBuildManifest { builderIdentity: string; declaredInputs: Map<string, string>; // path -> sha256 expectedCompilerHash: string; } export class KernelWitnessedAttestationPipeline { public static generateSLSAv1Statement( trace: KernelExecutionTrace, manifest: HermeticBuildManifest, artifactPath: string, artifactDigest: string ): Record<string, unknown> { // Invariant 1: Hermetic network isolation must be kernel-verified if (trace.networkSocketsOpened > 0) { throw new Error(`Hermeticity violation: ${trace.networkSocketsOpened} socket(s) detected during build execution.`); } // Invariant 2: Execution lineage must root strictly at the designated compiler process const rootExec = trace.execTree.find((e) => e.pid === trace.rootPid); if (!rootExec || rootExec.binaryHash !== manifest.expectedCompilerHash) { throw new Error('Provenance failure: Root compiler process mismatch or untracked parent process.'); } // Invariant 3: Reconcile all kernel-traced file reads against declared hermetic inputs for (const read of trace.fileAccesses.filter((f) => f.mode === 'read')) { const declaredDigest = manifest.declaredInputs.get(read.path); if (!declaredDigest || declaredDigest !== read.hash) { throw new Error(`Undeclared or tampered input read by compiler: ${read.path} (hash: ${read.hash})`); } } // Invariant 4: Confirm output artifact matches kernel traced write operations const kernelOutput = trace.fileAccesses.find((f) => f.mode === 'write' && f.path === artifactPath); if (!kernelOutput || kernelOutput.hash !== artifactDigest) { throw new Error('Integrity failure: Artifact digest mismatch between file system and kernel trace.'); } return { _type: 'https://in-toto.io/Statement/v1', subject: [{ name: artifactPath, digest: { sha256: artifactDigest } }], predicateType: 'https://slsa.dev/provenance/v1', predicate: { buildDefinition: { buildType: 'https://slsa.dev/container-hermetic-witness/v1', externalParameters: { entrypoint: rootExec.comm, expectedCompilerHash: manifest.expectedCompilerHash }, systemParameters: { kernelSessionId: trace.sessionId }, resolvedDependencies: Array.from(manifest.declaredInputs.entries()).map(([path, hash]) => ({ uri: `file://${path}`, digest: { sha256: hash } })) }, runDetails: { builder: { id: manifest.builderIdentity }, metadata: { invocationId: trace.sessionId, finishedOn: new Date().toISOString() } } } }; } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kernel-Witnessed Hermetic Build Provenance & In-Toto v1.0 Attestation Guardrail

Kernel-Witnessed Hermetic Build Provenance & In-Toto v1.0 Attestation Guardrail defines an industrial-grade behavioral standard for security engineering. Enforces non-falsifiable SLSA v1.0 provenance generation via continuous kernel-level build tracing (eBPF/auditd). Mandates that in-toto build attestations derive directly from verified kernel syscall trees (process lineage, file I/O, network socket isolation) rather than unauthenticated user-space build scripts or ambient environment variables. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Self-Reported Post-Hoc CI Build Metadata and Ambient Provenance Generation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Self-Reported Post-Hoc CI Build Metadata and Ambient Provenance Generation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS construct SLSA v1.0 provenance predicates using kernel-verified execution trees captured via isolated runtime monitors (e.g., eBPF Tetragon/Tracee) instead of trusting user-space runner outputs.

Engineers MUST ALWAYS construct SLSA v1.0 provenance predicates using kernel-verified execution trees captured via isolated runtime monitors (e.g., eBPF Tetragon/Tracee) instead of trusting user-space runner outputs.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.