The koanf config spec promised a self-protection rule that never shipped: a bundled-policy rule in internal/embed/policies/failsafe.rego blocking agent writes to ~/.config/failsafe/config.yaml, plus a corpus case covering it.
Without it, an agent can edit the guard's own config (e.g. point log.path somewhere useless or prepare control_plane.* keys) with no policy pushback. The dangerous knobs were already removed (mode.default, log.redact fixed true), so severity is contained — but the config file is still the guard's own attack surface and should be inside the protection boundary.
Scope:
Pairs with the fs-guard roadmap note from 8022a86 (config: telemetry stub, configuration docs, self-protection note).
The koanf config spec promised a self-protection rule that never shipped: a bundled-policy rule in
internal/embed/policies/failsafe.regoblocking agent writes to~/.config/failsafe/config.yaml, plus a corpus case covering it.Without it, an agent can edit the guard's own config (e.g. point
log.pathsomewhere useless or preparecontrol_plane.*keys) with no policy pushback. The dangerous knobs were already removed (mode.default,log.redactfixed true), so severity is contained — but the config file is still the guard's own attack surface and should be inside the protection boundary.Scope:
failsafe.regorule blocking writes/redirection targeting~/.config/failsafe/config.yaml(echo/tee/cp/mv/sed -i …)internal/corpusexercising the blockdocs/reference/configuration.mdPairs with the fs-guard roadmap note from 8022a86 (config: telemetry stub, configuration docs, self-protection note).