6.0 KiB
6.0 KiB
Here are four fast, defensible moat experiments you can add to Stella Ops and validate in 1–2 sprints—each with a crisp pass/fail and public references.
1) Function‑level semantic fingerprints (“semhash”)
Why: resilient artifact identity across rebuilds/optimizations; raises code‑reuse evasion cost. Signals to measure:
- ≥80% within‑version function match across gcc/clang and -O0/-O2/-Os;
- <1% cross‑project false positives vs ~10k‑function corpus;
- Robust to symbol‑stripping & minor reordering. 2‑sprint plan:
- A: Extract per‑function IL via DWARF, normalize, embed/hash; prototype store & query. (Dwarfstd)
- B: CI job builds 3 variants, computes semhash diffs; publish report. Single‑card experiment: CI asserts ≥80% functions cluster to same semhash; attach diffoscope snapshot for mismatches. (Diffoscope) Grounding: KEENHash (function‑aware hashing); DWARF v5 spec; diffoscope latest (v312, 2026‑02‑06). (arXiv)
2) Deterministic short‑run behavior attestations (sandbox traces)
Why: converts “it executed” into a cryptographically verifiable exploitability signal; complements VEX. Signals:
-
99% identical syscall/observable trace on repeated runs in hermetic harness;
- Variance across different inputs;
- Capture <10s, replay <10s. 2‑sprint plan:
- A: Record a containerized micro‑handler under Firecracker (or gVisor) using
rr; wrap trace as DSSE; sign with cosign. (Amazon Web Services, Inc.) - B: Verifier replays trace (rr) and checks DSSE + Rekor pointer. (RR Project) Single‑card experiment: Build+run a <1s handler, emit signed trace, store Rekor pointer, run verifier → PASS only if replay+verify succeed. (GitHub)
3) Dual‑log “twin‑proof” stitching (multi‑log anchoring + witness)
Why: attacker must tamper with two independent logs; stronger story for procurement/legal. Signals:
- Same DSSE digest appears in Rekor v2 and a second append‑only log (e.g., signed Git tag);
- Consistency/witness checks detect divergence;
- Measurable increased attack cost vs single‑log. 2‑sprint plan:
- A: Write attestation to Rekor v2 and to signed‑tag Git “proofs” repo; record both pointers in DSSE. (Sigstore Blog)
- B: Verifier fetches Rekor inclusion proof + Git tag sig; PASS only if both validate. (Sigstore Blog) Single‑card experiment: Produce one DSSE, anchor to both logs, run verifier → PASS iff both proofs verify. (Sigstore Blog)
4) Attestable runtime canary beacons
Why: low‑volume evidence that a specific artifact actually ran in a real env—without shipping raw telemetry. Signals:
- Signed beacon ⟨artifact_id, nonce, timestamp⟩ verified against cosign key + Rekor pointer;
-
90% beacon verification rate in staged infra;
- Origin/IP/arrival cadence provide internal execution evidence. 2‑sprint plan:
- A: Embed a one‑shot beacon emitter (Go) at entrypoint; post DSSE to a small collector over mTLS; sign + anchor. (GitHub)
- B: Collector verifies sig + Rekor, stores events; expose query API; (optionally align with OTel signals). (Canarytokens) Single‑card experiment: Run the binary once in staging → collector shows verified DSSE + Rekor pointer. (GitHub)
Where this slots into Stella Ops
- Evidence Locker: store semhashes, traces, dual‑anchors, and beacons as first‑class DSSE records.
- Attestor: add “sandbox‑trace.verify()” and “twin‑proof.verify()” checks to your policy engine.
- AdvisoryAI: surface investor‑friendly KPIs: semhash stability %, trace‑replay PASS rate, dual‑anchor PASS rate, beacon verification %.
- Release Orchestrator: make these jobs optional gates per environment.
Acceptance criteria (quick)
- Semhash: ≥80% stable across two compiler flags; <1% FP vs 10k corpus. (arXiv)
- Sandbox traces: rr replay PASS + DSSE verify + Rekor pointer in CI. (RR Project)
- Twin‑proof: verifier fails if either Rekor or Git proof missing. (Sigstore Blog)
- Beacons: ≥90% verified beacons from staged runs. (Canarytokens)
Primary links (for your sprint tickets)
- KEENHash (ISSTA 2025): arXiv/DOI & PDF. (arXiv)
- DWARF v5 standard. (Dwarfstd)
- diffoscope v312 (2026‑02‑06). (Diffoscope)
- Firecracker intro/background. (Amazon Web Services, Inc.)
- rr project docs. (RR Project)
- cosign (DSSE/in‑toto attestations) & Rekor v2 (alpha→GA). (GitHub)
- Canarytokens guide/admin (for beaconing patterns). (Canarytokens)
If you want, I can draft the four CI job cards (Makefile targets + sample DSSE predicates + policy checks) sized for a two‑sprint push.