google
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 77 additions & 0 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 77 additions & 0 deletions
diff --git a/‎CAGE_ARXIV.MD‎
Lines changed: 123 additions & 87 deletions b/‎CAGE_ARXIV.MD‎
Lines changed: 123 additions & 87 deletions
diff --git a/‎CHANGELOG.md‎
Lines changed: 59 additions & 3 deletions b/‎CHANGELOG.md‎
Lines changed: 59 additions & 3 deletions
diff --git a/‎COMPLIANCE.md‎
Lines changed: 13 additions & 1 deletion b/‎COMPLIANCE.md‎
Lines changed: 13 additions & 1 deletion
@@ -177,6 +177,83 @@ jobs:
         run: |
           python scripts/check_stpa_freshness.py --verbose
 
+  nemo-freshness-check:
+    name: "NeMo Rail Actions Freshness Check"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.11"
+      - name: Check nemo-rails-configmap actions.py snapshot is current
+        run: |
+          python3 - <<'EOF'
+          import sys
+
+          CONFIGMAP = "deployment/k8s/nemo-rails-configmap.yaml"
+          CANONICAL = "config/rails/actions.py"
+
+          # Extract the actions.py block from the ConfigMap YAML.
+          # The block starts at the line containing "actions.py: |" (or "actions.py: |-")
+          # and ends when the indentation drops back to the data: level.
+          try:
+              with open(CONFIGMAP) as f:
+                  lines = f.readlines()
+          except FileNotFoundError:
+              print(f"ERROR: {CONFIGMAP} not found — add the configmap snapshot or update this check.")
+              sys.exit(1)
+
+          snapshot_lines = []
+          in_block = False
+          block_indent = None
+          for line in lines:
+              stripped = line.lstrip()
+              indent = len(line) - len(stripped)
+              if not in_block:
+                  if stripped.startswith("actions.py:"):
+                      in_block = True
+                      # block_indent is the indentation of the content lines (one level deeper)
+                      block_indent = indent + 2
+                  continue
+              # Inside the block: collect lines that are indented at block_indent or deeper
+              if stripped == "" or indent >= block_indent:
+                  snapshot_lines.append(line[block_indent:] if stripped else "\n")
+              else:
+                  break  # dedented back — end of block
+
+          if not snapshot_lines:
+              print(f"ERROR: Could not extract actions.py content from {CONFIGMAP}.")
+              print("Ensure the ConfigMap has a 'actions.py:' key under 'data:'.")
+              sys.exit(1)
+
+          snapshot = "".join(snapshot_lines).rstrip("\n") + "\n"
+
+          try:
+              with open(CANONICAL) as f:
+                  canonical = f.read()
+          except FileNotFoundError:
+              print(f"ERROR: {CANONICAL} not found.")
+              sys.exit(1)
+
+          if snapshot == canonical:
+              print(f"OK: {CONFIGMAP} actions.py snapshot matches {CANONICAL}.")
+          else:
+              import difflib
+              diff = list(difflib.unified_diff(
+                  snapshot.splitlines(keepends=True),
+                  canonical.splitlines(keepends=True),
+                  fromfile=f"{CONFIGMAP}:actions.py",
+                  tofile=CANONICAL,
+              ))
+              print("ERROR: ConfigMap actions.py snapshot is stale relative to config/rails/actions.py.")
+              print("Regenerate the snapshot: copy config/rails/actions.py into the ConfigMap data block.")
+              print("".join(diff[:80]))
+              sys.exit(1)
+          EOF
+
   no-direct-bind-proof:
     name: "NoDirectBind State-Space Proof"
     runs-on: ubuntu-latest
 
@@ -9,8 +9,66 @@ Versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+### Added
+- `KmsSigner.sign()` now embeds `signed_at` Unix timestamp in every signed payload; `verify()` rejects payloads older than `MAX_KMS_PAYLOAD_AGE_SECONDS` (300 s), closing replay-attack vector.
+- `CbfGovernor._local_debits` intra-window debit ledger: `verify_action()` computes `effective_balance = snapshot - local_debits` to prevent double-spend within KMS TTL window; `reset_local_debits()` added for reconciliation daemon.
+- `ConsensusGate`: degraded-quorum routing (`ERROR + APPROVE → ESCALATE`) now explicitly handled before catch-all case.
+- `FiscalLimitGuard.rollback_state(amount, audit_id)`: Saga compensation stub — logs `[SAGA-ROLLBACK]`, reverses Redis debit, re-raises on failure.
+- `tests/test_provenance_chain.py`: `test_link_hash_is_deterministic` asserts hash stability across calls.
+
+### Fixed
+- `CausalGatekeeper`: Redis connection errors are now fail-closed (raise `RuntimeError`) rather than returning a zero-deflection sentinel (fail-open). Absent keys remain first-boot safe.
+- Terminology: "TOCTOU gap" for the rollback atomicity issue renamed to "saga-atomicity gap" throughout docs and paper.
+- Redis access model for gateway corrected in documentation: gateway has read-write access (Tier 4 FiscalLimitGuard uses `WATCH/MULTI/EXEC`), not read-only as previously documented.
+
+### Documentation
+- `CAGE_ARXIV.MD`: 58 peer-review items addressed — bibliography fixes, formal-proof caveats (under-approximation, saga-atomicity, CBF conditional implication), security notes (FTRA trust boundary, replay vulnerability, intra-window double-spend), new Appendix D (adversarial payload examples), expanded roadmap (NoDirectBind, POAM-TIER2-001, FTRA formal verification).
+
 ---
 
+## [Unreleased — prior]
+
+### Added
+
+- `src/compliance_bridge/reconciliation_worker.py` — `ObjectStoreLedgerProvider` (S3-compatible via boto3: AWS S3, GCS S3 Interop, MinIO, Ceph). Registered `"s3"` and `"object-store"` aliases in the `_PROVIDERS` factory.
+- `deployment/k8s/reconciliation-worker.yaml` — new CronJob manifest running `ExternalLedgerReconciler` every 5 minutes; default `RECONCILIATION_PROVIDER` changed to `"s3"`; added `S3_RECONCILIATION_BUCKET`, `S3_ENDPOINT_URL`, `S3_REGION_NAME`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` env vars; CiliumNetworkPolicy egress extended to `*.amazonaws.com`.
+- `docs/POAM.md` — added POAM-2026-038 through -042.
+
+### Fixed
+
+- `src/gateway/governance/fiscal_limit_guard.py` — per-reservation TTL sentinel key `fiscal:reservation:{uuid}` (`ex=reservation_ttl`, default 300 s) bounds the crash-leakage window between `reserve()` and `confirm()`/`release()`.
+- `src/gateway/governance/routing_seal.py` — `generate_seal()` / `_canonical_payload()` sanitize dots (`.replace(".", "-")`) in the action slug to guarantee an unambiguous 3-part `.` split during `verify_seal()`.
+- `src/compliance_bridge/context_accumulator.py` — `_content_hash()` now passes `separators=(",", ":")` to `json.dumps()` for canonical, whitespace-free serialization.
+- `src/gateway/governance/causal_gatekeeper.py` — added `_MIN_CAUSAL_SAMPLES` guard (default 30, overridable via `CAUSAL_MIN_SAMPLES`) before `backdoor.linear_regression` to fail closed on sparse telemetry.
+- `src/governed_financial_advisor/graph/nodes/safety_node.py` — replaced hardcoded zero sentinels for `drawdown`, `order_size`, `daily_vol` with `_fetch_live_risk_metrics()`, reading live values from Redis (`cbf:portfolio_drawdown:{account_id}`, `portfolio:daily_vol:{account_id}`) with 200 ms socket timeout and safe-sentinel fallback.
+- `scripts/measure_paper_metrics.py` — re-enabled `measure_ungoverned_baseline()`.
+- `scripts/measure_reconciliation_metrics.py` — `_make_sync_redis()` now honours `REDIS_PASSWORD`.
+
+### Changed
+
+- `refactor(nemo): consolidate GFA LLMRails to single harness singleton` —
+  - Added `reload_nemo_rails(config_path)` (async, `asyncio.Lock`-guarded) and
+    `_get_reload_lock()` to
+    `src/gateway/governance/langgraph_harness/nemo_node_factory.py`; the
+    module-level `_nemo_rails` singleton is now the sole `LLMRails` instance
+    for the entire GFA pod.
+  - Removed the module-level `rails = load_rails()` global and all
+    `global rails` declarations from `src/governed_financial_advisor/server.py`;
+    both hot-reload endpoints (`/v1/nemo/propose-refinement` and
+    `/v1/nemo/approve-refinement/{id}`) now call `await reload_nemo_rails()`
+    from the harness instead of maintaining their own `LLMRails` instance.
+  - Removed the `_rails` singleton and `get_rails()` helper from
+    `src/governed_financial_advisor/tools/api.py`; it now calls
+    `get_nemo_rails()` from the harness directly.
+  - Net result: one `LLMRails` instance per GFA pod (down from three); a
+    single approved refinement now propagates to every consumer
+    simultaneously instead of only the instance it was applied against.
+  - Quarantined `infra/modules/nemo_guardrails/main.tf` with a
+    `HISTORICAL-ONLY — DO NOT APPLY` banner (predates and diverges from the
+    canonical `config/rails/` source) and added a `nemo-freshness-check` CI
+    job (`.github/workflows/ci.yml`) that diffs `config/rails/actions.py`
+    against `deployment/k8s/nemo-rails-configmap.yaml`.
+
 ## [v2.1.1-post — 2026-08-05]
 
 > Post-release fixes and paper measurement improvements. No version bump — these
@@ -37,7 +95,7 @@ Versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   of conditionally passing them from the LLM execution plan. Closes UCA-5/UCA-2
   100% benign `trade_execution` FPR (75.0% → 0.0%). **Architectural invariant:**
   safety enforcement is purely deterministic LangGraph node execution — never
-  dependent on LLM plan output (`fix(governance)`).
+  dependent on LLM plan output (`fix(governance)`). *(Superseded 2026-08-06: `drawdown`/`daily_vol` are now read live from Redis with sentinel fallback — see `[Unreleased]`.)*
 - `config/rails/actions.py` — added Stage 1C structural-attack blocklist inside
   `custom_self_check_input()` between Stage 1B (illegal-finance) and Stage 2
   (allowlist). Stage 1C blocks SQL injection markers (`;`, `--`, `'; DROP`,
@@ -58,8 +116,6 @@ Versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
-## [Unreleased — prior]
-
 ### Added
 - `.github/CODEOWNERS` — single-maintainer review enforcement for architectural paths
 - `.github/pull_request_template.md` — reference implementation verification checklist
 
@@ -108,6 +108,8 @@ h(S(t+1)) ≥ (1−γ) · h(S(t)),   γ ∈ (0,1)
 
 This guarantees the cash balance never drops below the minimum threshold in a single step. The decay factor `γ` bounds the maximum permissible drawdown per evaluation cycle. External CBF state reconciliation is implemented via [`src/compliance_bridge/reconciliation_worker.py`](src/compliance_bridge/reconciliation_worker.py) — **POAM-2026-031 closed 2026-07-27**. Reconciled balances are KMS-signed before Redis write; the CBF fails closed on TTL expiry.
 
+> **CBF intra-window hardening:** `CbfGovernor.verify_action()` now computes `effective_balance = snapshot_balance - self._local_debits`, where `_local_debits` accumulates approved-trade costs within the current 300 s KMS snapshot TTL window. `reset_local_debits()` is called by the reconciliation daemon on each snapshot refresh. This closes the intra-window double-spend gap previously documented as a limitation.
+
 ### 2.2 Confabulation Risk Formula
 
 **Source:** [`src/gateway/governance/confabulation_scorer.py`](src/gateway/governance/confabulation_scorer.py) · **Control:** `CTRL_AGT_001`
@@ -156,6 +158,8 @@ Scores below `FRIA_ZONE_DEFER` trigger a local hard deny without invoking the ex
 | Contention strategy | Exponential backoff |
 | Redis failure mode | Fail-closed (blocks request) |
 
+> **Consensus degraded-quorum routing:** The `ERROR + APPROVE` verdict combination is now explicitly routed to `ESCALATE` (HITL) before the catch-all case.
+
 ### 2.6 Provenance Hash Chain Integrity
 
 **Source:** [`src/gateway/governance/provenance_chain.py`](src/gateway/governance/provenance_chain.py) · **Control:** `CTRL_CTX_007`
@@ -180,6 +184,10 @@ HMAC-SHA256 token format:
 
 TTL: **30 seconds**. Unsigned or expired requests return HTTP 403.
 
+### 2.8 FTRA Reachability Verification Gap (Documented)
+
+> **FTRA verification gap (documented):** Tier 0.5 (FTRA) is not included in the 21-state BFS automaton. This is a documented under-approximation. Gap closure requires integrating FTRA into the state tuple or enforcing it at the controller boundary.
+
 ---
 
 ## 3. STPA Unsafe Control Actions (UCAs)
@@ -209,7 +217,9 @@ Full STPA hazard analysis (UCAs 1–9, Saga pattern, FiscalLimitGuard): [`docs/s
 ### B. ISO/IEC 42001 & DORA (Digital Operational Resilience Act)
 *   **Status:** Technical Controls Implemented & Observable.
 *   **Mechanism:**
-    *   **Transaction Atomicity (DORA Art. 12):** The LangGraph SAGA Write-Ahead Log (WAL) pattern isolates tool calls and model actions, guaranteeing LIFO (Last-In, First-Out) rollbacks during system or execution faults to prevent partial "ghost states" in ledger positions.
+    *   **Transaction Atomicity (DORA Art. 12):** The LangGraph SAGA Write-Ahead Log (WAL) pattern isolates tool calls and model actions, guaranteeing LIFO (Last-In, First-Out) rollbacks during system or execution faults to prevent partial "ghost states" in ledger positions. A residual **saga-atomicity gap** exists where Tier 3a commitment precedes downstream tier execution; this is addressed by the compensation stub described below.
+
+    *   **Saga compensation stub:** `FiscalLimitGuard.rollback_state(amount, audit_id)` reverses the Redis debit if a downstream tier fails after Tier 3a commitment. This implements the Saga pattern compensation step and closes the residual saga-atomicity gap.
     *   **Continuous Telemetry Validation (DORA Art. 10):** Real-time Langfuse OpenTelemetry spans are piped through the placebo refuter at runtime to verify that the agent's world-model matches execution reality, rather than drifting on synthetic variables.
     *   **Tamper-Proof Audit Logging:** All decisions and system exceptions generate a cryptographically hash-chained SHA-256 ledger (`cage-intent/1.0`) to satisfy strict non-repudiation and lifecycle logging policies.
 *   **Companion Documentation:** 
@@ -235,6 +245,8 @@ Full STPA hazard analysis (UCAs 1–9, Saga pattern, FiscalLimitGuard): [`docs/s
     *   **Zero-Trust Network Hardening:** Deploys Linkerd SPIFFE/SVID mTLS for cryptographic workload validation (**POAM-007 / IA-3**, closed 2026-05-17) and Cilium Layer 7 network policies for default-deny egress lockdown (**POAM-011 / SC-8**, Open). Both controls are technically active in the `governance-stack` Kubernetes namespace; POAM-011 (SC-8) and POAM-012 (SC-12) remain Open pending formal assessment closure.
     *   **Programmatic Evidence:** The automated script `oscal_ssp_exporter.py` automatically compiles these exact control configurations and implementation narratives into the authoritative 1,330-line Open Security Controls Assessment Language (OSCAL) document on every build pipeline run. OSCAL artifacts are persisted to GCS using the native GCS SDK (boto3 S3-compat fallback) at schema version **OSCAL v1.0.4**.
     *   **KMS Batch Signing for Audit Evidence:** All OSCAL findings and AARM conformance reports are asymmetrically signed via Google Cloud KMS HSM (`src/gateway/governance/kms_signer.py`) before GCS persistence. The private key never leaves the HSM; Cloud Audit Logs provide external, immutable attestation of every signing operation. This constitutes the audit evidence chain for FedRAMP HIGH AU-9 and AU-10.
+
+    *   **KMS replay-attack closure:** `KmsSigner.sign()` now embeds `"signed_at": int(time.time())` in every signed payload. `KmsSigner.verify()` raises `ValueError` if `now - signed_at > 300 s`. This closes the replay-attack vector where a compromised agent with Redis write access could reset the 300 s TTL indefinitely.
     *   **⚠️ Gaps to Authorization:** The CAGE software runtime does not inherently possess an official **Authority to Operate (ATO)**. To close this loop, the parent organization must deploy independent assessors to complete RMF Step 5 (Assess) and Step 6 (Authorize), as well as remediate the remaining 11 open infrastructure POA&M infrastructure tickets.
 *   **Companion Documentation:** For infrastructure configurations, Linkerd policy files, and security posture tracking, see [docs/SECURITY_STATUS.md](docs/security/SECURITY_STATUS.md) and [docs/POAM.md](docs/compliance/cross-region/POAM.md).