nangsontay
diff --git a/‎.github/dependabot.yml‎
Lines changed: 32 additions & 0 deletions b/‎.github/dependabot.yml‎
Lines changed: 32 additions & 0 deletions
diff --git a/‎.github/workflows/security.yml‎
Lines changed: 120 additions & 0 deletions b/‎.github/workflows/security.yml‎
Lines changed: 120 additions & 0 deletions
diff --git a/‎.gitleaks.toml‎
Lines changed: 15 additions & 0 deletions b/‎.gitleaks.toml‎
Lines changed: 15 additions & 0 deletions
diff --git a/‎headroom/onnx_runtime.py‎
Lines changed: 41 additions & 4 deletions b/‎headroom/onnx_runtime.py‎
Lines changed: 41 additions & 4 deletions
diff --git a/‎headroom/paths.py‎
Lines changed: 31 additions & 0 deletions b/‎headroom/paths.py‎
Lines changed: 31 additions & 0 deletions
diff --git a/‎headroom/proxy/handlers/_debug_dump.py‎
Lines changed: 47 additions & 0 deletions b/‎headroom/proxy/handlers/_debug_dump.py‎
Lines changed: 47 additions & 0 deletions
@@ -40,3 +40,35 @@ updates:
         update-types:
           - "minor"
           - "patch"
+
+  # Rust dependency updates (cargo workspace: crates/*)
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "deps"
+    open-pull-requests-limit: 5
+    groups:
+      cargo-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # npm dependency updates (TS SDK, plugins, docs site)
+  - package-ecosystem: npm
+    directories:
+      - "/sdk/typescript"
+      - "/plugins/openclaw"
+      - "/plugins/opencode"
+      - "/docs"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "deps"
+    open-pull-requests-limit: 5
+    groups:
+      npm-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
@@ -0,0 +1,120 @@
+name: Security
+
+# Security gate: dependency vulnerability scanning (SCA), static analysis
+# (CodeQL/SAST), and secret scanning. Runs on every PR to main, on push to
+# main, weekly (to catch newly-disclosed CVEs without a code change), and on
+# demand. Each job is an independent required check.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Mondays 06:00 UTC — surface CVEs disclosed since the last commit.
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  # ---- SCA: dependency vulnerability scan -------------------------------
+  # Audits the PRODUCTION dependency set ([all]) exported from uv.lock. The
+  # `benchmark` extra is intentionally excluded from [all] (it pulls lm-eval's
+  # sqlitedict/nltk, which carry unpatchable upstream High CVEs and are never
+  # installed in production), so this gate fails only on actionable findings.
+  dependency-audit:
+    name: Dependency audit (pip-audit)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Export production dependency set from uv.lock
+        run: |
+          uv export --frozen --no-dev --no-emit-project --no-hashes \
+            --extra all --format requirements-txt > requirements-prod.txt
+          echo "Production dependencies audited:"
+          wc -l requirements-prod.txt
+
+      - name: Audit dependencies (pip-audit)
+        uses: pypa/gh-action-pip-audit@v1.1.0
+        with:
+          inputs: requirements-prod.txt
+
+  # ---- SAST: CodeQL static analysis ------------------------------------
+  codeql:
+    name: CodeQL (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript-typescript]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"
+
+  # ---- Secret scanning -------------------------------------------------
+  # Uses the gitleaks BINARY (MIT-licensed, no key) instead of
+  # gitleaks-action, which requires a paid GITLEAKS_LICENSE for organization
+  # repos. On PRs we scan only the PR's commits so pre-existing history can't
+  # block a PR; on push/schedule we scan the working tree. Config + allowlist
+  # live in .gitleaks.toml at the repo root (auto-loaded).
+  secret-scan:
+    name: Secret scan (gitleaks)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        run: |
+          version=8.18.4
+          curl -sSfL \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${version}/gitleaks_${version}_linux_x64.tar.gz" \
+            -o /tmp/gitleaks.tar.gz
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
+          sudo install /tmp/gitleaks /usr/local/bin/gitleaks
+          gitleaks version
+
+      - name: Scan for secrets
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          if [ -n "$BASE_SHA" ]; then
+            echo "Scanning PR commits ${BASE_SHA}..HEAD"
+            gitleaks detect --source . --log-opts="${BASE_SHA}..HEAD" --redact --no-banner
+          else
+            echo "Scanning working tree"
+            gitleaks detect --source . --no-git --redact --no-banner
+          fi
@@ -0,0 +1,15 @@
+# gitleaks configuration — extends the tuned default ruleset and allowlists
+# paths that contain hashes/identifiers (not real secrets) to avoid false
+# positives. Used by the Security workflow's secret-scan job.
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Non-secret artifacts: SBOMs, lockfiles, and vendored hashes."
+paths = [
+  '''sbom/.*''',
+  '''.*\.lock$''',
+  '''.*package-lock\.json$''',
+  '''pnpm-lock\.yaml$''',
+]
@@ -3,11 +3,42 @@
 from __future__ import annotations
 
 import ctypes
+import os
 import sys
 from typing import Any
 
-
-def hf_hub_download_local_first(repo_id: str, filename: str, *, allow_network: bool = True) -> str:
+# Pin model artifacts to immutable commit SHAs so a changed or compromised
+# upstream HuggingFace repo cannot be pulled silently (supply-chain integrity).
+# Repos not listed here fall back to the floating default ref. Set
+# HEADROOM_HF_PIN=off to bypass pinning (e.g. when intentionally evaluating a
+# newer model revision). To upgrade a model, bump its SHA here deliberately.
+_PINNED_REVISIONS: dict[str, str] = {
+    # chopratejas/kompress-v2-base @ 2026-06-10
+    "chopratejas/kompress-v2-base": "b1563631b35bfdcee37587ad530147497d820d4c",
+    "chopratejas/technique-router-onnx": "27b0b4bfa510a1cff66d888072c0b807082721a8",
+    "chopratejas/siglip-image-encoder-onnx": "d0a9fbd66d4bd8c761bff592d44831f7c2ae184e",
+    # Third-party repo — pinning matters most here.
+    "Qdrant/all-MiniLM-L6-v2-onnx": "5f1b8cd78bc4fb444dd171e59b18f3a3af89a079",
+}
+
+
+def _resolve_revision(repo_id: str, revision: str | None) -> str | None:
+    """Resolve the HF revision to download: explicit arg wins, else the pinned
+    SHA for a known repo, else ``None`` (floating ref)."""
+    if revision is not None:
+        return revision
+    if os.environ.get("HEADROOM_HF_PIN", "").strip().lower() in ("off", "0", "false", "no"):
+        return None
+    return _PINNED_REVISIONS.get(repo_id)
+
+
+def hf_hub_download_local_first(
+    repo_id: str,
+    filename: str,
+    *,
+    allow_network: bool = True,
+    revision: str | None = None,
+) -> str:
     """Download a file from HuggingFace Hub, preferring the local cache.
 
     Tries ``local_files_only=True`` first to avoid a network HEAD request when
@@ -21,6 +52,10 @@ def hf_hub_download_local_first(repo_id: str, filename: str, *, allow_network: b
             a cache miss re-raises the local-lookup error. Used by startup
             preload so a cold cache cannot block (or, via native crashes in the
             download stack, kill) the process before it binds its port.
+        revision: Explicit git revision (commit SHA / tag / branch). When
+            ``None``, a pinned SHA is applied for known repos (see
+            ``_PINNED_REVISIONS``) for supply-chain integrity; unknown repos use
+            the floating default ref.
 
     Returns:
         Absolute path to the local cached file.
@@ -33,12 +68,14 @@ def hf_hub_download_local_first(repo_id: str, filename: str, *, allow_network: b
     from huggingface_hub import hf_hub_download
     from huggingface_hub.errors import EntryNotFoundError, LocalEntryNotFoundError
 
+    revision = _resolve_revision(repo_id, revision)
+
     try:
-        return str(hf_hub_download(repo_id, filename, local_files_only=True))
+        return str(hf_hub_download(repo_id, filename, revision=revision, local_files_only=True))
     except (LocalEntryNotFoundError, EntryNotFoundError, OSError):
         if not allow_network:
             raise
-        return str(hf_hub_download(repo_id, filename))
+        return str(hf_hub_download(repo_id, filename, revision=revision))
 
 
 def create_cpu_session_options(
 
@@ -95,6 +95,35 @@ def _env(name: str) -> str:
     return os.environ.get(name, "").strip()
 
 
+# ---------------------------------------------------------------------------
+# Process-wide stateless flag
+# ---------------------------------------------------------------------------
+# Stateless mode forbids writes to the workspace. Many persisters are
+# module-level singletons reached without a config object, so the proxy records
+# the mode here once at startup and writers consult ``process_is_stateless()``.
+
+_PROCESS_STATELESS: bool = False
+
+
+def set_process_stateless(value: bool) -> None:
+    """Record process-wide stateless mode (set once at proxy startup)."""
+
+    global _PROCESS_STATELESS
+    _PROCESS_STATELESS = bool(value)
+
+
+def process_is_stateless() -> bool:
+    """True when the process must not write to the workspace.
+
+    True if ``set_process_stateless(True)`` was called OR the ``HEADROOM_STATELESS``
+    environment variable is set, so non-proxy entrypoints honor it too.
+    """
+
+    if _PROCESS_STATELESS:
+        return True
+    return _env("HEADROOM_STATELESS").lower() in ("1", "true", "yes", "on")
+
+
 def _resolve(explicit: str | os.PathLike[str] | None, env_var: str, derived: Path) -> Path:
     """Apply the standard precedence: explicit > env > derived.
 
@@ -364,6 +393,8 @@ def plugin_workspace_dir(plugin_name: str) -> Path:
     "HEADROOM_SAVINGS_EVENTS_PATH_ENV",
     "HEADROOM_TOIN_PATH_ENV",
     "HEADROOM_SUBSCRIPTION_STATE_PATH_ENV",
+    "set_process_stateless",
+    "process_is_stateless",
     "config_dir",
     "workspace_dir",
     "ensure_config_dir",
 
@@ -0,0 +1,47 @@
+"""Shared helpers for diagnostic dumps of upstream-error (>=400) requests.
+
+The dump can contain cleartext prompt / tool / system content, so it is OFF by
+default, is never written in stateless mode, and content is redacted unless the
+operator explicitly opts in to full content. Used by both the Anthropic and the
+OpenAI handlers so the gating stays consistent across providers.
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Any
+
+
+def _debug_dump_mode(config: Any) -> str:
+    """Return the diagnostic-dump mode for upstream (>=400) errors.
+
+    - "off"      : nothing written (default, and forced in stateless mode)
+    - "redacted" : structure, roles, and lengths only — content elided
+                   (``HEADROOM_DEBUG_DUMP=1``/``true``/``on``/``redacted``)
+    - "full"     : everything including content (``HEADROOM_DEBUG_DUMP=full``)
+    """
+    if getattr(config, "stateless", False):
+        return "off"
+    raw = os.environ.get("HEADROOM_DEBUG_DUMP", "").strip().lower()
+    if raw in ("full", "all", "content"):
+        return "full"
+    if raw in ("1", "true", "yes", "on", "redacted"):
+        return "redacted"
+    return "off"
+
+
+def _redact_debug_value(value: Any, _max_len: int = 80) -> Any:
+    """Recursively elide long strings (likely prompt/tool content) while keeping
+    structure, roles, type tags, ids, and other short fields for debugging.
+
+    Note: short strings (<= ``_max_len``) are preserved, so the redacted tier is
+    not a guarantee against leaking very short sensitive values — it is a
+    best-effort convenience. The default ("off") writes nothing at all.
+    """
+    if isinstance(value, str):
+        return value if len(value) <= _max_len else f"<redacted: {len(value)} chars>"
+    if isinstance(value, dict):
+        return {k: _redact_debug_value(v, _max_len) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_redact_debug_value(v, _max_len) for v in value]
+    return value