fix(sentinel): real keyed signatures, verify traces before scoring, escape dashboard XSS

[imran-siddique]

Security hardening for the sentinel integration. Three fail-closed fixes, each configurable via environment variables. No behavior change when the relevant env vars are set; default posture is to reject/refuse rather than fabricate trust.

1. Real keyed incident signatures (fail closed)

Incident reports were "signed" with base64(sha256(payload) + b"signed") — keyless, so any party could recompute it, and /verify recomputed the same public value. Replaced with HMAC-SHA256 over the canonical report JSON using a secret from SENTINEL_SIGNING_KEY.

• If no key is configured, signing fails closed: the report is returned with "signature_status": "unsigned" and no signature, rather than a value that merely looks signed.
• /verify now verifies the keyed HMAC with hmac.compare_digest, and returns UNVERIFIABLE when no key is set.

2. Verify TRACE claims before scoring/enforcing (fail closed)

ingest_trace, the /evaluate endpoint, and the CLI fleet path fed unverified input straight into scoring and enforcement. Added a verification gate that checks the Ed25519 signature against a trusted key from TRACE_TRUSTED_JWK (an OKP/Ed25519 public JWK as JSON), using agentrust_trace.verify_record when the package is importable, otherwise a minimal Ed25519 check.

• Verification is against the configured trusted key, never the key embedded in the record.
• Unsigned traces, bad signatures, and a missing trusted key are rejected (403 on the endpoint). The only bypass is SENTINEL_ALLOW_UNVERIFIED=1, which logs a loud warning on every use. Default is reject.

3. Escape dashboard DOM-XSS

dashboard.html interpolated posted-trace fields (agent_id, claim.reason, event.description, detection_type, claim_id) into innerHTML and inline onclick handlers unescaped. All trace-derived strings are now HTML-escaped via an esc() helper, untrusted values are carried on data-* attributes, and actions are wired with addEventListener instead of inline onclick.

Tests

Adds sentinel/tests/test_security.py (18 tests, all passing locally on Python 3.12):

• Keyed signing: round-trip verifies; tampering, wrong key, and no-key-set all fail closed; guard against regressing to the old keyless value.
• Trace gate: unsigned/wrong-key traces rejected and a properly signed trace accepted, at the module, ingest_trace, and /evaluate endpoint level; SENTINEL_ALLOW_UNVERIFIED=1 opt-out logs a warning.
• Incident endpoints: export marks unsigned without a key; /verify round-trips VERIFIED, detects TAMPERED, and returns UNVERIFIABLE without a key.
• Dashboard: source-level assertions that the render path escapes untrusted fields and uses no inline on* handlers for untrusted values.

Both the agentrust_trace-installed path and the minimal-fallback path were exercised and pass. cryptography added to requirements.txt. README and integration.yaml updated to document the env vars and the fail-closed behavior.

🤖 Generated with Claude Code