feat(paw-patrol): ReleaseRun — governed merge, rollout watch, and rollback through the computer

[rita-aga]

What

Closes the deploy gap found on the 2026-08-23 DSF release: the merge ran as a governed Exec on the computer, but nothing watched the rollout and rollback was manual.

• ReleaseRun (paw-patrol): Requested → Merging → Watching → Healthy | Unhealthy → RolledBack | Failed.
• WorkCycle.ConfigureRelease records repo / PR / computer / health URL / probe budget; Complete carries a guarded entity-kind trigger (bool_true release_configured) that creates the ReleaseRun and fires Request with params_from. Declarative — no WASM dispatches it.
• release_run_lifecycle WASM: one side effect per trigger on the named Computer's sandbox, reporting only via named callbacks:
  • Request → merge PR via GitHub API (token on the computer) → MergeSucceeded(merge_sha)
  • Check → one curl of the health URL → CheckHealthy (2xx + healthy + served git_sha == merge_sha) / CheckPending / CheckUnhealthy (degraded on the new commit, or budget spent)
  • CheckUnhealthy → git revert -m 1 <merge_sha> + push main → RollbackPushed(revert_sha) (same push-triggered deploy path restores the previous build)
• Watch loop = kernel state_timeout on Watching (30s, reset_on = ["CheckPending"]). No polling loop in code.
• Cedar: Agent may create/Request/Fail; callbacks + Check are system; module gets http_call/access_secret.
• ADR-0005 in os-apps/paw-patrol/adrs/.

Pairs with arni-labs/deep-sci-fi#106 (git_sha on /health), which is the first PR this workflow releases.

Verification

• release_run_lifecycle: 21/21 unit tests (merge parsing, probe verdicts incl. budget edge, rollback command/sha, shell-safety validators).
• ReleaseRun spec: L0–L3 pass (17 model states, 100 property cases, 0 unreachable). WorkCycle spec: L0–L3 pass (358 states). Whole-app composite verify: PASS.
• Live run on openpaw-production: pending (this PR is draft until then).

Linear: ARN-394

🤖 Generated with Claude Code

https://claude.ai/code/session_01PZkYwk1gmU6GPKRuQsSLda

Greptile Summary

The PR adds a governed ReleaseRun lifecycle that merges an approved pull request, watches its deployed health and commit, and automatically reverts an unhealthy merge. The attempted health-probe SSRF hardening remains bypassable through DNS resolution.

• Adds ReleaseRun state, schema, policies, lifecycle WASM, and bounded timeout-driven health checks.
• Connects completed WorkCycles to service-authorized release creation and request dispatch.
• Adds commit-bound merge confirmation, rollout assessment, and isolated merge-commit rollback.

Confidence Score: 3/5

The PR is not yet safe to merge because the health-probe SSRF boundary remains bypassable through attacker-controlled DNS resolution.

A configured dotted hostname can pass the textual host checks, resolve to a private or link-local address, and be curled from the selected computer sandbox without any resolution-level destination enforcement.

Files Needing Attention: os-apps/paw-patrol/wasm/release_run_lifecycle/src/lib.rs

Security Review

The health URL guard blocks literal private hosts but accepts attacker-controlled dotted hostnames without constraining DNS resolution, allowing probes to resolve to private or link-local services. How this was verified: The configured hostname passes textual validation and flows unchanged into sandbox curl, with no resolution-level private-address check.

Important Files Changed

Filename	Overview
os-apps/paw-patrol/wasm/release_run_lifecycle/src/lib.rs	Implements merge, rollout probing, and rollback, but its hostname-only SSRF defense can be bypassed through DNS resolution to private addresses.
os-apps/paw-patrol/specs/release_run.ioa.toml	Defines the bounded ReleaseRun state machine, callbacks, health-check scheduling, rollback transition, and terminal failure paths.
os-apps/paw-patrol/specs/work_cycle.ioa.toml	Adds release configuration and declaratively creates and requests ReleaseRun when a configured WorkCycle completes.
os-apps/paw-patrol/policies/patrol.cedar	Restricts ReleaseRun creation and Request to the release service and gates lifecycle callbacks to service or system principals.

Sequence Diagram

sequenceDiagram
    participant W as WorkCycle
    participant R as ReleaseRun
    participant C as Computer sandbox
    participant G as GitHub
    participant H as Health endpoint
    W->>R: Complete trigger creates and Requests
    R->>C: release_merge
    C->>G: Read and merge pinned PR head
    G-->>R: MergeSucceeded(merge_sha)
    loop State timeout while Watching
        R->>C: Check
        C->>H: curl health_url
        H-->>R: health status and git_sha
    end
    alt Healthy and matching merge_sha
        R->>R: CheckHealthy
    else Budget spent or degraded
        R->>C: CheckUnhealthy
        C->>G: Revert merge commit and push main
        G-->>R: RollbackPushed(revert_sha)
    end

Loading

Prompt To Fix All With AI

### Issue 1
os-apps/paw-patrol/wasm/release_run_lifecycle/src/lib.rs:907-948
**DNS rebinding bypasses SSRF guard**

When an authorized release configuration supplies a dotted HTTPS hostname that resolves to a loopback, private, or link-local address, the textual hostname validation accepts it and `Check` passes it unchanged to sandbox `curl`, causing the credentialed computer to probe internal services.

**How this was verified:** The configured hostname flows through textual validation into sandbox `curl` without a resolution-level private-address check.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (4): Last reviewed commit: "fix(paw-patrol): SSRF host guard on the ..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[rita-aga]

@greptile review

[rita-aga]

@greptile review

[rita-aga]

Greptile review disposition (4 × P1)

Checked each against the merged code:

1. Health URL → shell injection — False positive. validate_url rejects ' ` $ ; | and whitespace via an allowlist and is called on both the merge preflight (lib.rs:145) and every check (lib.rs:510) before probe_command. There's a dedicated test with the exact exploit shape (validate_url_rejects_injection_and_non_https).

2. Any Agent can create/Request a ReleaseRun — False positive. The create/Request permit is gated when { principal.agent_type == "patrol-release-service" } (the elevated Complete-trigger principal). Only read/list are tenant-open. The unqualified permit directly above it is that read/list grant.

3. ConfigureRelease target unscoped — Valid (defense-in-depth), tracked. The permit correctly restricts the caller to Admin/system/patrol-release-service/supervisor. Binding the release target (repo/PR) to the WorkCycle's own produced artifact needs the WorkCycle to model its output and applies to the whole WorkCycle→ReleaseRun path; documented as a residual in ADR-0005 and filed as a follow-up.

4. Health probe SSRF — Valid, fixed in c7cfe6d5. Added validate_url_host: the probe host must be public — refuses loopback/127./10./192.168./172.16–31./0., the 169.254. link-local+metadata range, IPv6 loopback/ULA/link-local, and bare single-label names. Applies on both merge and check paths (+ test).

[greptile-apps]

DNS rebinding bypasses SSRF guard

When an authorized release configuration supplies a dotted HTTPS hostname that resolves to a loopback, private, or link-local address, the textual hostname validation accepts it and Check passes it unchanged to sandbox curl, causing the credentialed computer to probe internal services.

How this was verified: The configured hostname flows through textual validation into sandbox curl without a resolution-level private-address check.

Prompt To Fix With AI

This is a comment left during a code review.
Path: os-apps/paw-patrol/wasm/release_run_lifecycle/src/lib.rs
Line: 907-948

Comment:
**DNS rebinding bypasses SSRF guard**

When an authorized release configuration supplies a dotted HTTPS hostname that resolves to a loopback, private, or link-local address, the textual hostname validation accepts it and `Check` passes it unchanged to sandbox `curl`, causing the credentialed computer to probe internal services.

**How this was verified:** The configured hostname flows through textual validation into sandbox `curl` without a resolution-level private-address check.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.