Run internal prod security assessment

Epic 5329 ask (verbatim): "Analyze current code, processes and documentation and close the gap to being SOC 2 compliant. Humans can participate but only where it cannot be avoided legally. Ask questions, but do not offload any work that you are technically able to do." Sources: PRD (Task 5330) and architecture (Task 5331) of epic 5329 — read them with `task_read` / `task_read_artifact` for full context. Target is **Type I readiness** (D2). Binding operator decisions (PRD §2, verbatim): "D1 ... Agents deliver everything to `develop` through PRs. Roman alone opens and merges develop→master promotion PRs and signs." "D3 Outreach: None. Agents contact no outside party." "D6 Auditor (OA-25) and third-party pentest (OA-21): Agents prepare, Roman engages." Credentials: `gmind/skynet/main` (prod console login, for the probe user) and `jaah/system/bootstrap-admin` (evidence filing via `OrganizationAccountAccessRole` in 366008913850); confirm with `task_credential_list` first (missing = BLOCKER ask). Evidence filing: `tools/evidence_store.py` CLI (shipped by the access-tooling child this depends on) with `EVIDENCE_BUCKET=jaah-main-evidence-366008913850`; Object Lock GOVERNANCE 3y — every filing is permanent; dry-run to `./evidence-out/` first; drafts named `<control>/<YYYY-MM-DD>/<slug>.draft.<ext>` with `Status: awaiting signature` (DA6). Any non-HIGH finding: name its risk-row text in your settle summary — the readiness close-out child registers it as R-SOC-8+. ## Requirement (verbatim from PRD) "### R14 — Assessment, pentest and auditor, prepared (CC4.1; OA-21, OA-25, G-35; D6) - **AC14.1** An agent-run internal security assessment of prod is filed to `pentest/` as interim CC4.1 evidence. It covers the external surface of `app.jaah.ai` plus an authenticated web and API check against prod's public surface. Every finding gets a severity and is fixed (HIGH/CRITICAL) or registered." This child owns AC14.1 up to the prod re-check (done by the Security Hub verification child after promotion). ## Scope and approach (from the settled architecture) Architecture A11: - **External surface of `app.jaah.ai`:** TLS, security headers, exposed paths, WAF behaviour, and the machine paths that must be denied (`infra/jaah/terraform/public-ui.tf:260+`). - **Authenticated web/API checks** as a probe user, using the probe helper the access-tooling child ships (pinned identity: fresh non-superadmin user created via the prod CP admin API as `gmind/skynet/main`, TOTP seed in memory only, disabled after; plus-address on `jaah.ai`). Tenancy isolation (second tenant = an existing prod org the probe user is not a member of; prove it cannot read that org's rows; never create an org), IDOR on task/project routes, role enforcement. - **No DoS and no brute force.** Rate-limited tooling only. - **Findings:** each gets a severity. A HIGH/CRITICAL fix lands as a develop PR inside this child (with a reproduction test). Anything else: name its risk-row text in your settle summary. - Report → `pentest/` as a `.draft.` interim CC4.1 evidence object. Each HIGH/CRITICAL reproduction is re-run on prod after promotion by the Security Hub verification child — write each as a reproducible step. Out of scope: Epic-wide fences (PRD §6, verbatim): "No agent merges or pushes to `master`. No agent approves its own promotion. No agent applies to prod any change not yet promoted. Delivery is a PR to `develop` (D1)." "No contact with any outside party: no emails, Slack messages to externals, vendor portals, NDA click-throughs or RFPs sent; no contracts; no new vendor or subprocessor, which also excludes PagerDuty/Opsgenie and Drata (D3, D7, D8)." "Legacy account 210352747749 is untouched." "Out of scope: Security Hub MEDIUM and LOW findings (D10) — registered only; evidence automation: no new crons, workflows or collectors whose purpose is recurring evidence (D7); Type II, the observation window, the audit, auditor engagement; `compliance_locks` and the vault-lock *compliance* mode." "No change to the console Compliance page, `portfolio/registry.toml` or `portfolio/engine/`" (epic 5303 owns them). "No change to dev's control plane or account beyond what an R-item strictly needs." "No secret value in any doc, register, evidence object or report." "No weakening of an existing control to make a check pass." This child: No DoS, brute force, or load testing. No probe user left enabled; no org created. No change to WAF/auth to make a check pass. Auditor/RFP/SOW documents belong to the people/endpoint/tabletop packs child. Done means: - Quality — oracle: the `pentest/<date>/internal-assessment.draft.(html|md)` object (its `s3://` URI printed) contains scope, method, each check run with its observed result, and a findings table with severity, reproduction and disposition — not a checklist of headings; a reviewer can reproduce any finding from its entry. - Probe hygiene — oracle: the probe user shows disabled on prod after the run (CP admin API read cited). - HIGH/CRITICAL — oracle: each has a merged develop PR with a regression test, PR numbers listed; else the report states "no HIGH/CRITICAL found" with the checks that would have found them. - Non-HIGH findings — oracle: each named with proposed R-SOC-8+ row text in the settle summary.

Internal prod external-surface assessment filed to s3://jaah-main-evidence-366008913850/pentest/2026-10-09/internal-assessment.draft.html (GOVERNANCE lock, verified). External surface CLEAN: TLS1.2/1.3 only, HSTS+strict CSP+X-Frame DENY, all machine/auth deny-paths 403, no unauth data, no session leak. NO HIGH/CRITICAL found (so no fix PR). Authenticated web/API half (MFA re-proof, role enforcement, tenancy isolation, IDOR) NOT run — operator chose Skip (no prod admin session obtainable by a runner; gmind/skynet/main is superadmin). Report = task report artifact. Proposed risk rows (R-SOC-8+) for the readiness close-out child: - R-SOC-8: Authenticated prod web/API assessment (MFA re-proof, role enforcement, tenancy isolation, IDOR) not yet executed; a runner cannot obtain a prod admin session (gmind/skynet/main is superadmin, no scriptable login). Treatment: operator supplies a prod admin session (saved credential), run the ready driver (tools/mfa_check.py + probe_identity.py against https://app.jaah.ai), re-verify via the Security Hub verification child. Owner: Roman. - R-SOC-9 (LOW): No RFC 9116 /.well-known/security.txt on app.jaah.ai (returns SPA shell, not a disclosure contact). Treatment: publish a security.txt or accept. Owner: Roman. - R-SOC-10 (LOW): Residual — internet-reachable GET /api/projects honours X-Agent-Token reads (public-ui.tf:17-20), so a leaked NODE_TOKEN could read the project roster from the internet. Treatment: scope the carve-out or accept as documented residual. Owner: Roman. INFO (no risk row): SPA catch-all returns 200 index.html for dotfile-shaped paths — expected, no data leak.