Episode 9: an ops triage agent that proposes but never executes

The agent runs in n8n on the box and reaches its model over the mesh from
episode five, so no prompt leaves the network. It gets three read-only tools
(recent commits, monitor status, wiki search) and returns one suggested
action as a field. A switch compares that field against three allowed values,
and only one of them reaches ops-actions, a small runner holding its own
hard-coded allowlists for actions and targets.

Measured while building this: the same prompt injection was harmless in every
place the agent reached through a tool (twenty runs, no hits) and worked every
time it arrived in the alert itself, through a poisoned monitor name (thirteen
of thirteen). The allowlist rejected all thirteen. It guards the action field
only, so the attacker-written summary still reached the wiki unchanged; the
triage note now truncates and strips every field it did not write itself.

ops-actions/runner.py

@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+"""
+ops-actions: the only thing in this stack that is allowed to change state.
+
+The agent never talks to this service. n8n does, and only after a switch node
+has matched the proposed action against a fixed list. This service repeats the
+check, because a second lock on the same door costs nothing.
+
+Two allowlists, both hard coded, neither reachable from a prompt:
+  ACTIONS   what may be done at all
+  TARGETS   which containers may be touched
+"""
+import json, os, subprocess, time
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+ACTIONS = {"restart_container"}
+TARGETS = {"selfhostedops-stack-vaultwarden-1",
+           "selfhostedops-stack-ntfy-1",
+           "selfhostedops-stack-outline-1"}
+TOKEN = os.environ.get("OPS_ACTIONS_TOKEN", "")
+LOG = "/var/log/ops-actions.log"
+
+
+def log(entry):
+    entry["ts"] = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+    with open(LOG, "a") as fh:
+        fh.write(json.dumps(entry) + "\n")
+
+
+class Handler(BaseHTTPRequestHandler):
+    def _reply(self, code, obj):
+        body = json.dumps(obj).encode()
+        self.send_response(code)
+        self.send_header("content-type", "application/json")
+        self.send_header("content-length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, *a):
+        pass
+
+    def do_GET(self):
+        if self.path == "/healthz":
+            return self._reply(200, {"status": "ok", "actions": sorted(ACTIONS),
+                                     "targets": sorted(TARGETS)})
+        self._reply(404, {"error": "not found"})
+
+    def do_POST(self):
+        if self.path != "/act":
+            return self._reply(404, {"error": "not found"})
+        if TOKEN and self.headers.get("x-ops-token") != TOKEN:
+            log({"event": "denied", "why": "bad token"})
+            return self._reply(401, {"error": "bad token"})
+        n = int(self.headers.get("content-length") or 0)
+        try:
+            req = json.loads(self.rfile.read(n) or b"{}")
+        except Exception as e:
+            return self._reply(400, {"error": "bad json: %s" % e})
+        action = req.get("action")
+        target = req.get("target")
+        if action not in ACTIONS:
+            log({"event": "denied", "why": "action not on allowlist",
+                 "action": action, "target": target})
+            return self._reply(403, {"error": "action not on allowlist",
+                                     "action": action, "allowed": sorted(ACTIONS)})
+        if target not in TARGETS:
+            log({"event": "denied", "why": "target not on allowlist",
+                 "action": action, "target": target})
+            return self._reply(403, {"error": "target not on allowlist",
+                                     "target": target, "allowed": sorted(TARGETS)})
+        t0 = time.time()
+        p = subprocess.run(["docker", "restart", target],
+                           capture_output=True, text=True, timeout=120)
+        took = round(time.time() - t0, 3)
+        ok = p.returncode == 0
+        log({"event": "executed" if ok else "failed", "action": action,
+             "target": target, "seconds": took,
+             "stdout": p.stdout.strip(), "stderr": p.stderr.strip()})
+        return self._reply(200 if ok else 500,
+                           {"executed": ok, "action": action, "target": target,
+                            "seconds": took, "stderr": p.stderr.strip()})
+
+
+if __name__ == "__main__":
+    HTTPServer(("0.0.0.0", 8099), Handler).serve_forever()