docs: untrusted-target live — 4 of 4 expansion calls recorded, 0 of 6 literal

Also records the first noise source: CSP response headers taint every origin a page may load from. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-09-22 19:00:08 -05:00
parent 5f69e88878
commit 0c4a13c841
1 changed files with 11 additions and 0 deletions
@@ -138,6 +138,17 @@ intersection.
   cases, and the shell never refuses. Limits pinned by that table: a literal
   secret in a URL is not an expansion, and a subdomain of a tainted host
   (`www.iana.org` vs `iana.org`) is not matched.
+
+   **Live, mission 01a0cb8c.** The agent fetched `example.com`, then made six
+   literal requests to the IANA pages and four with `?t=$(date +%s)`. Shadow
+   recorded exactly the four expansion calls as `untrusted-target` and none of
+   the six. The first thing to watch: 5 of the 8 tainted hosts
+   (`www.google.com`, `www.googleapis.com`, …) came from `www.iana.org`'s
+   `Content-Security-Policy` **response header**, not its body. That is
+   correct by the letter (fetched output named them) and noisy in practice.
+   An agent later calling a Google API with `$KEY` in the URL would be
+   recorded. If shadow traffic shows that, the fix is to stop reading header
+   lines other than `Location`. Stage 3 waits on that evidence.
 3. Enforce on the **container tier**, where public egress is open. On the VM
   tier it is defence in depth behind an allow-list that already holds.