nexus-security-hardening

name	nexus-security-hardening
description	Wave-2 security hardening for Nexus Link — runs the diagnostic tools, dispatches the MURE build, verifies the gates. Invoke for "wave 2", "security hardening", "nexus security", "pre-customer security", "rls audit", "audit chain verify", "antipattern scan".
triggers	["wave 2","security hardening","nexus security","pre-customer security","rls audit","audit chain verify","antipattern scan","wave2"]

Nexus Security Hardening (Wave 2)

Wave 2 is the pre-customer security gate (MASTER-PLAN §11): close the three load-bearing gaps (network perimeter, tamper-evident audit, real encryption) before any tenant PII lands on Hetzner. This skill orchestrates the diagnostic-verify-build-verify cycle, builds from the verified Code Reference Pack, and dispatches the MURE fleet on the codebase leaves.

Hard truth from the research: Nexus's breach risks are misconfigured boring infrastructure (Capital One = SSRF, Equifax = unpatched CVE, LastPass = dev-held-prod-keys, MOVEit = SQLi, 23andMe = no MFA, Colonial = legacy VPN, SolarWinds = build-pipeline), not exotic zero-days. The meta-failure across nearly every breach is insufficient detection (78-day dwell at Equifax). Detection + response is the real safety net.

Source-of-record (read before building)

• 02_RESOURCES/RESEARCH/nexus-security-hardening-deep-research-2026-07-06.md — the WHAT (3 gaps, 4 designs, 10 breach vectors, 30-line build spec).
• 02_RESOURCES/RESEARCH/nexus-security-code-reference-pack-2026-07-06.md — the HOW (20 controls, verbatim code, sources, license, pitfalls, Nexus adaptation).
• docs/NEXUS-LINK-WAVE2-SECURITY-VISUAL-PLAN-2026-07-06.html — the legible plan (build sequence, gates, effort map).

Diagnostic tools (verify — run BEFORE and AFTER each slice)

Bundled in scripts/. Heuristic — flags candidates for human review. Each finding points at the control that fixes it.

• antipattern-scan.mjs (this skill) — greps for the DO-NOT-USE anti-patterns (str(e) logging, bcrypt, AES-GCM random nonce, SMS 2FA, psycopg client-merge, global WAF rule removal, fast-hash passwords, pepper-in-env, TLS-verify-disabled, pg_hba trust). Exit 1 on critical → CI gate.
• rls-audit (TODO) — every Postgres table: RLS on? anon/authenticated readable without owner-scoping? Flags the silent anon-key bypass.
• audit-chain-verify (TODO) — runs the nightly hash-chain verification query; any BROKEN_LINK / ROW_HASH_MISMATCH = breach signal.
• network-perimeter-check (TODO) — no public DB/Studio ports, origin IP not in DNS, allowlist freshness < 25h.
• dep-scan (TODO) — wraps syft/grype across Python/Rust/Tauri-npm.

Run the suite: node skills/nexus-security-hardening/scripts/antipattern-scan.mjs 03_NEXUS-LINK/nexus-app.

The build sequence (highest-leverage first — each ends in a gate)

1. Network perimeter (L4a/b) — ufw default-deny + Cloudflare-origin allowlist + bind 127.0.0.1 + Tunnel. Cheapest, highest leverage. GATE: no public DB/Studio ports.
2. Audit hash-chain spine (L3) — audit_log (NO UPDATE/DELETE) + 0x00-prefixed BEFORE-INSERT trigger + nightly verify + PII triggers + log sanitizer (fixes str(e)). GATE: nightly verify all-OK; deliberate tamper detected.
3. Field-level encryption (L1a) — XChaCha20-Poly1305-IETF for tokens + DM bodies; LUKS on hosts. GATE: ciphertext round-trips; AAD binds to (tenant,row).
4. Envelope + Vault KEK (L2) — self-hosted EU Vault, transit engine, per-tenant keys. GATE: cross-tenant wrapped_dek won't decrypt.
5. App-layer (L5) — SECURITY DEFINER public writes + psycopg3 binding + SSRF guard (reuse social-adapter) + log sanitizer. GATE: G1 tenant-isolation negative test green.
6. Supply chain + WAF block-mode (L6) — SBOM/grype + SLSA L3 + scoped deps + Tauri signing; WAF flips log→block after 2-week tuning.

MURE dispatch (the fleet executes the codebase leaves)

Wave 2 → role-assigned leaves. MURE is owner-armed (spend) — prep the packet at zero cost, owner arms. Infra pieces (real Hetzner ufw, Cloudflare dashboard, Vault cluster) need the owner's hands — MURE builds the config/scripts.

Role	Leaves
architect	audit_log schema + RLS policies + SECURITY DEFINER functions (the SQL design)
engineer	Python modules (log sanitizer, SSRF guard, Argon2id/PEPPER, envelope calls) + migrations
mechanic	infra plumbing (ufw script, Cloudflare allowlist sync, Tunnel config, Tailscale, Vault standup script)
sentinel	runs the diagnostic tools (antipattern-scan, rls-audit, chain-verify), writes the posture report
adjudicator	attacks each slice: G1 tenant-isolation negative test, hash-chain tamper detection, SSRF redirect-to-metadata, WAF false-positive review
chronicler	the G12 incident runbook (DSGVO Art. 33 72h clock) + the build record
oracle/calibrator	gate evidence (each control's verification ledger)

DO NOT USE (the verify-pass-killed anti-patterns — antipattern-scan enforces)

Hand-rolled AES-GCM · bcrypt for new code · a linear hash chain labeled "RFC 6962" (it's a Merkle tree with mandatory 0x00/0x01 prefixes) · global WAF rule removal · SMS 2FA · pepper in DB/.env/repo · US-region KMS · psycopg ClientCursor/mogrify · Cloudflare One Access mTLS as workload auth · WAF in block-mode day 1.

The two trap doors (do not skip)

• The 0x00 prefix is mandatory. RFC 6962 §2.1 requires 0x00 leaf / 0x01 node domain-separation or second-preimage resistance is lost. The audit chain MUST include E'\\x00' before the canonical bytes.

• WAF block-mode is a GATE, not a default. Log-mode 2 weeks → targeted ctl:ruleRemoveTargetById=<id>;ARGS:<param> exclusions → only then flip to block.

"Done" = the pre-customer gate

Network default-deny live · audit hash-chain + nightly verify green · tokens/bodies field-encrypted under per-tenant Vault keys · G1 tenant-isolation negative tests in CI · SBOM + signed Tauri releases · WAF in block-mode · L5.5 detection wired to the G12 runbook. No paying tenant PII on Hetzner until those are green.

Session Notes

2026-07-06

• session: first build | tools: Write×2, Bash (scan run)
• built: master skill + antipattern-scan.mjs (10 patterns, CI gate). TODO: rls-audit, audit-chain-verify, network-perimeter-check, dep-scan.
• corrections: none (the RFC 6962 correction was caught upstream in the code-pack verify pass + folded into the L3a/L3b controls)
• errors: none
• notes: skill + tool travel together under skills/nexus-security-hardening/; the tool is @capability-tagged for recall. Infra pieces + MURE arming are owner-gated.