📖 Add KubeStellar Hive security self-assessment

[clubanderson]

Summary

• Adds the CNCF TAG-Security self-assessment for KubeStellar Hive under projects/kubestellar/sub-projects/hive/security-assessment/, alongside the existing Console assessment
• Source document: https://github.com/kubestellar/hive/blob/v4/src/docs/security-self-assessment.md

What Hive is, and why the threat model is unusual

Hive orchestrates fleets of AI coding agents that autonomously maintain software projects — filing issues, opening pull requests, reviewing, and at high autonomy levels merging. Agents run as CLI subprocesses under tmux, in containers or pods, holding GitHub App or PAT credentials.

That means the system runs model output with credentials that can write to source repositories, so the assessment focuses on the boundaries that contain that rather than on a conventional network/data perimeter.

Covered:

• ACMM autonomy levels (L1–L6) and the agent mode ladder — the primary risk gate. Write and merge capability is earned by level; low-level agents can only advise.
• ioscan — prompt-injection scanning of untrusted input on the kick path, with canary support
• MITM proxy — network egress enforcement (ADR-0002)
• GitHub App credential handling — JWT→installation token, per-cluster private keys at 0600, distinct from the OAuth/OIDC login path
• Append-only audit log — the attribution substrate, with rotation and a gzip-bomb read cap
• Private vulnerability reporting via GitHub Security Advisories

Weaknesses are stated, not omitted

A self-assessment that claims everything is fine is not useful to a reviewer, so the document names its own gaps. The three most significant:

1. ioscan.fail_mode defaults to open. A scanner or classifier outage degrades toward continuing to process untrusted input rather than blocking — a deliberate availability/security tradeoff, documented as such.
2. Agents share a container rather than being sandboxed per run, separated by UID rather than process/kernel containment, and can hold live write credentials in-session. Tracked upstream as ✨ [catch-up] Credential-free sandboxed agent execution (no token, no network in sandbox) kubestellar/hive#2804.
3. Single-maintainer security response capacity, with CODEOWNERS present but not enforced by branch protection — a consequence of the project's own automation merging green PRs. This is the largest institutional risk identified.

It also records plainly that no third-party security audit or penetration test has been performed, and that SBOM/provenance attestations are currently disabled on image builds (with the reason, which is a real container-runtime exec failure rather than an oversight).

Notes for reviewers

• Relative links in the source document have been rewritten to absolute Hive URLs so they resolve from this repository.
• The canonical copy lives in the Hive repo; the document says so, so corrections land in one place.
• Scope is Hive only — not KubeStellar Core, and not Console.

References

• CNCF TAG-Security self-assessment template
• Sibling assessment: KubeStellar Console (📖 Add KubeStellar Console security self-assessment #2106)