Proposal: host-side AffixIO attestation alongside ADR observe/detect/prevent
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start by reading the README sections on Prevention and the Sensor schema; the issue does not identify specific files or tests. The first step is to get maintainer direction on whether this belongs in documentation, a Sensor schema change, or a local example, and whether to wait for Prevention OSS. Done would require an agreed scope and a minimal contribution matching it.
由索引模型根据 Issue 内容生成。
描述
Summary
AffixIO can sit next to ADR as complementary host-side signed ACTION yes/no proof for consequential agent tool calls. ADR already observes activity, detects threats, and (in product) prevents unsafe actions. AffixIO would not replace that loop. It would add signed allow/deny evidence ADR can cite in detection/response, and optionally gate unsafe tool calls with host proof before execution.
Happy to stop at discussion, or contribute a minimal example if maintainers want one.
Why this fits
ADR Discovery/Sensor/Detection already cover inventory, telemetry, and threat detection. Prevention is called out in the README but is not in the current open-source release. Host-side attestation is a natural companion:
- ADR sees what the agent did or tried to do.
- AffixIO signs a concrete ACTION allow/deny decision on the host.
- Detection/response can treat that signature as citeable evidence, not another opaque policy black box.
Scope lock for AffixIO here: PII stays on the host. This is not person/age/KYC identity.
Product surface (AffixIO)
- Host-side signed ACTION yes/no via
npm i affixio - Local stdio MCP:
@affixio/[email protected] - Docs: https://www.affix-io.com/ and https://hub.affix-io.com/onboarding/
Proposed sit (no full wrap)
Optional complementary path only:
- Before a consequential tool call executes, request AffixIO host attestation for that ACTION.
- If denied, do not execute; emit signed deny evidence into the ADR observability/detection trail.
- If allowed, proceed and attach signed allow evidence so ADR Detection can cite it later.
This stays outside ADR core. No proposal to vendor AffixIO into Discovery/Sensor/Detection, and no full SDK wrap of ADR.
Ask for maintainers
- Does complementary host-side attestation belong in ADR's open-source direction (docs/example note, Sensor schema field for attestations, or wait until Prevention OSS lands)?
- If useful, would you prefer a short docs note plus a minimal local example under something like
Sensor/examples/, or hold until Prevention is public? - Any schema constraints for attaching signed evidence to Sensor events without bloating the unified telemetry model?
If maintainers want a minimal example, AffixIO can provide a small FIT-for-PR sketch (local stdio MCP + signed ACTION gate stub) and stop there. No large wrap planned.
- 主要语言
- Python
- 星标
- 2.1k
- 派生
- 230
- 平均合并
- 16 小时 8 分钟
- 30 天内合并 PR
- 2
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
uber/ADR 的其他 Issue
-
难度 5/5 一周以上 新手友好度 20/100
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 32/100
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 72/100
gorakhargosh/watchdog#1462 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 85/100
openwisp/openwisp-monitoring#889 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100
OpenFreeEnergy/Lomap#180 ·
-
难度 2/5 1-3 小时 新手友好度 62/100
roman-corgi/corgisim#327 ·
维护者通常 2 天内回复
-
agent:WSL bug code-review linux pri:medium sev:low tooling
难度 2/5 半天 新手友好度 62/100
维护者通常 1 天内回复