Phase 1: critical security — bind anon DNA tasks, fix DEBUG default, lock task whitelist

[vanajmoorthy]

Summary

Phase 1 of the multi-agent triage remediation. Closes the three Critical-severity security findings from the triage report:

1. Anonymous DNA hijack via guessable task_id (US-001, US-002, US-003) — anyone who learned a task_id (Referer leak, shared link, log) could pull another user's DNA into their own session, or sign up with the stolen task_id and inherit the whole library.
2. DEBUG defaulting to True (US-004) — a missing/typo'd env var silently exposed Silk profiler and disabled secure cookies.
3. run_management_command_task had no in-task whitelist (US-005) — admin had a whitelist but a malicious caller publishing directly to the broker could bypass it.

Also lands the Ralph harness + the 8-phase remediation PRD; subsequent PRs (Phase 2..8) will work off the same branch.

What changed

Critical security fixes (US-001 → US-005)

• US-001 (011ab73) — anonymous branch of upload_view now binds task_owner_<task_id> in Redis to the visitor's session_key at upload time (TTL 3600s). Session is .save()d first if session_key is None.
• US-002 (07abc13) — get_task_result_view checks task_owner_<task_id> and rejects mismatched callers with 403. Gated behind a new ENFORCE_TASK_OWNERSHIP env flag (defaults False) so in-flight pre-US-001 task IDs aren't immediately broken. Logs task_owner check skipped warnings while the flag is off so operators can drain legacy traffic.
• US-003 (ff16c64) — signup_view validates task_id_to_claim against the session's own anonymous_task_id BEFORE creating the user (and before login() rotates session_key). The pre-login session_key is captured into a local and passed as a new third arg to claim_anonymous_dna_task.delay(...). The task refuses any claim where task_owner_<task_id> doesn't match the supplied key.
• US-004 (e978af4) — DEBUG = os.environ.get(\"DEBUG\", \"False\") == \"True\" (was \"True\" default); ImproperlyConfigured raised at startup if DJANGO_ENV=production and DEBUG=True. Also adds explicit DEBUG=True + ALLOWED_HOSTS=localhost,127.0.0.1 to docker-compose.local.yml because dev was implicitly relying on the old default.
• US-005 (44b8a55) — ADMIN_COMMANDS / ALLOWED_COMMANDS carved into new core/management_command_registry.py (third module — sidesteps the tasks.py → admin.py cycle that would have been created if we imported the other direction). run_management_command_task now raises ValueError(f\"command not allowed: {command_name}\") as its first statement.

Required deploy actions

• ⚠️ Set ENFORCE_TASK_OWNERSHIP=True in the production env ≥1 hour after this deploy lands. Until then, US-002's strict check is off (legacy task IDs predating US-001 are warn-and-allow). Grep production logs for task_owner check skipped — once it drops to zero for ≥1 hour, flip the flag.
• ⚠️ Set DEBUG=False (or unset it entirely) and DJANGO_ENV=production in the production env. With the new default, a missing DEBUG env var is safe; with the new assert, an accidentally-set DEBUG=True in production will refuse to start.
• ⚠️ Local dev now requires DEBUG=True to be set explicitly. The compose file at docker-compose.local.yml is updated; if you run Django outside Docker (honcho start), ensure your .env has DEBUG=True.

Scaffolding (not user-facing)

• tasks/prd-codebase-triage-fixes.md — full 69-story remediation PRD (8 phases, ~1250 lines).
• scripts/ralph/ — Ralph harness (ralph.sh, prompt, prd.json work list, PRD-to-JSON converter).
• AGENTS.md — project conventions + settings invariants + Redis key registry (referenced by future stories).
• progress.txt — append-only chronological log; populated as iterations land.

Test plan

All five stories shipped with regression tests. New / updated tests live in:

• core/tests/test_views_e2e.py — anon upload-binds-owner, owner-positive read, foreign-session strict 403, foreign-session legacy warn, signup-cross-session reject, signup-post-rotation positive.
• core/tests/test_tasks_integration.py — claim_anonymous_dna_task direct-invocation mismatch rejection.
• core/tests/test_tasks_unit.py — run_management_command_task whitelist (blocked-name + empty-string negatives, whitelisted positive).

Pre-merge checklist

• CI passes (full Django test suite).
• Confirm ENFORCE_TASK_OWNERSHIP env var is in the production env (default False).
• Confirm prod DEBUG env is unset OR explicitly False; DJANGO_ENV=production set.
• Manual smoke test of: anonymous upload → dashboard → recommendations, authenticated upload → dashboard, signup with anon-DNA claim, login, password reset.
• Plan the ENFORCE_TASK_OWNERSHIP=True flip for 1h+ post-deploy.

Related

• PRD: tasks/prd-codebase-triage-fixes.md
• Phase 2 target (next PR): chore: remove dead code, scripts, profiles, personal CSVs, test fixtures (US-006..US-014).

[vanajmoorthy]

Review fixes pushed (e80c734)

All 4 BLOCKER findings + bonus MEDIUM/LOW polish from the post-merge security review are now addressed. Full suite remains green (359 tests).

Blockers closed:

• Features #1 — get_task_result_view no longer writes session DNA on ownership mismatch (regardless of ENFORCE_TASK_OWNERSHIP). The original warn-and-allow path leaked into session["dna_data"], which combined with signup_view's session-DNA branch to re-open the hijack.
• feat: set up basic posthog event #2 — claim_anonymous_dna_task(session_key) is now a required positional arg. Direct broker publishers can no longer omit it to skip the check.
• css #3 — Both view and task fail closed on cache miss (TTL expiry was a silent bypass).
• Update README.md #4 — Session keys hashed with sha256[:12] before logging (they're bearer credentials).

Medium fixes:

• update meter #6 — signup_view now ALSO checks task_owner_<id> cache against caller session_key, layered with existing session["anonymous_task_id"] consistency check.
• Update README.md #7 — DEBUG production assert uses a whitelist of allowed envs (development, test, ci); staging is no longer silently permissive. New _env_bool helper fails loud on typos like ENFORCE_TASK_OWNERSHIP=true (lowercase) — was previously silently coerced to False.
• use google books and add mgmt command to fix genres and update mappings #12 — pending_dna_task_id is cleared on any claim-task rejection, so the rightful user's dashboard doesn't poll a doomed task forever.

Polish (#10, #11): RALPH_PROMPT.md no longer ships with hardcoded username path; scripts/ralph/, scripts/regression/, tasks/, progress.txt, AGENTS.md, .claude/ added to .dockerignore so internal triage scaffolding doesn't end up in the production image.

Test hardening (#9): test_task_result_warns_but_allows_when_not_enforced (which would have passed against the buggy fix) replaced with test_task_result_rejects_foreign_session_even_when_not_enforced that asserts the attacker's session has NO leaked dna_data after the 403. Plus two new fail-closed negative tests for the claim task (cache-miss + missing-key paths).

Deploy notes update: the ENFORCE_TASK_OWNERSHIP env var is now vestigial — fail-closed semantics apply regardless. Kept for forward compat with operational docs.

Ready for re-review.