Open-Finance-Lab
diff --git a/‎.github/workflows/backend-deploy.yml‎
Lines changed: 51 additions & 11 deletions b/‎.github/workflows/backend-deploy.yml‎
Lines changed: 51 additions & 11 deletions
diff --git a/‎.github/workflows/uptime.yml‎
Lines changed: 36 additions & 0 deletions b/‎.github/workflows/uptime.yml‎
Lines changed: 36 additions & 0 deletions
diff --git a/‎Docs/superpowers/specs/2026-07-02-websocket-webrtc-ssrf-egress-firewall-design.md‎
Lines changed: 10 additions & 0 deletions b/‎Docs/superpowers/specs/2026-07-02-websocket-webrtc-ssrf-egress-firewall-design.md‎
Lines changed: 10 additions & 0 deletions
diff --git a/‎Main/backend/Dockerfile‎
Lines changed: 16 additions & 11 deletions b/‎Main/backend/Dockerfile‎
Lines changed: 16 additions & 11 deletions
diff --git a/‎Main/backend/datascraper/playwright_tools.py‎
Lines changed: 7 additions & 1 deletion b/‎Main/backend/datascraper/playwright_tools.py‎
Lines changed: 7 additions & 1 deletion
diff --git a/‎Main/backend/datascraper/ssrf_guard.py‎
Lines changed: 26 additions & 2 deletions b/‎Main/backend/datascraper/ssrf_guard.py‎
Lines changed: 26 additions & 2 deletions
diff --git a/‎Main/backend/datascraper/url_tools.py‎
Lines changed: 5 additions & 1 deletion b/‎Main/backend/datascraper/url_tools.py‎
Lines changed: 5 additions & 1 deletion
@@ -177,28 +177,68 @@ jobs:
             podman network exists fingpt-net || podman network create fingpt-net
 
             # Redis counter store (atomic incr/decr for agent budget + ratelimit).
-            # Ephemeral cache: no persistence. --replace keeps redeploys idempotent.
-            podman run -d --name fingpt-redis --replace --restart=always \
-              --network fingpt-net \
-              --health-cmd 'redis-cli ping' --health-interval 10s --health-retries 5 \
-              docker.io/library/redis:7-alpine redis-server --save '' --appendonly no
+            # Ephemeral cache: no persistence. Started idempotently (start-if-absent, not
+            # --replace) BEFORE the pre-cutover gate so (a) the firewall self-test has redis
+            # up on fingpt-net, and (b) an ABORTED deploy does not bounce the live redis /
+            # wipe counters for the still-serving old container.
+            # TRADE-OFF of start-if-absent: the running container stays FROZEN on whatever
+            # redis:7-alpine image it was created from -- deploys never pick up redis image
+            # updates (security patches included). To upgrade redis, run on the droplet:
+            #   podman pull docker.io/library/redis:7-alpine && podman rm -f fingpt-redis
+            # then let the next deploy (or a re-run of this one) recreate it. Counters are
+            # ephemeral by design, so the wipe is acceptable when done deliberately.
+            if ! podman container exists fingpt-redis; then
+              podman run -d --name fingpt-redis --restart=always \
+                --network fingpt-net \
+                --health-cmd 'redis-cli ping' --health-interval 10s --health-retries 5 \
+                docker.io/library/redis:7-alpine redis-server --save '' --appendonly no
+            else
+              podman start fingpt-redis >/dev/null 2>&1 || true
+            fi
+
+            # Pre-cutover firewall validation: run the NEW image's REAL entrypoint in
+            # check-only mode on fingpt-net BEFORE the systemctl restart's --replace kills
+            # the currently-serving container. --egress-check-only exercises the byte-
+            # identical root-init PID1 runs at cutover (generate + sentinel checks + nft
+            # load + transition-proof self-test + setpriv drop), then exits before the app
+            # phase; an inline re-copy of that sequence (this step's previous shape) can
+            # silently drift from the boot path it is supposed to prove. On failure, abort
+            # so the OLD container keeps serving (there is no auto-rollback). This closes
+            # the CI-invisible gap: the test job is pytest-only and never touches nft/netns.
+            echo "Validating egress firewall on the new image (pre-cutover)..."
+            podman run --rm --cap-add=NET_ADMIN --network fingpt-net \
+              --env REDIS_URL=redis://fingpt-redis:6379/0 \
+              "$REMOTE_IMAGE" --egress-check-only \
+              || { echo "ERROR: egress firewall pre-cutover validation FAILED; aborting deploy (old container left serving)"; exit 1; }
+            echo "Egress firewall pre-cutover validation passed."
+
+            # Record the currently-deployed image for manual rollback (no auto-rollback).
+            PREV_IMAGE=$(podman inspect --format '{{.ImageName}}' "$SYSTEMD_UNIT" 2>/dev/null || echo "unknown")
+            echo "Previous image (manual rollback target): $PREV_IMAGE"
 
             # Update systemd override to run the image we just pulled.
-            # The image now runs as non-root uid 1001 (Dockerfile USER fingpt), so the
-            # runtime bind mount below needs BOTH relabel suffixes for the non-root process
-            # to write it on this SELinux-enforcing Fedora host:
+            # PID1 is now root-in-userns (no Dockerfile USER line); it loads the egress
+            # firewall, chowns /app/runtime to fingpt, then setpriv-drops to uid1001 for
+            # the app. The runtime bind mount still needs BOTH relabel suffixes on this
+            # SELinux-enforcing Fedora host:
             #   :U  rootless podman recursively chowns the host dir to the in-container uid
-            #       (DAC/ownership); without it the write is EACCES.
+            #       (now root/0, since PID1 is root); entrypoint then re-chowns it to fingpt
+            #       so the dropped app user can write it (validated: spec Appendix A probe 3).
             #   :Z  relabels the (private) host dir to container_file_t (MAC/SELinux);
-            #       without it container_t is denied and the write is *also* EACCES -- which
+            #       without it container_t is denied and the write is EACCES -- which
             #       crash-looped the truth-layer store build the first time a deploy actually
             #       wrote this mount (#322). Ownership alone is not enough; both are required.
+            # --cap-add=NET_ADMIN is SECURITY/FUNCTIONALLY LOAD-BEARING: rootless podman's
+            # default cap set excludes NET_ADMIN, so without it the root-in-userns init
+            # cannot load the SSRF egress firewall (nft EPERM) -> entrypoint fail-closes ->
+            # the container never serves. Do NOT drop it. (The app itself runs as uid1001
+            # with NET_ADMIN removed from its bounding set; see Main/backend/entrypoint.sh.)
             OVERRIDE_DIR="$HOME/.config/systemd/user/${SYSTEMD_UNIT}.service.d"
             mkdir -p "$OVERRIDE_DIR"
             cat > "$OVERRIDE_DIR/override.conf" <<EOF
             [Service]
             ExecStart=
-            ExecStart=/usr/bin/podman run --name ${SYSTEMD_UNIT} --replace --rm --cgroups=split --sdnotify=conmon -d --memory=1.7g --memory-swap=2g --network fingpt-net -v /home/deploy/fingpt/runtime:/app/runtime:U,Z --publish 127.0.0.1:8000:8000 --env-file /home/deploy/fingpt/envs/.env.production --env REDIS_URL=redis://fingpt-redis:6379/0 ${REMOTE_IMAGE}
+            ExecStart=/usr/bin/podman run --name ${SYSTEMD_UNIT} --replace --rm --cap-add=NET_ADMIN --cgroups=split --sdnotify=conmon -d --memory=1.7g --memory-swap=2g --network fingpt-net -v /home/deploy/fingpt/runtime:/app/runtime:U,Z --publish 127.0.0.1:8000:8000 --env-file /home/deploy/fingpt/envs/.env.production --env REDIS_URL=redis://fingpt-redis:6379/0 ${REMOTE_IMAGE}
             EOF
 
             systemctl --user daemon-reload
 
@@ -0,0 +1,36 @@
+name: Uptime Monitor
+
+# Deploy-independent liveness: the backend fail-closes on a bad egress-firewall load,
+# and a load can fail on a reboot/OOM/kernel update WITHOUT a deploy (which re-runs the
+# entrypoint). This cron curls the PUBLIC endpoint so such an outage is caught within
+# minutes instead of by a user. Zero-infra fallback; GitHub may delay scheduled runs and
+# disables schedules after 60 days of repo inactivity.
+on:
+  schedule:
+    - cron: "*/10 * * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  probe:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Curl public health endpoint
+        run: |
+          set -euo pipefail
+          # ~180s budget: comfortably past the documented ~130s deploy cold start (the
+          # entrypoint builds the XBRL store before gunicorn listens, behind a --replace
+          # swap), so a tick landing in a deploy window catches recovery instead of crying
+          # wolf. A genuinely dead endpoint (>180s) still alerts.
+          for i in $(seq 1 9); do
+            if curl -fsS -m 10 https://agenticfinsearch.org/health/ >/dev/null; then
+              echo "healthy (attempt $i)"
+              exit 0
+            fi
+            echo "attempt $i/9 failed; retrying in 20s..."
+            sleep 20
+          done
+          echo "::error::agenticfinsearch.org/health/ is DOWN after 9 attempts (~180s)"
+          exit 1
@@ -172,6 +172,10 @@ Deliberate choices, each from the design review:
     resolver) → else non-zero.
   - `fingpt-redis:6379` TCP connect **must succeed** within a short retry window (~5×1s, tolerating
     redis's own cold start) → else non-zero.
+  - **AMENDED at implementation:** the DNS + redis legs shipped as **advisory (WARN, exit 0)**, not
+    fatal — the prior entrypoint had zero redis/DNS boot dependency, so a fatal leg would let a
+    redis blip at reboot fail-close a correct firewall (see `_self_test`'s docstring for the full
+    rationale). Only the metadata leg is fatal.
 - `ops/__init__.py` (new, empty) so `python -m ops.egress_firewall` resolves from WORKDIR `/app`.
 
 ### Dockerfile changes
@@ -195,6 +199,12 @@ Deliberate choices, each from the design review:
   ssrf_egress >/dev/null && python -m ops.egress_firewall --self-test'`. **Abort the deploy on
   failure** so the old container keeps serving. This converts a catastrophic mid-swap fail-closed
   into a safe no-op abort and closes the CI-invisible gap.
+  **AMENDED at implementation (simplify pass):** the gate no longer inlines that sequence — it runs
+  the image's REAL entrypoint via `podman run … "$REMOTE_IMAGE" --egress-check-only` (a flag
+  entrypoint.sh handles after the setpriv drop, exiting before the app phase). An inline copy can
+  silently drift from the boot path it is supposed to prove (and had: it lacked the `[ -s ]` and
+  grep-sentinel guards); the flag form exercises the byte-identical root-init PID1 runs at cutover.
+  Wiring pinned by `test_dockerfile_nonroot.test_precutover_gate_runs_real_entrypoint_check_only`.
 - Record/echo the previously-deployed image digest before restart, and add a one-line manual
   rollback note to the deploy log for the no-auto-rollback case.
 
 
@@ -11,6 +11,9 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-ins
     python3.12-venv \
     python3.12-dev \
     nodejs \
+    nftables \
+    iproute2 \
+    util-linux \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 RUN curl -LsSf https://astral.sh/uv/install.sh | sh
@@ -52,22 +55,24 @@ RUN echo "Verifying Playwright browsers..." && \
     test -d /ms-playwright/chromium_headless_shell-* && \
     echo "✓ Chromium browser found at /ms-playwright"
 
-# Create a non-root runtime user and own ONLY the writable runtime dirs.
-# The application source under /app stays root-owned so a compromised
-# process cannot rewrite code at runtime (P0 Root A.3: no-write-under-/app).
+# Create the non-root runtime user and own ONLY the writable runtime dirs.
+# The application source under /app stays root-owned so a compromised process cannot
+# rewrite code at runtime (P0 Root A.3: no-write-under-/app). PID1 (entrypoint.sh) runs
+# as root-IN-USERNS -- rootless podman keeps that host-unprivileged -- solely to load the
+# SSRF egress firewall (needs CAP_NET_ADMIN) and chown the runtime mount, then
+# setpriv-drops to fingpt (uid1001, NET_ADMIN removed from the bounding set, no_new_privs)
+# so the long-running app is non-root and cannot flush its own firewall. The
+# no-write-under-/app intent holds: the app process is uid1001 and /app is root-owned;
+# only the brief pre-app init is root and it writes nothing under /app except chowning the
+# designated writable runtime mount (see entrypoint.sh; there is deliberately no USER line).
 # /app/runtime is the writable runtime-data volume mountpoint: entrypoint.sh builds the
-# regenerable DuckDB truth-layer store there (from the root-owned, still-read-only
-# vendored companyfacts JSON in the truthlayer/data package dir) BEFORE gunicorn forks, and in
-# production it is a persistent bind mount (podman -v ...:/app/runtime:U) so the store
-# survives restarts. Owning it in the image keeps it writable even with no mount
-# (compose/CI/bare docker run). Only this regenerable artifact dir is fingpt-writable;
-# no application code (.py) becomes writable, so the no-write-under-/app intent holds.
+# regenerable DuckDB truth-layer store there BEFORE gunicorn forks; in production it is a
+# persistent bind mount (podman -v ...:/app/runtime:U,Z) so the store survives restarts.
+# Owning these dirs in the image keeps them writable with no mount (compose/CI/bare run).
 RUN groupadd --system --gid 1001 fingpt \
     && useradd --system --uid 1001 --gid fingpt --no-create-home fingpt \
     && chown -R fingpt:fingpt /app/staticfiles /app/media /app/logs /tmp/fingpt_cache /app/runtime
 
-USER fingpt
-
 ENTRYPOINT ["/app/entrypoint.sh"]
 
 EXPOSE 8000
 
@@ -14,6 +14,7 @@
 
 logger = logging.getLogger(__name__)
 
+
 @asynccontextmanager
 async def PlaywrightBrowser(timeout: int = 30000):
     """
@@ -36,7 +37,8 @@ async def PlaywrightBrowser(timeout: int = 30000):
         playwright = await async_playwright().start()
         browser = await playwright.chromium.launch(
             headless=True,
-            args=['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage']
+            args=['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage',
+                  *ssrf_guard.CHROMIUM_HARDENING_ARGS]
         )
 
         context = await browser.new_context(
@@ -50,6 +52,10 @@ async def PlaywrightBrowser(timeout: int = 30000):
         # async entrypoints (and any future one) are pinned without each having
         # to remember the call. See datascraper.ssrf_guard.install_route_guard.
         await ssrf_guard.install_route_guard(page)
+        # WebRTC hardening (best-effort, not a boundary): remove RTCPeerConnection before
+        # page scripts run to curb WebRTC egress on Chromium's own socket (which the route
+        # guard cannot intercept). The netns egress firewall is the real boundary.
+        await page.add_init_script(ssrf_guard.DISABLE_WEBRTC_JS)
 
         yield page
 
 
@@ -14,8 +14,11 @@
 buffered response, so Chromium never opens its own connection for the HTTP(S)
 requests ``page.route`` intercepts. Non-GET and non-http(s) in-browser requests
 fail closed (aborted), as ``safe_get`` only serves pinned GETs. (WebSocket /
-WebRTC are NOT intercepted by ``page.route`` and remain a separate, pre-existing
-gap — out of scope here.)
+WebRTC are NOT intercepted by ``page.route``; that gap is closed for
+private/link-local/metadata destinations at the netns layer by the egress
+firewall — see ops/egress_firewall.py, which deliberately still accepts
+own-subnet + public egress — with ``DISABLE_WEBRTC_JS`` below as best-effort
+surface reduction on top.)
 
 Public contract (do not rename):
     UnsafeURLError
@@ -25,6 +28,8 @@
     install_route_guard(page)      (async, Playwright)
     install_route_guard_sync(page) (sync, Playwright)
     assert_safe_page_url(page)     (async, Playwright)
+    DISABLE_WEBRTC_JS              (init-script string, Playwright)
+    CHROMIUM_HARDENING_ARGS        (launch-args tuple, Playwright)
 """
 import asyncio
 import ipaddress
@@ -68,6 +73,25 @@
 # subresource burst reuses connections instead of serializing on one.
 _POOL_MAXSIZE = int(os.getenv("SCRAPE_POOL_MAXSIZE", "20"))
 
+# Best-effort WebRTC surface reduction (NOT a boundary): a text scraper needs no WebRTC,
+# and page.route cannot intercept it (Chromium egresses it on its own socket). Installed
+# as a pre-navigation init script by BOTH scraper paths (the playwright_tools async
+# factory and the url_tools sync fallback) — defined once HERE so the two paths cannot
+# drift. Paired with CHROMIUM_HARDENING_ARGS on the launch args. A fresh realm could
+# re-obtain the deleted constructor, so the netns egress firewall (ops/egress_firewall.py)
+# remains the actual boundary; this only shrinks the surface for the public-egress residual.
+DISABLE_WEBRTC_JS = (
+    "delete window.RTCPeerConnection;"
+    "delete window.webkitRTCPeerConnection;"
+    "delete window.RTCDataChannel;"
+)
+
+# The launch-args half of the same surface reduction, consumed by BOTH launch sites
+# (playwright_tools async factory + url_tools sync fallback) so a hardening flag can
+# never be added to one path only. QUIC would otherwise carry HTTP/3 on Chromium's own
+# UDP socket, past page.route exactly like WebRTC.
+CHROMIUM_HARDENING_ARGS = ("--disable-quic",)
+
 # Response headers that must NOT be forwarded when fulfilling a Playwright route
 # from a safe_get response: requests has already decoded the body (so a stale
 # Content-Encoding would make Chromium try to gunzip plaintext), and the framing
 
@@ -202,7 +202,7 @@ def scrape_with_playwright(url: str) -> str:
 
     try:
         with sync_playwright() as p:
-            browser = p.chromium.launch(headless=True, args=['--no-sandbox', '--disable-setuid-sandbox'])
+            browser = p.chromium.launch(headless=True, args=['--no-sandbox', '--disable-setuid-sandbox', *ssrf_guard.CHROMIUM_HARDENING_ARGS])
             try:
                 context = browser.new_context(
                     user_agent=HEADERS['User-Agent'],
@@ -215,6 +215,10 @@ def scrape_with_playwright(url: str) -> str:
                 # seed-only validate_fetch_url checks leave open. Must precede
                 # the first navigation.
                 ssrf_guard.install_route_guard_sync(page)
+                # WebRTC hardening (see ssrf_guard.DISABLE_WEBRTC_JS): remove
+                # RTCPeerConnection in every frame so a scraped page cannot open WebRTC
+                # on Chromium's own socket. Must precede the first navigation.
+                page.add_init_script(ssrf_guard.DISABLE_WEBRTC_JS)
 
                 logger.info(f"Playwright scraping: {url}")
                 page.goto(url, timeout=30000, wait_until="domcontentloaded")