carlos / platform Public

From the 2026-10-06 access & tenant-isolation assessment (docs/security/2026-10-06-access-assessment.md, finding #2).

Problem. childEnv built each tenant instance's environment by copying the edge agent's own process environment and removing only CARLOS_* — a denylist. So any non-CARLOS_ secret the agent happened to carry (an inline AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, a DATABASE_URL, an SMTP cred, a SENTRY_DSN) was handed to every hosted app via its /proc/self/environ. The deployment-bucket client uses the stock AWS credential chain, so a leaked inline AWS key would have meant control-plane takeover from any tenant.

Fix (this branch). Replace the denylist with an explicit allowlist of benign, non-secret base vars: PATH, HOME, TMPDIR, TZ, LANG, LC_*, USER, LOGNAME, SHELL, TERM, SSL_CERT_FILE/SSL_CERT_DIR. Everything else — all AWS_*, and CARLOS_* as before — is dropped. fileEnv layering, dedup and last-value-wins ordering are byte-for-byte unchanged, so an app's own declared config still works. New regression test asserts planted secrets never reach a child.

Scope / severity. Defence-in-depth. On the live box the acute form is already inert (host.env uses AWS_SHARED_CREDENTIALS_FILE=/etc/carlos/credentials, not inline keys). And on a flat instance a tenant runs as carlos and can read /etc/carlos/credentials off disk regardless — so this change does not by itself isolate a flat tenant. The real fix for that is the nested-layout migration (finding #1), tracked separately. This branch closes the environment channel so that even a future host.env secret can't leak.

Behavioural change to note at rollout. AWS_REGION and any var an operator set box-wide in host.env for all apps no longer propagate; apps must declare their own config in their env file.

Review ask: sanity-check the allowlist (anything a real tenant legitimately inherits that I've dropped?) and the host.env rollout note. Full activator package test is green locally.