#239 Install-integrity guard: manifest + tamper detection for Doberman's own hook registration

[Anonymous]

Originally created by: fu351

Doberman's host hooks are registered by editing the agent's settings file, and nothing today records what was installed or notices when it changes. An agent (or anything else) that strips those entries silently removes Doberman from its own execution path.

Build

• An install manifest at .doberman/install-manifest.json, written by install-hooks: which settings file, scope, and a keyed HMAC fingerprint of the installed hook groups (reuse the existing fingerprint helper; never a plain hash).
• uninstall-hooks clears the manifest first: an absent manifest means silence is intentional and no alarm fires.
• Verify-at-invocation: each hook run cheaply cross-checks the sibling registrations against the manifest. Partial tampering is caught at the next surviving hook, recorded as a tamper event, and surfaced as a warning.
• doberman doctor reports manifest status: intact, diverged (naming the group), or absent.
• Regression guard: uninstalled/disabled hooks must still emit the explicit continue envelope with exit 0. Silence is indistinguishable from a crash to a fail-closed client.

Tests must prove: removing any one hook group is detected at the next sibling invocation; a legitimate uninstall raises no alarm; the integrity check can never crash or block hook execution (it degrades to a warning); no absolute user paths or secrets appear in the manifest or logs.

Prior art: Cisco DefenseClaw's hook-config guard. This issue covers detection + doctor; a warm-daemon watcher that re-asserts the installation lands separately once the ambient monitor daemon (#237) exists.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed

[Anonymous]

Ticket changed by: fu351

• status: closed --> open

[Anonymous]

Originally posted by: fu351

Design notes for when this gets built, from reading core/integrity.py in WayneCider/YourOwnPersonalJean-Luc (Apache-2.0), which implements the same idea for its own install:

• Tiered verdicts. Files are grouped into trust tiers; a hash mismatch on the security core aborts, on peripheral files it warns. Cheap to specify and it keeps the guard usable — an all-or-nothing manifest gets disabled the first time a benign edit trips it.
• Sweep for unknown files, not just changed ones. They scan the guarded directories for .py files absent from the manifest. Tampering by addition is invisible to a hash-only check.
• Mechanics worth keeping: HMAC over canonical JSON (sorted keys, no whitespace), hmac.compare_digest, salt + iteration count stored in the manifest.
• One pitfall to avoid: their key derives from an interactive passphrase (getpass) at every verify — that would hang a headless hook start. Ours should use the existing keyring / 0600 HMAC key we already use for fingerprints.