Merge branch 'main' into fix/issue-264-pin

Author: cagataycali

AGENTS.md

@@ -238,4 +238,17 @@ Corrections from code review that apply to all future contributions:
   Do not manually bump tags; merge the Dependabot PR.
 - **Especially `pypa/gh-action-pypi-publish`** — it uses a moving `release/v1`
   branch, which is exactly the supply-chain pattern that the `tj-actions/changed-files`
-  incident exploited. This pin is non-negotiable.
+  incident exploited. This pin is non-negotiable.
+
+### Operational Runbooks for Security Pins
+- **A static security pin must ship with a rotation runbook, not just a recompute
+  command.** A docstring one-liner that recomputes a pin is necessary but not
+  sufficient; on-call at 3 AM needs a documented grace-period strategy. For the
+  Amazon Root CA1 pin (`provision._AMAZON_ROOT_CA1_PINS`) the runbook lives in
+  README.md > "CA Pin Rotation Runbook": dual-pin tuple during the overlap, ship
+  the new pin first, drop the old pin in a follow-up release after fleet uptake,
+  and use `STRANDS_MESH_CA_PINS` only as an emergency out-of-band override.
+- **Make the accepted-pin set a collection, never a scalar.** `_resolve_ca_pins()`
+  returns a `frozenset` so the dual-pin grace period is expressible. Any future
+  pinned fingerprint (other roots, signing keys) should follow the same
+  multi-value shape so rotation never requires a flag-day deploy.

CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable behavioural changes to `strands-robots` are logged here. Follows
 [Keep a Changelog](https://keepachangelog.com/) conventions.
 
+## Unreleased - #320 (MuJoCo robot-scene ground-plane z-fighting)
+
+### Fixed: broken floor render when a robot asset ships its own ground plane
+
+Robots whose asset MJCF includes its own ground/floor plane (e.g.
+``franka_emika_panda/scene.xml`` ships ``<geom name="floor" type="plane"/>``)
+produced a **severely broken floor** - a flickering checkerboard/triangle mess
+- when added to a world created with ``ground_plane=True`` (the default). Two
+coplanar infinite ground planes at z=0 with different checker materials
+(``grid_mat`` vs the robot's ``groundplane``) caused depth-buffer Z-fighting.
+The artifact corrupted rendered videos, camera observations fed to policies,
+and demos, with no error raised.
+
+``SpecBuilder.attach_robot`` now strips plane geoms from the robot scene MJCF
+before attaching it, so exactly one world-owned ``ground`` plane survives. The
+world ``ground`` plane (configurable via ``create_world(ground_plane=...)``)
+is the single source of truth; robots contribute only their own
+bodies/joints/actuators/sensors.
+
 ## Unreleased - #228 (AWS IoT provisioning hardening)
 
 ### Changed: default presigned-URL TTL for camera offload
@@ -39,8 +58,7 @@ Applies to ``strands_robots.mesh.iot.provision`` and
   ``re.fullmatch``) applied symmetrically across ``provision_robot``,
   ``provision_operator``, and ``teardown_thing``. Rejects path
   separators, dots, spaces, NUL, non-ASCII, and trailing
-  ``
-``/````/``	``. Pre-existing AWS IoT Things containing ``:``
+  ``\n``/``\r``/``\t``. Pre-existing AWS IoT Things containing ``:``
   must be renamed (we deliberately reject ``:`` due to NTFS / classic
   Mac filesystem semantics).
 - **IoT policy scope** — robot/operator policies use explicit

README.md

@@ -580,6 +580,7 @@ agent.tool.gr00t_inference(action="stop", port=8000)
 | `STRANDS_MESH_AUDIT_DIR` | Directory for the safety audit log (`mesh_audit.jsonl`) | `~/.strands_robots/` |
 | `STRANDS_MESH_CA_PINS` | Comma-separated SHA-256 hex pins, **additive** to the bundled Amazon Root CA1 pin tuple. Operator break-glass for an AWS-side root rotation that arrives before the next `strands-robots` release ships the new pin. Must match `^[0-9a-fA-F]{64}$` per entry. | unset |
 | `STRANDS_MESH_DISABLE_CA_PIN` | Set to `true` (case-insensitive) to skip CA pin verification on the *download* path only. The on-disk re-use path always raw-checks the pin regardless. Last-resort break-glass; prefer `STRANDS_MESH_CA_PINS` for rotations. | `false` |
+| `STRANDS_MESH_CAMERA_DISABLED` | Privacy kill-switch. Set truthy (`true`/`1`/`yes`/`on`, case-insensitive) to short-circuit the mesh camera publish loop before any frame is collected, encoded, or uploaded. Invalid values raise `ValueError`. | `false` |
 | `STRANDS_MESH_CAMERA_PRESIGN_TTL` | Default TTL (seconds) for S3 presigned URLs emitted on the IoT camera-offload path. Capped at 3600s (1h); a `0` is clamped to 1s. Non-integer values fall back to the default with a WARNING. | `60` |
 | `GROOT_API_TOKEN` | API token for GR00T inference service | - |
 | `STRANDS_ROBOT_MODE` | Override `Robot()` factory mode detection (`sim`, `real`, `auto`) | `auto` |
@@ -592,6 +593,45 @@ agent.tool.gr00t_inference(action="stop", port=8000)
 | `STRANDS_GROOT_WIRE_LOG` | Path to a directory where `Gr00tPolicy` will dump pre-inference observations + post-inference action chunks as pickle files (one per `get_actions` call, named `{local,service}_call{N:04d}.pkl`). Used by the #187 bisection plan to verify whether LOCAL and SERVICE inference paths send byte-identical observations to the model. Run an eval once with each mode into the same dir, then `np.allclose` matching files. | unset |
 | `STRANDS_GROOT_WIRE_LOG_MAX_CALLS` | Cap on number of wire-payload dumps per process when `STRANDS_GROOT_WIRE_LOG` is set. Prevents multi-GB pickle archives on long evals. The first few calls are enough to bisect a divergence. | `10` |
 
+### CA Pin Rotation Runbook
+
+The IoT provisioner downloads `AmazonRootCA1.pem` over HTTPS and pins its
+SHA-256 fingerprint (`strands_robots/mesh/iot/provision._AMAZON_ROOT_CA1_PINS`)
+before trusting the bytes. Because the pin is static, an AWS-side root CA
+rotation needs an operational plan. On-call at 3 AM should follow this runbook,
+not reverse-engineer it from a docstring.
+
+**Recompute the pin** (run when AWS publishes a new root, or to verify the
+current one):
+
+```bash
+python -c "import hashlib, urllib.request as u; \
+print(hashlib.sha256(u.urlopen( \
+'https://www.amazontrust.com/repository/AmazonRootCA1.pem' \
+).read()).hexdigest())"
+```
+
+**Grace-period strategy (dual-pin).** `_AMAZON_ROOT_CA1_PINS` is a tuple, so a
+rotation lands as two releases:
+
+1. Ship a release whose tuple contains **both** the new pin and the old pin.
+   `_resolve_ca_pins()` accepts any pin in the set, so fleets on the old root
+   and fleets that have already seen the new root both verify successfully.
+2. Wait for fleet uptake (track your own deploy rollout; there is no flag day).
+3. Ship a follow-up release that drops the old pin once every fleet member has
+   upgraded and AWS has retired the old root.
+
+**Monitor for upcoming rotations.** Subscribe to AWS security bulletins
+(https://aws.amazon.com/security/security-bulletins/) and the Amazon Trust
+Services repository; AWS publishes root CA deprecation timelines ahead of time.
+
+**Emergency override.** If a rotation lands faster than a code release can ship,
+operators stage the new pin out-of-band via `STRANDS_MESH_CA_PINS`
+(comma-separated 64-char lowercase hex). It is **additive** to the built-in
+tuple, so the old pin keeps working during the overlap. Prefer this over
+`STRANDS_MESH_DISABLE_CA_PIN`, which disables pinning entirely on the download
+path and should be a last resort.
+
 ### Mesh Networking
 
 Every `Robot()` and `Simulation()` constructed in a process is automatically a

strands_robots/mesh/_acl_config.py

@@ -41,6 +41,22 @@
 
 logger = logging.getLogger(__name__)
 
+
+class PermissiveACLError(RuntimeError):
+    """Raised when an operator-supplied ACL uses the blacklist footgun
+    (``default_permission='allow'`` with explicit rules) without opting
+    in via ``STRANDS_MESH_ACCEPT_PERMISSIVE_ACL``. Pentest B-08 / F-14.
+
+    The built-in permissive default (allow + EMPTY rules) is exempt --
+    it is gated separately by the ``Mesh.start`` refuse-to-start path
+    (:meth:`Mesh._refuse_under_permissive_default_acl`) which fires under
+    mTLS. This error closes the *operator-file blacklist* footgun: a
+    hand-written ``allow + rules`` ACL is an explicit, load-bearing
+    anti-pattern that should fail loud rather than silently expose any
+    rule gap.
+    """
+
+
 #: Maximum bytes of an ACL file we will load. Anything larger is almost
 #: certainly an attacker probing for an OOM.
 ACL_FILE_MAX_BYTES: int = 256 * 1024
@@ -202,6 +218,29 @@ def _load_acl_file(path: Path) -> dict[str, Any]:
                 path,
                 len(data["rules"]),
             )
+            # B-08 / F-14: the warning above is the first-line signal; this
+            # is the hard gate. An operator-supplied blacklist ACL
+            # (allow + explicit rules) is a load-bearing anti-pattern --
+            # any gap in the rule set exposes the mesh. Refuse to load it
+            # unless the operator has explicitly acknowledged the posture
+            # via STRANDS_MESH_ACCEPT_PERMISSIVE_ACL. The built-in default
+            # (allow + EMPTY rules) does not reach this branch and stays
+            # gated by Mesh.start's refuse-to-start path.
+            accept = os.getenv("STRANDS_MESH_ACCEPT_PERMISSIVE_ACL", "").strip().lower() in (
+                "1",
+                "true",
+                "yes",
+            )
+            if not accept:
+                raise PermissiveACLError(
+                    f"ACL file {path} uses default_permission='allow' with "
+                    f"{len(data['rules'])} rule(s) -- a blacklist policy where any "
+                    "rule gap exposes the mesh. Refusing to load. Remediate one of:\n"
+                    "  1. Rewrite the ACL with default_permission='deny' and "
+                    "explicit allow rules (see examples/mesh_acl_example.json5).\n"
+                    "  2. Set STRANDS_MESH_ACCEPT_PERMISSIVE_ACL=1 to acknowledge "
+                    "the dev/lab posture."
+                )
     _validate_acl_shape(data, path)
     return data
 

strands_robots/mesh/core.py

@@ -1042,7 +1042,14 @@ def _exec_cmd(self, data: dict[str, Any]) -> None:
         # {"action":"execute",...}. Outgoing send/broadcast/tell still accept
         # the ergonomic dict-or-string forms because tell() wraps internally.
         #
-        rkey = f"strands/{sender}/response/{turn}" if sender else None
+        # F-15 / B-09: include the responder's own peer_id as a topic
+        # segment so the IoT robot policy can scope publish to
+        # ``strands/+/response/${ThingName}/*`` -- a robot can only
+        # publish responses tagged with its OWN ThingName, closing the
+        # cross-robot response-spoof surface. The requester subscribes
+        # with ``response/**`` so the extra segment matches. Operator
+        # prefix (``{sender}``) is unchanged so routing is preserved.
+        rkey = f"strands/{sender}/response/{self.peer_id}/{turn}" if sender else None
         if cmd is None or not isinstance(cmd, dict):
             # route non-dict envelope rejection
             # through the same audit + wire-response path as

strands_robots/mesh/input.py

@@ -25,6 +25,7 @@
 from collections.abc import Callable
 from typing import TYPE_CHECKING, Any
 
+from strands_robots.mesh.security import ValidationError, validate_input_frame
 from strands_robots.mesh.session import put
 
 if TYPE_CHECKING:
@@ -202,6 +203,7 @@ def __init__(
         self._error_count = 0
         self._last_seq = -1
         self._drops = 0
+        self._rejected = 0
         self._start_time = 0.0
 
     def __repr__(self) -> str:
@@ -222,6 +224,7 @@ def stats(self) -> dict[str, Any]:
             "frames_received": self._frame_count,
             "errors": self._error_count,
             "drops": self._drops,
+            "rejected": self._rejected,
             "hz_actual": self._frame_count / elapsed if elapsed > 0 else 0,
         }
 
@@ -271,7 +274,25 @@ def _on_input(self, topic: str, data: dict[str, Any]) -> None:
             if self._last_seq >= 0 and seq > self._last_seq + 1:
                 self._drops += seq - self._last_seq - 1
             self._last_seq = seq
-            self._apply_fn(self.robot, action)
+            # B-04 / F-02: validate the teleop frame before it reaches
+            # send_action(). A LAN-adjacent peer that discovers this
+            # source peer_id could otherwise drive the follower's joints
+            # directly with unbounded / non-finite values. validate_input_frame
+            # bounds key count, key charset, and clamps each value to a
+            # finite magnitude. Rejected frames are counted + logged and
+            # dropped (never applied) rather than crashing the receiver.
+            try:
+                safe_action = validate_input_frame(action)
+            except ValidationError as verr:
+                self._rejected = getattr(self, "_rejected", 0) + 1
+                if self._rejected <= 5:
+                    logger.warning(
+                        "[mesh] input frame rejected from %s: %s",
+                        self.source_peer_id,
+                        verr,
+                    )
+                return
+            self._apply_fn(self.robot, safe_action)
             self._frame_count += 1
         except Exception as exc:
             self._error_count += 1