feat(haystack): add Serialization Boundary Evasion sandbox, interactive trainer, and tutorial (JDP-2026-005)

[JDP-Security]

Summary

Adds a complete containerized lab environment, interactive CLI trainer, exploit payloads, and documentation demonstrating the Haystack Serialization Boundary Evasion vulnerability (JDP-2026-005) in haystack-ai v2.27.0.

This module aligns with OWASP LLM06 (Excessive Agency) and OWASP ASI02 (Tool Misuse), demonstrating how unvalidated init_parameters in default_from_dict() allow an untrusted YAML pipeline payload to mutate unsafe=False to unsafe=True and achieve persistent Remote Code Execution (RCE).

---

What's Included

• Local Sandbox (sandboxes/agentic_local_haystack/)

  • Containerized Flask API (server.py) running haystack-ai v2.27.0.
  • Exposes /chat (pipeline deserialization sink) and /verify (integrity verification) endpoints.
  • Includes Containerfile and Makefile (make clean, make attack).

• Exploitation & Training Suite (exploitation/haystack/)

  • interactive_trainer.py: Menu-driven CLI wizard with 6 interactive lessons (Baseline, YAML Bypass, Full RCE, Scope Change, Mitigation Limitations, and Attack Vectors) plus --auto mode.
  • payloads/: Pre-built YAML/JSON exploit definitions for OutputAdapter and ConditionalRouter.
  • submission_audit.md: Detailed audit and proof-of-concept validation report.

• Tutorials & Documentation (tutorials/ & README.md)

  • haystack_orchestration_security_tutorial.md: Comprehensive theoretical break-down, vendor/researcher perspective analysis, and remediation strategies.
  • Top-level README.md: Updated index entry linking the Haystack sandbox and trainer suite.

---

Verification & Testing

1. Built and launched container via make -C sandboxes/agentic_local_haystack attack.
2. Verified initial /verify state returns clean.
3. Executed automated pass using ./exploitation/haystack/interactive_trainer.py --auto.
4. Confirmed unsafe flag bypass, Jinja2 SSTI execution, and persistent framework compromise via haystack/__init__.py overwrite.