Safety and threat model
Treat operational evidence and model output as untrusted data while preserving local control and honest truth state.
Security invariants
- Deterministic local use requires no credential or network call.
- A model response is never a confirmed resolution or an executable action.
- High-risk or irreversible actions cannot enter core without human approval policy.
- Verification must follow any future execution before recovery is confirmed.
- No telemetry is exported by default.
Current controls
| Threat | Current control |
|---|---|
| Prompt injection | Evidence is data; models receive no core execution tools. |
| Secret leakage | Conservative recursive redaction, environment-variable secret references, and explicit model opt-in. |
| Hostile YAML | safe_load, strict schemas, and a one-MiB limit. |
| Oversized inputs | Ten-MiB CLI log limit; bounded evidence items, characters, and response bytes. |
| Model hallucination | Schema validation, evidence separation, deterministic fallback, unconfirmed truth. |
| Forged webhooks | Constant-time HMAC, timestamp skew limits, strict delivery IDs, fail-closed replay guard. |
| Malicious plugins | Metadata-only discovery, manifest validation, default-denied sensitive authorities, explicit load policy. |
| Unapproved actuation | No core executor; proposals expire and carry execution_allowed=false. |
| Silent telemetry | No remote telemetry adapter or default export. |
| Hostile YAML structure | Aliases rejected; nesting depth capped at 64 nodes before model validation. |
| Supply-chain tampering | SPDX SBOMs, signed provenance attestations, reproducible-build comparison, artifact content validation, secret scanning, and Trusted Publishing. |
A recorded security and authority review accompanies the Phase 1 release, and dependency and license review runs on every pull request.
Report vulnerabilities
Do not disclose active vulnerabilities in a public issue. Follow the repository SECURITY.md process and provide impact, affected versions, reproduction details, and mitigation ideas privately.