Security

Trust model

Every operation is limited by the intersection of local device scope, device policy, Agent authorization and approval policy.

Management sessions administer an account. Agent credentials can only use their bound authorization.
Device requests are signed with a local Ed25519 key, timestamp and one-time nonce.
Filesystem operations validate canonical paths and symlink boundaries again on the device.

Important limitation

Restricted process mode is a guardrail, not a sandbox. Full device trust disables command and protected-path filters.

Device private keys currently use a mode-0600 file. Keychain and keyring support is not implemented.

The control plane stores exposed path names, invocation arguments, returned results, artifacts and audit metadata.

It does not hold the device private key or proactively crawl the filesystem. An authorized result may still contain sensitive data.

Threat	Control	Residual risk
Stolen access key	Access keys are hashed, expire and bind to one revocable authorization.	A copied access key remains usable until it expires or is revoked.
Compromised device key	Every request uses an Ed25519 signature, timestamp and durable one-time nonce.	A stolen private key remains valid until the device is revoked.
Path escape	Canonical paths, realpath, no-follow opens and descriptor identity checks are enforced locally.	Portable APIs cannot eliminate every hostile parent-directory race or hard-link alias.
Duplicate side effect	Stable idempotency keys and a fsynced local ledger prevent automatic duplicate execution.	A crash after the effect but before its receipt is reported as unknown_outcome.
Sensitive output	Protected paths, bounded output and common secret patterns are filtered in restricted mode.	Redaction is best effort and cannot prove arbitrary authorized content is safe.

Verified in automation and preview

Not yet certified