File size: 3,077 Bytes
e547dfd | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 | # Security interfaces and limits
This guide describes checks in the source and where callers must apply them. It is not a security certification.
## Path boundaries
[PathJail.resolve](../src/core/path_jail.py) resolves a path and checks membership under configured roots, rejects control characters, and checks selected Windows device names. Use the returned path for the operation.
### Local example
```python
from pathlib import Path
from tempfile import TemporaryDirectory
from src.core.path_jail import PathJail, PathJailError
with TemporaryDirectory() as directory:
root = Path(directory).resolve()
jail = PathJail([root])
assert jail.resolve(root / "example.txt") == root / "example.txt"
try:
jail.resolve(root.parent / "outside.txt")
except PathJailError:
print("outside path rejected")
else:
raise AssertionError("expected rejection")
```
This check is not an OS sandbox and does not make a later file open atomic with validation. Handlers in [loader.py](../src/tools/loader.py) must be inspected individually; constructing a jail in the engine does not route all filesystem calls through it.
## Network boundaries
`SSRFGuard.check_url` checks URL scheme and hostname text against blocked hosts/prefixes. It does not resolve DNS and revalidate the actual destination or follow-up redirects. It is not a complete DNS-rebinding defense.
The HTTP bridge installs wildcard CORS and has no authentication middleware in its current route setup. `/tool/execute` invokes handlers directly. Keep it on loopback for development; deployment requires authentication, authorization, request validation, and network-level restrictions.
## Evidence ledger
[WORMLedger](../src/core/evidence.py) wraps the binary [WORMFile](../src/core/storage.py). `append(event_type, data, metadata)` is synchronous and accepts bytes, strings, dictionaries, or None. `scan()` yields records. `verify_chain()` reports chain validity.
Binary encoding does not eliminate malicious content or filesystem modification. Hash-chain verification is not interchangeable with verification of every signature against a trusted identity. Preserve signing-key provenance separately; the engine currently generates a new key during construction.
## Tool approval
Risk classes and approval policies are metadata until the execution path enforces them. See [Tools](TOOLS.md). Review direct handler calls, native fallback, shell/code execution, and external service credentials as distinct boundaries.
## Node capabilities and formal claims
[node_key.py](../sovereign/node_key.py) checks a nonempty capability file and active status if an authorization file exists. It does not verify expiry or signatures. The separate execution-gate script is incomplete at the documented baseline. The direct runner does not call it.
A theorem about a model does not certify the running application. The [formal sources](../research/formal/) include axioms, postulates, and admitted proofs; report specific checker results rather than a repository-wide proof claim.
|