| # Security interfaces and limits |
|
|
| This guide describes checks in the source and where callers must apply them. It is not a security certification. |
|
|
| ## Path boundaries |
|
|
| [PathJail.resolve](../src/core/path_jail.py) resolves a path and checks membership under configured roots, rejects control characters, and checks selected Windows device names. Use the returned path for the operation. |
|
|
| ### Local example |
|
|
| ```python |
| from pathlib import Path |
| from tempfile import TemporaryDirectory |
| from src.core.path_jail import PathJail, PathJailError |
| |
| with TemporaryDirectory() as directory: |
| root = Path(directory).resolve() |
| jail = PathJail([root]) |
| assert jail.resolve(root / "example.txt") == root / "example.txt" |
| try: |
| jail.resolve(root.parent / "outside.txt") |
| except PathJailError: |
| print("outside path rejected") |
| else: |
| raise AssertionError("expected rejection") |
| ``` |
|
|
| This check is not an OS sandbox and does not make a later file open atomic with validation. Handlers in [loader.py](../src/tools/loader.py) must be inspected individually; constructing a jail in the engine does not route all filesystem calls through it. |
|
|
| ## Network boundaries |
|
|
| `SSRFGuard.check_url` checks URL scheme and hostname text against blocked hosts/prefixes. It does not resolve DNS and revalidate the actual destination or follow-up redirects. It is not a complete DNS-rebinding defense. |
|
|
| The HTTP bridge installs wildcard CORS and has no authentication middleware in its current route setup. `/tool/execute` invokes handlers directly. Keep it on loopback for development; deployment requires authentication, authorization, request validation, and network-level restrictions. |
|
|
| ## Evidence ledger |
|
|
| [WORMLedger](../src/core/evidence.py) wraps the binary [WORMFile](../src/core/storage.py). `append(event_type, data, metadata)` is synchronous and accepts bytes, strings, dictionaries, or None. `scan()` yields records. `verify_chain()` reports chain validity. |
|
|
| Binary encoding does not eliminate malicious content or filesystem modification. Hash-chain verification is not interchangeable with verification of every signature against a trusted identity. Preserve signing-key provenance separately; the engine currently generates a new key during construction. |
|
|
| ## Tool approval |
|
|
| Risk classes and approval policies are metadata until the execution path enforces them. See [Tools](TOOLS.md). Review direct handler calls, native fallback, shell/code execution, and external service credentials as distinct boundaries. |
|
|
| ## Node capabilities and formal claims |
|
|
| [node_key.py](../sovereign/node_key.py) checks a nonempty capability file and active status if an authorization file exists. It does not verify expiry or signatures. The separate execution-gate script is incomplete at the documented baseline. The direct runner does not call it. |
|
|
| A theorem about a model does not certify the running application. The [formal sources](../research/formal/) include axioms, postulates, and admitted proofs; report specific checker results rather than a repository-wide proof claim. |
|
|
