# Security model

## Enforced now

- Tenant keys are stored as salted scrypt derivations.
- Card assignments, memory, and receipts are tenant-scoped.
- Card archives have a four-file allowlist and reject executable members.
- Checksums and Ed25519 signatures cover every declarative package payload.
- Production trust policies can restrict accepted signer fingerprints.
- Adapter cards cannot carry local model or weight paths. Operators register
  private PEFT directories separately, and the backend recomputes the declared
  config-plus-weights hash before activation.
- Local Hugging Face directories require path-free receipt labels. vLLM model
  selection is fixed by the configured base or a signed adapter card; caller
  metadata cannot substitute a served model.
- Typed adapter envelopes reject duplicate or extra keys, mismatched operators,
  terms, prompts, types, and oversized payloads. A term appearing in user text
  does not activate an adapter.
- Request body, generation length, rate, concurrency, card state, latency, and
  residual magnitude have explicit bounds.
- Activation hooks run under a model mutation lock and are removed before the
  next stack executes.
- Expected service errors cross the API boundary without stack traces.
- Management endpoints fail closed when no management token is configured.

## Not yet a security boundary

- A Python process is not a sandbox for arbitrary third-party Python. Backplane
  therefore does not load Python from card archives.
- A manifest is not proof that an arbitrary native extension obeys its declared
  permissions.
- Residual steering is not a certified guardrail.
- SQLite provides single-node isolation, not hostile multi-tenant process
  containment.
- The public demo backend validates the control plane, not model safety.

## Third-party card path

Executable third-party cards should not be enabled until an out-of-process or
WASM ABI exists with:

- no ambient filesystem or network access;
- capability-based lane handles;
- deterministic memory and time quotas;
- signed publisher identity;
- revocation;
- conformance and adversarial tests;
- process-level failure containment.

Report security issues privately to `justin@cyberelf.link`.

