# RFC 0008: Security Responsibility and Capability Model

- **Status:** accepted for architecture-proof preview
- **Review trigger:** any remote listener, default policy, or sandbox claim

## Threat boundary

Spice annotations/tools, compiled extension modules, providers, in-process tools,
and runtime plugin executables are trusted code selected by Go module or explicit
digest configuration. Process separation, local authentication, capability
metadata, and digest pinning are not sandboxes.

The architecture-proof distribution deliberately gives coding tools the current
user process's privileges. It must warn on first run and in help/health output
that no permission or sandbox extension is active. Marketing and documentation
may not imply containment that the implementation does not enforce.

## Canonical interception

Every compiled or runtime tool call traverses one typed dispatcher. Definitions
declare exact filesystem read/write, process, network, secret, and environment
capabilities. A future permission decorator can inspect definition, call,
workspace, run, and interaction facts and deny before execution. Tools cannot
publish an alternate executable route or event directly.

Each run uses one immutable leased definition snapshot. The guard rejects tool
names outside that snapshot even if a mutable or malicious delegate later
advertises or accepts them. Decorators cannot change the merged definition set,
and source/decorator panics are converted to bounded diagnostics without
including recovered values. Plan IDs are integrity identities, not trust or
sandbox claims, and must never be reused for different executable behavior.

Capability data is immutable, bounded, deterministic, and covered by generated
composition tests. It is useful for UI disclosure and policy input but provides
no enforcement until an explicit policy bean is installed.

Effect and replay metadata are also mandatory policy inputs, not inferred
security guarantees. Definitions marked read-only fail closed if they request
filesystem write, process execution, network access, or environment write.
Capabilities are a set with canonical order, so source declaration order cannot
change fingerprints, snapshots, or policy decisions. Replay-safe is reserved
for read-only work; mutating tools must explicitly choose idempotent or unsafe.

## Secrets and sensitive data

Credentials originate in secret-redacted typed configuration and are passed only
to the owning constructor/client. They are prohibited from:

- generated source and ownership manifests;
- compatibility/starter manifests, SBOMs, signatures, and provenance;
- errors, ordinary logs, events, snapshots, replay, plugin manifests, and TUI
  diagnostics;
- command argv or environment unless an explicit tool contract and policy allow
  it.

Provider metadata uses explicit namespace allowlisting and a documented safe
field set. Unknown headers/provider payloads are dropped, not forwarded.
Interaction events carry only identity, kind, and lifecycle status. Prompt text,
schemas, approvals, secrets, and user-entered response JSON never enter the
event log or replay stream; the validated response is returned directly to the
requesting stage.

## Local daemon and plugins

Daemon endpoints and tokens are current-user only. This reduces accidental
cross-user access but does not protect against malicious code already executing
as the same user. Remote listen is absent. Plugin paths are absolute and digest
pinned with random per-launch secrets; candidates validate before activation.

## Supply chain

All modules pin exact direct/tool dependencies, commit reproducible vendor data,
verify with `GOWORK=off`, scan reachable vulnerabilities, and audit GitHub
manifest alerts. Releases are reproducible, signed, checksummed, SBOM-backed,
and covered by protected immutable tags and private vulnerability reporting.

## Failure and uncertainty

Cancellation does not prove a mutating operation had no effect. File replacement
reports commit separately from durability. Lost process/plugin acknowledgement
reports uncertain termination/outcome. Automatic replay is forbidden unless the
operation contract proves it did not begin or is independently idempotent. A
typed uncertain execution error can only describe a mutating tool and always
declares retry forbidden. A definitive failure may declare retry eligible only
when the tool's replay contract is not unsafe; no core dispatcher performs that
retry by itself.

## Rejected claims

- "Runs in another process" is not isolation.
- "Inside a configured worktree" is not filesystem containment for child code.
- A capability declaration is not permission enforcement.
- Redaction after logging is insufficient; sensitive values must not enter the
  event/log value in the first place.

## Acceptance

Security tests scan generated/release artifacts for canary secrets, prove all
tool routes hit a dispatcher decorator, verify endpoint permissions and digest
changes, exercise process/plugin uncertain outcomes, and audit standalone module
graphs. The phase 7 permission prototype must intercept every executable route
without changing the kernel.