Security model
The boundaries between data, authority, local processes and a future public service.
Status: Development. RURAL has bounded parser and ownership foundations, with a wider security design still to implement and verify. There is no accepted public service or security certification.
Data cannot grant itself authority
Imported repository text, analytics payloads, governance documents and model output are data. They must not become executable instructions or permission grants merely because a database stores them.
The application owner authenticates the actor, determines scope and authorizes the actual operation. The state engine's authorization epoch detects stale context; an epoch number is not an authentication token or an access-control system.
Branches retain history, not revoked permissions
Opening a historical world must not restore credentials or bypass current revocations. A child can have no broader capabilities than its allowed creation scope and current policy.
Copied action history must not activate jobs, resend a transaction or start external processes. Git worktrees share repository state and are not a sandbox. Execution isolation belongs to the host/runtime boundary.
Bound every resource path
Protocol foundations reject ambiguous lengths, duplicate critical fields, unsupported encodings and oversized inputs. The state layer bounds mutation sizes, branch identities and retained receipts.
Those checks do not supply the entire service boundary. Connection limits, deadlines, authenticated scopes, rate limits, current read authorization, queue fairness, logging limits and global memory/disk budgets still require integration.
The restricted HTTP parser opens no socket. Its bearer comparison helper does not issue credentials, rotate them, establish user identity or provide encryption. Public exposure requires a completed transport and operational security contract.
Integrity and durability are different controls
An unkeyed checksum can detect accidental frame changes. A writer able to replace a file can also recompute that checksum. It is not encryption, writer authentication or evidence of an authorized transaction.
The local journal assumes a trusted parent directory and cooperating owners using its OS lock. Other principals must not be able to replace live lock/data files. A network filesystem or an arbitrary external writer is outside that ownership contract.
Before a public release
Required evidence includes malformed-input and resource-exhaustion testing, branch/cache scope isolation, authorization revocation, recovery under full-disk conditions, restore behavior, transport interoperability and an independent boundary review.
No public security contact or hosted incident-response service is published at this checkpoint. Keep private findings within the repository's established reporting process until an external reporting channel is defined.