Assurance · section 11b

Reliability, control and security

The architecture is judged on three promises. Each row names the promise, the mechanism that keeps it, the ontology objects involved and the file that proves it exists. Open items are marked, never hidden.

Reliability — it keeps running and it never lies about state

PromiseMechanismObjectsBacking
Services come back after a crash or rebootpodman restart policies + podman-restart.service (Linux) / launchd (Mac); console under systemdServiceRole, NativeConsoleappliance.yml, install.sh
A lifecycle mutation cannot half-completejournaled CAS lifecycle.operation; generation volumes; roll-forward promotion; recovery of up:claimedLifecycleOperation, VolumeSetappliance/bin/kos
Data survives and moveskos backup/restore with ownership kept; exact-count parity checks; the volumes are liftableBackupSnapshot, VolumeSetdocs/guides/backup-restore.md, APPLE_TO_PODMAN_MACOS_MIGRATION.md
Schema changes are exactmigration ledger with checksums (kos_appliance_schema_baseline_migrations, kos_app_schema_migrations); refuses unknown rowsLifecycleOperationappliance/migrate.py
A stuck run does not stall dispatchdispatch lease expiry → watchdog auto-requeue; retry cap → CONSULT escalation; dead-run reclaimDispatchLease, Handoff, TeamEventorchestrator.py, watchdog.py
A completion is not a claimthe reviewable return protocol + the evidence floor (harness "completed" with no evidence → partial)CompletionHandback, EvidenceFloor.agents/api/main.py
Memory stays freshwork-product freshness by hash; retention tiers; ingest updates clear stale embeddings (KD-7)WorkProduct, RetentionTier, Knowledgerun_agent.py, main.py
A green suite is not evidencereal-engine gate on a fresh host (kos-test) before any releasePackageChannel, HostFamilyTHE_WAY §14, design 26

Control — a human stays in charge of what runs, where, and with what money

PromiseMechanismObjectsBacking
One place configures the appliancethe control-volume contract; every consumer reads it, nothing is bakedContractbin/kos CONTRACT_KEYS
Who may act is data, not a guessactor model + roles; designation (interactive / autonomous / deterministic); persona registry planned (E014)Actor, Role, Agentcortex_actors, app/domain/roles.py
Nothing dispatches by surprisepropose-mode parking; interactive holds announced once; auto_dispatch per agent; wave gating per epicHandoff, DispatchLease, Epicorchestrator.py
No one approves their own workdelegator ≠ worker on the return protocol; handbacks route to a visible reviewerCompletionHandbackhandback_recipient
Projects do not leakcross-project isolation with a one-off CTO override that never cross-registersProject, Handoffcortex-handoff --cto-override
Spend and capability are gatededition (structural) → entitlements (six gates) → Manifold key mint and spend reservationsEdition, Entitlement, Grant, SpendReservationapp/edition.py, app/license.py, Manifold
Provider credentials have one ownerOpenKai owns its store; KOS projects and tests itKOSProjection, Provideropenkai_provider_config.py
The operator sees the raw truthterminal-first: the PTY byte stream is the surface, never a reconstructionHarness, NativeConsoledesign 27, app/terminal_stream/

Security — the layers, and what each one refuses

L4mTLS service identityhosted platform onlyL3passwordless login + passkeysevery consoleL2Tailscale + TLS, loopback-only publishesremote accessL1hashed named tokensevery Cortex callRLSrow-level security, FORCE everywherethe substrateProcessservice user · bwrap sandbox · SELinuxthe appliance host
LayerRefusesObjectsBacking
L1 hashed named tokensany caller without a token; the legacy default tokenCortex API, Contractadmin_tokens, secrets.compare_digest
L2 Tailscale + TLSLAN and internet exposure; services publish on loopback onlyAppliancetailscale serve, appliance.yml
L3 passwordless login + passkeyspassword reuse and phishing; first admin only through the bootstrap tokenAuthapp/auth.py
L4 mTLS (platform)unauthenticated service-to-service calls on the hosted platformcortex-servicedocs/design/09-security-architecture.md
RLS substratecross-tenant reads on the platform; FORCE RLS everywhereOrganization, Projectrls_context.py
Process boundaryagent code escaping its sandbox (bwrap); the console running as rootHarnessInstall, NativeConsoleharness_runner.py, install.sh
Secret custodysecrets in code, in the browser, or in imagesContractTHE_WAY, bin/kos
Open workSEC-04 per-user scoping of terminal routes · SEC-05 backup encryption · sandbox on Ubuntu (AppArmor)tasklist C1–C4

Appliance security posture

ConcernMechanismBacking source
Who runs the consolea dedicated non-root service user; systemd hardening on Linuxinstall.sh unit generation
Who runs agent codeharness child processes of the console user, sandboxed with bwrap where the distro permits unprivileged user namespaces (Fedora/RHEL: yes); interactive Leads are never sandboxed by designationharness_runner.py _agent_full_access, _run_bwrap_probe
Where services listenloopback-only published ports; nothing on the LAN; remote access through L2 (Tailscale + TLS)appliance/appliance.yml 127.0.0.1: publishes
Where secrets livethe control volume contract (0600) and the console's runtime env; never the browser, never codebin/kos contract, docs/CURRENT_ARCHITECTURE_AND_RELEASE.md
Data at restnamed volumes; backups carry the databases (encryption of backups is open work SEC-05)kos backup
Provider credentialsOpenKai owns its store; KOS only projects and testsapp/openkai_provider_config.py