Ontology · domain 7

Tenancy & Security — the substrate

Rebrand invariant: the user-facing product term is Kaidera / Kaidera OS. Legacy engen identifiers (schema, roles, key ids, manifest keys) are machine …

3 objects · 0 links · 0 actions

Objects · every one cites its backing source

Organization

organizations (03-shared)

license_tier ∈ {base, developer, enterprise} (compat field)

Project (platform)

projects

org → projects → agents

RLSPolicy

Postgres RLS, FORCE everywhere

transaction-local GUCs app.current_org_id + app.rls_mode ∈ {system, platform, tenant} via rls_context.py; per-domain schemas/roles (public, manifold+manifold_app_dml, license schema + its DML role — legacy engen_os namespace)

Notes, laws and mechanics

4-layer security architecture (`docs/design/09-security-architecture.md`)

Layer	What	Ownership	Deployment
L1	SHA-256-hashed named tokens (`admin_tokens` table; `secrets.compare_digest`; legacy `cortex-local-admin` rejected)	Console	every install
L2	Tailscale + Let's Encrypt TLS (`tailscale serve`, loopback-only binding)	Deployment/operator	remote VM only
L3	Passwordless console login — email code/link + optional WebAuthn passkeys (`auth_users/sessions/email_challenges/passkeys/audit_events`)	Console	self-contained VM; local Mac = OS account
L4	PKI / mTLS service-to-service identity (step-ca, 24h certs)	Platform	multi-tenant platform only

Design principles: defense in depth · independent ownership · progressive deployment · no plaintext secrets · minimal external dependency.

Appliance security posture (R5)

Concern	Mechanism	Backing source
Who runs the console	a dedicated non-root service user; systemd hardening on Linux	`install.sh` unit generation
Who runs agent code	harness child processes of the console user, sandboxed with `bwrap` where the distro permits unprivileged user namespaces (Fedora/RHEL: yes); interactive Leads are never sandboxed by designation	`harness_runner.py` `_agent_full_access`, `_run_bwrap_probe`
Where services listen	loopback-only published ports; nothing on the LAN; remote access through L2 (Tailscale + TLS)	`appliance/appliance.yml` `127.0.0.1:` publishes
Where secrets live	the control volume contract (0600) and the console's runtime env; never the browser, never code	`bin/kos` contract, `docs/CURRENT_ARCHITECTURE_AND_RELEASE.md`
Data at rest	named volumes; backups carry the databases (encryption of backups is open work SEC-05)	`kos backup`
Provider credentials	OpenKai owns its store; KOS only projects and tests	`app/openkai_provider_config.py`

Cortex-level governance (KOS)

Cross-project isolation: no reads/writes outside your project without explicit one-off CTO override
API-only writes: never psql against Cortex — with ONE sanctioned exception, the KOS lifecycle lane (kos backup / kos restore / install use pg_dump and pg_restore; E021 boundary; see the Deployment & Runtime section)
No self-approval: proposer ≠ approver for schema/policy/action changes
Admin token in local-cortex/.env (600-perm), backend-only, never to browser

4-layer security architecture (docs/design/09-security-architecture.md)

Appliance security posture (R5)

Cortex-level governance (KOS)

4-layer security architecture (`docs/design/09-security-architecture.md`)