Compatibility: Pactmark 0.1.x. This model covers the portable kernel, adapters, local release path and tested reference hosts. It does not replace an operator’s deployment-specific assessment. A green test applies only to its exact fixture and environment.

​
Trust boundaries

Figure 1. Nine crossings where untrusted input becomes trusted only after an explicit check. Every row in the register below sits on at least one of them.

​
Severity and evidence discipline

Severity uses critical, high, medium and low. Every high or critical item carries an owner, executable or inspection evidence, and a residual-risk statement. The residual-risk column is the one worth reading closely — it is where the honest limits live.

​
High and critical register

Controls. The model has no authority; exact AgentDefinition and WorkOrder binding; default-deny policy with a per-effect recheck.Evidence. Core identity, runtime command and policy adversarial suites.Owner and residual risk. Runtime and policy maintainers. An allowed model action can still be undesirable inside an over-broad host grant.
Controls. Returned content is untrusted; bounded context admission; explicit purpose, data and egress profiles; no automatic grants.Evidence. Context and resource limits, malicious metadata and egress denial fixtures.Owner and residual risk. Host integrator. Semantic manipulation inside admitted data remains a model risk.
Controls. Tool schema, security metadata, factory and executor source, and implementation version all contribute to the registration digest; same-version drift fails.Evidence. Registration-source and same-version drift gates.Owner and residual risk. Tool owner. A malicious implementation can still act within its declared and granted scope.
Controls. Authority binds tenant, principal and purpose; one-use reservations; every storage path and effect checks exact bindings.Evidence. Authorisation reservation, cross-tenant, credential and command-replay tests.Owner and residual risk. Identity and host owner. Incorrect upstream identity mapping remains external risk.
Controls. Authenticated DecisionChallenge; keyed opaque proof; atomic consumption with exact effect, grant and SecretRef bindings; expiry and role strength.Evidence. Approval and challenge replay, cross-tenant, wrong-role and zero-dispatch tests.Owner and residual risk. Decision-system owner. Human misunderstanding of an accurate preview remains possible.
Controls. Opaque ModelCredentialRef and SecretRef; resolution only in the bound adapter; sealed credential lifecycle; redaction canaries across all outputs.Evidence. Credential-boundary, secret, telemetry, public-surface and release audits.Owner and residual risk. Credential and adapter owners. A compromised host process or provider endpoint can still access authorised values.
Controls. Tenant identifier in every store path and index; authority-scoped idempotency; non-disclosing not-found behaviour.Evidence. Memory and Postgres contract suites, authenticated HTTP negative tests.Owner and residual risk. Store and host owners. Database superusers and operator mistakes require infrastructure controls.
Controls. Persisted effect preparation and acknowledgement; exact registered effect strategy; park uncertainty; reconciliation or separate compensation authority.Evidence. Crash-boundary matrix and a two-process acknowledged-effect proof.Owner and residual risk. Tool and runtime owner. No global exactly-once claim; external system truth may remain unavailable.
Controls. Canonical identifiers and paths; repeated decoding checks; physical symlink resolution; package-relative allowlists.Evidence. Property-based canonicalization plus sandbox traversal and symlink probes.Owner and residual risk. Policy and executor owners. Kernel or storage implementation flaws remain outside pure normalization evidence.
Controls. Normalized exact HTTPS origins; blocked address classes; DNS and redirect policy; injected egress broker; origin-bound credentials and limits.Evidence. Policy canonicalization, HTTP/MCP egress, loopback and metadata denial fixtures.Owner and residual risk. Egress and host owner. DNS rebinding and network-provider behaviour need deployment controls.
Controls. Pessimistic durable reservations for active time, calls, tokens, bytes and cost; provider output cap; uncertain calls retain maximum charge.Evidence. Resource-profile, admission, concurrency, crash and infinite-loop tests.Owner and residual risk. Runtime and operator. Estimator and price inputs can be conservative, stale or provider-dependent.
Controls. Database-time leases, fencing tokens, optimistic event sequence, atomic command unit of work, request-digest conflict.Evidence. Postgres concurrency, clock-skew, worker and duplicate-command tests.Owner and residual risk. Store and worker owners. Database outage and failover behaviour depends on the deployed service.
Controls. The reference fixture uses non-root, no network, no mounts or sockets, read-only root, tmpfs, dropped capabilities, no-new-privileges and hard resource bounds.Evidence. Container probes for secret, path, symlink, socket, network, fork, loop and output.Owner and residual risk. Deployment owner. The fixture is explicitly not production arbitrary-code isolation.
Controls. Pin server and transport identity and capabilities; treat discovery as unknown; exact tool metadata; bounded pages, process, output and time; cleanup.Evidence. MCP conformance, malformed discovery, stdio, HTTP and cancellation suites.Owner and residual risk. MCP and host owner. Production stdio requires a separately assessed SandboxAdapter.
Controls. Exact lockfile; lifecycle scripts denied by default; versioned allowlist; immutable action refs; offline advisory, licence, secret and workflow audits; no long-lived release token.Evidence. Lifecycle canary and supply-chain audit gates.Owner and residual risk. Dependency and release owners. Time-bound advisories and upstream compromise require live refresh and incident response.
Controls. Exact scope, version and internal dependencies; allowlisted staged packer; two byte-identical archives; frozen independent consumers; guarded publisher with anonymous-byte verification.Evidence. Pack, NodeNext/Bundler/Yarn/Bun, loopback registry, release-command tests, and v0.1.1 public-byte verification.Owner and residual risk. Release owner. Registry, maintainer-account and upstream compromise remain external risks.
Controls. Separate output schemas; metadata-only telemetry; explicit redaction; content absent by default; stable non-disclosing errors.Evidence. Redaction, secret-canary, telemetry, evidence, HTTP and audit tests.Owner and residual risk. Observability and evidence owners. Consumer-added exporters must preserve classification and retention.
Controls. Exact artifact, verifier and rubric bindings; bounded claim language; exception types cannot waive security controls; readiness separates local from external evidence.Evidence. Evidence and verifier suites, placeholder and public-doc checks, readiness review.Owner and residual risk. Maintainers and the downstream user. Human marketing or governance misuse cannot be prevented solely in code.

​
Additional medium risks

  • A third-party adapter ignores cancellation or a deadline.
  • Backup, retention, deletion or key rotation is incomplete across replicas.
  • A supported provider changes semantics without a versioned adapter update.
  • Denial messages become an enumeration oracle.
  • Performance degradation causes queue growth inside configured but overly generous bounds.
  • A maintainer account or external organisation setting is compromised.
These require bounded adapter contracts, deployment monitoring, access review, backup and restore drills, live advisory checks, protected release environments and incident response. They do not justify weakening a high or critical control.

​
Review triggers

Review this model for any new public package, persistence or protocol adapter, credential path, effect strategy, sandbox, hosted service, release mechanism, supported platform, data class, or externally verified deployment. Record accepted architecture changes in an ADR and in the applicable release-readiness record.

Security model

The control set these rows draw on.

Responsibility matrix

Which owners in this register are you.