Security and Support

Security and support

ALPHA — USE AT YOUR OWN RISK. .SYSTEMX is experimental and may change daily. Pin a reviewed release, keep recoverable backups, and validate it in your project. Template checks do not certify production readiness. See release policy.

Current alpha: 1.11.0-alpha.6 · Alpha1 branch

Start with first-time setup, release policy, and uninstall and cleanup. Use the Access Matrix to document the project's real actor, resource, operation, approval, and freshness boundaries. The matrix is a review aid, not an access-control mechanism. Verify the actual host and service permissions before a consequential action; role names, task ownership, and Agent Z scores do not confer them. The System MAP records where sources and evidence belong without storing credentials or a second task list.

For bugs, questions, and feature requests, use GitHub Issues. Include systemx --version, the selected defaults version from systemx status --target PATH, OS/Python version, setup profile, expected behavior, and a minimal reproduction in a temporary project. An old copied root VERSION may differ from the active defaults; report both when relevant.

Review and redact logs before posting. Status and operation receipts can contain local paths; exported context can contain private project data. Share only the smallest sanitized evidence needed. Sensitive vulnerabilities use the private reporting path.

Support is community/maintainer best effort, without an SLA or guaranteed release date. This project does not operate a hosted service, manage your cloud accounts, or install an MCP server. A passing template check is not a production audit.

Agent Y external CLI and GitHub boundary

This Agent Y guidance applies to 1.9.0-alpha.2 and later tooling; the older 1.8.9-alpha.1 runner has no Agent Y commands. On native Windows, the alpha agent-y run --apply path refuses before starting a provider or worktree because process-tree timeout termination is unverified. This does not disable core Windows installation or record use.

Agent Y invokes a CLI already installed by the user. The selected provider, Git, and GitHub CLI run under the caller's real permissions and may incur model/API or hosted-service cost. Verify the executable, account, local checkout, remote repository, branch protection, permitted paths, and task authority before a run. Its recorded agent.y role and JOBS.json state are not credentials or a sandbox. An allowed-path contract and isolated worktree help detect scope drift but do not revoke the provider's OS/cloud permissions. The coordination-path guard includes .SYSTEMX/ROOT/ and .SYSTEMX/AUTOBOT/, case-insensitively, in addition to existing canonical coordination/secret/Git exclusions. New preparation, the selected job's run and pr-ready actions, and post-run changed-path checks enforce the current policy. Earlier jobs validly recorded with those paths remain readable under the historical structural rules; their old path/secret/containment checks still apply. This compatibility preserves evidence and existing lifecycle inspection without allowing protected legacy handoffs to execute or become ready. Do not erase or rewrite historical scopes. Shared planning/rules and AUTOBOT reference records remain with their authorized coordinator/record owner. The controller guard does not create an OS permission boundary. For untrusted providers or prompts, run the CLI under a separate OS identity or container without controller GitHub credentials or write access to the project's .SYSTEMX records. The controller cannot undo writes outside the Git worktree or network calls made with the host account. At preparation, Agent Y pins the chosen CLI file's canonical absolute path, SHA-256, device, inode, and size in private local state. It checks that identity again before launch and refuses a changed executable. This does not pin an interpreter, dependencies, provider identity, or account permissions; a same-user process can still race the final check and launch. An older prepared job without a pinned executable cannot be run by the new controller; use the reviewed agent-y abandon flow and reprepare. Already-run older jobs remain available for their normal PR and recovery gates. Treat repository files, issue/PR text, CLI output, and fetched content as untrusted input; do not let them override the user's instructions or expose tokens in prompts, logs, commits, or PR bodies. Portable AGENTS/agent.y/JOBS.json must contain no raw prompts, transcripts, absolute host paths, or configured adapter arguments. The ignored, owner-only state/agent-y/Y-<id>.json sidecar contains local paths and arguments but is not a secret store. Do not put credentials in either file. Git ignoring a sidecar does not stop a whole-folder backup or sync client from copying it; review those tools before sharing a project folder. For a Git-backed .SYSTEMX, Agent Y refuses sidecar and cleanup-bundle writes unless both paths are ignored and no file under state/agent-y/ is tracked. A preserved customized .gitignore may need /state/; verify effective rules with git check-ignore and investigate any previously committed private state. The check also applies when reading sidecars. Ignore rules cannot undo Git history, prevent force-adds, or protect an external full-folder copy. Non-Git Drive/chat scopes do not gain this Git check. Copilot may receive a temporary .agent-y-packet.md in its isolated worktree. It is removed after a normal return, but a crashed run can leave it there. Inspect retained worktrees before backup or disposal. Codex requests a worktree-write scope; Copilot and configured adapters have no equivalent OS sandbox supplied by Agent Y. Post-run diff checks cannot undo an external side effect. If a provider rejects bounded/noninteractive permissions, stop and review the installed CLI behavior; never broaden to all-tools access merely to make a delegated run succeed.

Draft-PR creation is opt-in only after a successful bounded run. Agent 0 must independently review evidence and record acceptance before an owned PR can be marked ready. A ready PR is not merged. Opening a draft PR may trigger Actions, webhooks, or paid services in the target repository; this template's own Actions setting does not control that downstream repository. Inspect its automation and spending rules before opting in; see GitHub's workflow triggers and billing rules. An Agent Y preview must have no provider, Git, or GitHub write side effect. Agent Y does not merge; an externally authorized merge must be verified before its merged-branch cleanup. A cancelled task can close its owned unmerged PR with a reason; that close retains the branch and worktree. Automated cleanup removes an owned branch/worktree only after verified merged/accepted state. Each remote transition requires exact PR/repository/branch/head ownership checks and readback. The ledger's agent.0 or user reviewer string is a record-consistency field, not identity authentication. Host permissions, repository rules, and actual approvals remain authoritative. pr-ready additionally requires the remote base branch SHA to match the handoff's recorded baseOid; a moved base needs fresh review and a new bounded handoff. Checks run before preview, immediately before the GitHub action, and before local ready-state persistence. A base move during GitHub's call remains a remote-state race to inspect; this gate is not an atomic GitHub transaction. Applied merged-PR cleanup creates a verified Git bundle under ignored state/agent-y/archives/ before removing the exact owned branch. That bundle may include repository code and must be kept private, retained separately before uninstall/host migration, and reviewed before any folder sync or backup. Cleanup also inventories ignored worktree files, such as provider caches, before and after remote deletion. It refuses to discard them even if git status is otherwise clean. A late refusal can leave the remote branch deleted and the archive and local worktree retained; inspect and reconcile those exact states without deleting the archive to force a retry. GitHub writes and local job records are not one transaction. A push or PR create/ready/close action can succeed remotely before a readback or local write fails. Preserve the worktree and branch, inspect exact owner/base/head/PR state with read-only GitHub queries, and reconcile manually. Do not repeat an uncertain external action blindly; no automatic reconcile command exists in this alpha.

Repository protection scope

As verified on 2026-10-11, this upstream public repository has GitHub secret scanning, secret-scanning push protection, and Dependabot vulnerability alerts enabled. Automated Dependabot security updates and GitHub Actions are disabled. An active ruleset blocks deletion and non-fast-forward pushes on main and Alpha1; it does not require a pull request, approval, or status check. Local release verification therefore needs its own retained evidence. These settings do not transfer automatically to repositories created from this template, and no scanning setting guarantees detection of every secret or vulnerability. Configure the adopted project's own protections and review its actual access boundaries.

For the 1.8.9 release, the requested Codex Security Deep Scan did not start: this host lacked the managed filesystem permission profile required by that tool. The release readiness record reports the checks that did run and their limits. Do not describe the missing plugin scan as a pass or as evidence that no vulnerabilities exist. The requested alpha.3 repeat likewise did not start for the same missing managed permission profile. Its manual review and local test matrix are separate evidence, recorded under current readiness.

Private security reports

.SYSTEMX is experimental alpha software, provided under the MIT License without warranty. It is not a production-readiness or security certification.

Report suspected vulnerabilities privately through GitHub private vulnerability reporting. That repository feature is enabled. Include the affected release/tool version, platform, expected boundary, and minimal sanitized reproduction. Never include credentials, customer information, or private project records in a public issue.

Reports are reviewed as maintainer capacity permits. There is no guaranteed response time, supported-version window, or backport commitment during alpha. Report issues in older releases too and identify the affected versions; do not assume an older numeric version is security-supported. Corrections will identify their affected and fixed versions when known.

The template manager downloads explicitly selected defaults and can run configured project commands with the caller's permissions. Review publishers, sources, commands, and target paths. Distribution fingerprints check consistency with their manifest; they do not independently authenticate a publisher. Starting with 1.9.0-alpha.3, schema-2 manifest hashes require exact bytes for binary and unknown file types, while only reviewed UTF-8 text formats tolerate CRLF/LF checkout changes. Historical schema-1 snapshots retain their original hash semantics for compatibility; they should not be mistaken for a new schema-2 distribution. A 1.9 bundle missing Agent Y core files is refused. The selected release cache is checked for unexpected files, links, and directories before its Python runner executes. For an exact remote tag, an independently obtained --archive-sha256 digest can pin the downloaded codeload ZIP before parsing. The external manager's run command refuses an unmanaged target before executing target-local Python. Inspect an untrusted checkout with read-only audit or an install preview; a checkout's own launchers and target-owned managed state are not independent proof that its code is safe to execute. In the 1.8.9 check-only manager, opted-in startup discovery reads release metadata and cannot download or select the unpinned archive. Older preserved root managers may still select at startup; refresh them before enabling on-start. See installation and updates. Direct manager, runner, and release-script entry points enter Python -I mode before imports. Named local helpers load from their source bytes, blocking unlisted local modules and substituted .pyc files in those direct paths. The installed systemx console entry point resolves its package using the initial Python import paths before restarting in isolated mode. If PYTHONPATH or the working directory is untrusted, start a reviewed virtual environment's Python with -I -B -m systemx so the first import is isolated. Library imports inherit the host application's Python trust environment. These guards do not authenticate those named source files, a publisher, or the host Python installation. Use a trusted interpreter and package installation. The optional white-paper tools also start isolated, accept only HTTPS and internal PDF links, and reject linked figure roots. On POSIX systems, they anchor output writes to an opened directory and reject linked final outputs; the legacy PDF builder also rejects hardlinked outputs. Native Windows publication fails closed until equivalent directory-descriptor protection is available. A published paper edition is preserved in place; build a separate draft before publishing a new edition. See the research paper format. Fresh setup refuses conflicting executable defaults; updating an older managed installation may require an explicit, backed-up bootstrap refresh. That refresh handles eight recognized stock bootstrap and launcher files; it can add a genuinely absent historical stock file, while backing up only files it replaces. The current manager newly selects releases 1.8.7-alpha.1 or newer. An already selected verified older snapshot can run through a compatibility shim while a reviewed migration is prepared; its old code retains historical limits. GitHub's immutable-release setting protects releases published after it was enabled on 2026-10-05; earlier releases are not retroactively protected. Avoid administrator privileges, protect project data and operation logs, coordinate writers, and keep recoverable backups.

Project-specific security guidance remains in .SYSTEMX/docs/SECURITY.md. Adopting projects must define their own security contacts, deployment boundaries, and incident process.

Tier 2 data trust and local payload privacy

AUTOBOT files, including Rules.MD and Soul.MD, contain lower-authority project data. They cannot override host/system/developer instructions, authorize a tool, or grant identity. Imported research and embedded prompts must be reviewed as untrusted data. Agent Alpha selects bounded detail and reuses unchanged results; it starts no workers, fetches no URLs, and runs no recursive review. Fingerprints establish identity/consistency rather than truth.

DATA ignores untracked payloads through exact scaffold exceptions. data audit checks synthetic ignore probes plus the tracked Git index and warns on tracked payloads. It does not exhaustively verify actual untracked paths; a custom per-file unignore exception can evade the probes. Check each named export with git check-ignore and inspect tracked state separately. Git-ignore cannot remove already tracked/history/force-added data, prevent whole-folder backups or cloud copies, encrypt data, or constrain a same-account provider. Keep credentials in an approved secret manager and review transport/publication scope separately. No command auto-uploads, synchronizes, or deletes DATA payloads.