Security boundaries

Security boundaries

Elah's security model starts by limiting authority.

Observer

Observer has read-only filesystem authority for the selected world. It rejects symbolic links, special entries, unsafe paths, malformed allocation tables, unsupported compression, oversized data, malformed NBT, and evidence changes.

An input problem returns no partial success report.

Protocol Laboratory

The current plaintext gRPC endpoint accepts loopback addresses only. It is not suitable for network exposure. Future control-plane transport requires authenticated TLS and explicit caller identity.

Future ownership calls

Ownership-sensitive calls are designed to carry:

• request and trace identities;
• caller and cluster identities;
• protocol version and deadline;
• cell identity;
• ownership epoch;
• operation identity.

These fields make stale, repeated, cross-cluster, and unauthenticated work easier to reject and audit.

Supply chain

The repository uses pinned toolchains, SHA-pinned GitHub Actions, generated-output verification, dependency review, software bill of materials generation, CodeQL, license coverage, provenance checks, and an isolated upstream research boundary.

Production source cannot import or build from the studying/ research tree.

Vulnerability reports

Do not publish a suspected vulnerability in a public issue. Use the repository's private security reporting instructions.