Threat model

Security / reviewed source

The full reviewed source is auths-proof/docs/threat-model.md.

Protected

substitution of proof, action, context, or referenced objects;
forged or mismatched principal-control evidence;
authority expansion through delegation;
action, audience, challenge, body, status, or validity mismatch;
unsupported critical behavior becoming implicit acceptance;
malformed and non-canonical wire input;
resource exhaustion beyond configured bounded work; and
executing a command not derived from the sealed verified action.

Trusted inputs

Security depends on correctly chosen trust anchors, executable registries, evaluation time, status snapshots, assurance policy, expected audience and challenge, and verifier limits.

Not provided by the kernel

The kernel does not provide transport confidentiality, evidence acquisition, challenge storage, replay prevention, budget claiming, exactly-once execution, custody, application sandboxing, or receipt persistence.