Security boundaries

tentaflake separates configuration, credentials, network access, tool execution, and persistent state into explicit boundaries. The controls are composable, but no single control makes an untrusted agent safe.

Boundary map

Boundary	Mechanism	Review next
Agent process → host	Hardened container and systemd policy	Threat model
Agent → model provider	Per-agent LLM broker, model allowlist, and virtual credential	Brokered egress
Agent → web	Pinned secure-research-tool relay; retrieved content stays untrusted	Web research
Agent → tool execution	Disposable offline worker and approval gate; runtime tools must submit to its queue	Disposable worker
Agent → credentials	Agenix and runtime credential loading	Secrets
Agent → persistent state	Fixed-size workspace and optional separate private-state quota	Workspace and state quotas
Operator → host	Configured private connectivity and SSH authorization; reviewed Tailscale backend	Private management contract

Treat the threat model and the configuration in your own fork as the authoritative security review inputs.

tentaflake.management declares operator-owned private connectivity and SSH policy. Tailscale is the only reviewed backend; the old tentaflake.tailscale.enable aliases management.enable. Balanced requires read-only configured capabilities and still forbids public OpenSSH. The version-2 security manifest describes configuration, not enrollment, live connectivity, operator-tested access or effective remote grants. Legacy or missing management records remain unknown. Management connectivity and SSH authorization are separate from Research Internet exit readiness. See the contract and migration.

Research Internet egress requires fresh trusted observations and controller leases; missing or stale evidence withholds readiness. The optional services.secureResearch.vpnObserver is disabled by default. Operators can select link/path evidence and WireGuard handshake/public-peer checks. Evidence, leases and markers must remain root-protected and unwritable by agents; VPN credentials stay on the host. Tailscale or Headscale management membership does not provide an Internet exit, and firewall markers and region remain operator assertions.

For a planned exit change, keep the old exit and firewall protected until the documented drain condition, then confirm a fresh ready generation. Read the VPN selection and drain procedure. Option checks and upstream WireGuard fixtures are separate from Tentaflake real-tunnel integration and operator acceptance, which remain outstanding.

Private-state quotas bound the adapter’s exact state source separately from its workspace. Existing data requires explicit offline migration and quota-aware backup/restore; activation refuses unsafe sources or a mismatched backing image. Individual quotas do not reserve aggregate host capacity. See the quota guide.

Generic OCI definitions use the same containment with no network, model credentials, or accepted model/Research hooks. Their private root-owned instance parent is not mounted into the capsule; startup refuses symlink mount sources. Generic workloads remain stopped pending capability admission. Native shell/files execute inside the capsule; declaring a worker does not redirect them automatically. Onboarding imports validate stopped definitions without activating the host.

Declaring a worker does not prove that every native controller tool uses it. Actual vendor startup, MCP discovery and execution routing require evidence from the exact image. The dev profile permits broader authority and is not a security boundary for untrusted, continuously running agents.

The model broker can forward bounded Chat Completions and Responses SSE only when enabled for the exact agent; streaming is disabled by default. Its event and output limits, deadlines, cancellation, audit admission and conservative budget reservation do not establish acceptance of a vendor runtime. See streaming model responses and the adapter support limits.