Threat Model

Assets and trust boundaries

Assets include repository contents, developer secrets, project files, Intentloom catalog integrity, generated-file ownership records, human approval, future workflow evidence, provider credentials, and project-access grants. Inputs from repositories, Git history, provider exports, external MCP servers, templates, profiles, generated files, paths, and tool adapters are untrusted until validated. Intentloom is local-first and has no network or telemetry plane in v0.1.

Threats and controls

Threat	Risk	Required controls
Malicious repository instructions / prompt injection	Agent is persuaded to bypass policy or leak data	Treat repository prose as untrusted data; isolate instruction sources; show provenance; retain human confirmation for write plans.
Malicious Git or provider evidence	Commit messages, exports, or API payloads influence decisions or leak data	Parse as bounded untrusted data; preserve provenance; redact sensitive fields; never execute or treat prose as instructions.
External MCP server manipulation	A connected server returns forged evidence or requests unsafe actions	Capability allowlists, source identity, schema validation, provenance, trust classification, project isolation, and no direct mutation from external results.
Path traversal / symlink escape	Reads or writes escape the selected project root	Canonicalize paths, bind capabilities to an explicit root, reject external symlinks, and revalidate destinations before writes.
Over-broad project access	Inspection reads unrelated, private, or secret files	Explicit root and access scopes, bounded discovery, built-in exclusions, content-safe reporting, and a documented distinction from OS sandboxing.
Arbitrary script or shell execution	Local code execution or credential theft	No shell or project scripts during inspection/evidence collection; fixed Git read-only allowlist; no generic MCP command or CLI-execution tool.
Secret leakage	Secrets enter prompts, logs, evidence, locks, or generated files	Redact known secret patterns; prohibit credentials in project metadata, evidence bundles, source maps, examples, and diagnostics.
Excessive provider permissions	Provider token can modify or administer repositories	Export-first delivery; later live access is explicit, least-privilege, preferably read-only, revocable, and stored outside project state.
Cross-project evidence mixing	Events from another repository create false findings	Bind evidence bundles to provider identity, repository identity, explicit root, source IDs, and deterministic case correlation.
Forged, stale, or incomplete evidence	Conformance findings are overstated	Trust states, timestamps, source provenance, cache freshness, conflict detection, and explicit missing/ambiguous/unsupported classifications.
Unsafe hooks	Silent lifecycle execution	Never install or enable hooks automatically; model hooks as explicit, reviewed future artifacts.
Template injection	Untrusted values alter generated output	Use structured rendering with schema validation and escaping; forbid arbitrary expression evaluation.
Generated-file or ownership-metadata tampering	Drift is hidden or malicious content is trusted	Re-read committed generated and metadata bytes; validate identity, versions, paths, ownership, relationships, and checksums; roll back every inconsistency.
Dependency supply-chain risk	Compromised build/runtime dependency	v0.1 installs none; later dependencies require lockfiles, provenance review, and minimal surface.
Destructive overwrite	User content loss	Dry-run, diff, conflict detection, and backup or explicit confirmation for every write.
Stale instructions	Obsolete policy drives unsafe behavior	Pin versions and checksums; doctor reports stale locks, unsupported adapters, and drift.
Adoption ownership confusion	Existing project files are silently claimed	Treat every unrecorded existing file as project-owned regardless of path, header, filename, equivalent source, or matching bytes.
Unbounded repository discovery	Heavy, ignored, binary, or external trees are traversed	Bound depth/file count; ignore dependencies, VCS, vendor/build/cache output and binaries; never traverse symlinked directories.
Local daemon endpoint exposure or peer impersonation	Another process reaches or controls the daemon	IPC-only explicit endpoint, private runtime directory, one-use in-memory session token, strict framing/limits, no TCP fallback, and authenticated shutdown.
MCP mutation replay or stale approval	An agent applies a changed or previously approved plan	Short-lived root-bound plan ID, digest, expiry, exact path/diff preview, current-state revalidation, explicit human approval, and transactional apply.
Persistent-memory poisoning or stale acceptance	Untrusted or superseded content is retrieved as trusted project knowledge	Project-scoped IDs, explicit lifecycle states, provenance, review before acceptance, approval evidence, supersession history, deterministic trust filtering.
Memory import or export leakage	A bundle mixes projects, overrides policy, or exposes secret content	Versioned bundles, project identity checks, proposal-only imports, canonical-source rejection, secret redaction, explicit export and deletion audit evidence.
Semantic index or provider disclosure confusion	Derived state is treated as canonical or private data is sent unexpectedly	Rebuildable local index, accepted-record filtering, explicit provider/model/network/retention disclosure, no implicit downloads or network access.
Agent session poisoning, stale context, or unredacted transcript leakage	Unvalidated session state corrupts agent decision-making or leaks secrets	Bounded session schemas, explicit state transitions (active/closed/compacted/archived), secret path redaction, project-scoped isolation, local JSON storage under .aif/memory/sessions/, no silent mutation of canonical intent during session compaction/export/deletion.
Malicious SARIF reports, scanner supply-chain tampering, or unredacted vulnerability evidence	External scanner output or tampered report corrupts findings or leaks credentials	Untrusted input parsing, strict schema validation, path canonicalization, secret path redaction, project-isolated storage under .aif/security/, no silent capability grant or shell execution from security findings.
Security scanner script injection, unauthorized build execution, or scanner data leakage	Security scanning executes malicious scripts or sends codebase data externally	Built-in local security adapters execute only fixed read-only file inspections without shell commands, build scripts, external binaries, or network connections; findings normalize to SecurityFinding with local deduplication.
Security policy tampering, unapproved baseline resets, or silent vulnerability suppression	A malicious change or agent action alters security policies or overwrites baselines to hide vulnerabilities	Schema-validated policy/baseline documents under .aif/security/, explicit maintainer confirmation for baseline updates, deterministic exit code enforcement on policy failures, and full finding traceability.
Agent capability escalation, out-of-sandbox path mutations, or unauthorized command execution	An agent proposal attempts to write outside permitted directories or execute unapproved commands	Sandbox capability contracts stored under .aif/security/sandbox.json, pre-execution proposal evaluation against path and command allowlists, structured violation reporting, and default network denial.
Audit trail tampering, silent security regression, or invariant verification bypass	Security invariant checks are bypassed, modified out-of-band, or audit report logs are altered	Versioned audit report schemas under .aif/security/audit-report.json, automated invariant verification 1-28, quantitative health score computation (0-100%), tamper-evident SHA-256 audit hashes, and deterministic non-zero exit codes on posture failure.
Harness authority confusion, unsafe execution, trace poisoning, or false model consensus	An evaluation is treated as approval, escapes its declared executor, persists secrets, or hides disagreement	Versioned scenarios and capabilities, deterministic pre/post gates, executor conformance, state storage outside the target, redaction, bounded append-only events, manifest digests, explicit uncertainty, and deterministic aggregation that cannot override hard failures.

Non-goals

Intentloom does not currently sandbox a coding agent, enforce provider permissions, scan all repository content, or prevent a user from deliberately approving unsafe actions. Application-level access scopes are not represented as a complete operating-system sandbox. The planned harness does not change this claim until an executor adapter and its conformance evidence are implemented. Intentloom makes provenance, differences, uncertainty, capabilities, and unsafe plans visible before mutation.

Security invariants

1. No network request or telemetry is implicit.
2. A pure validation path must exist for every mutating path.
3. Every generated artifact is traceable to canonical inputs and adapter version.
4. Human confirmation is required when an existing non-identical file would be replaced.
5. Security-sensitive provider behavior remains outside canonical core and is explicitly documented by an adapter.
6. Generated and metadata write paths reject symlinks, including internal and broken links, and are revalidated before replacement.
7. Symlink loops fail through the same stable path-security classification without recursive traversal.
8. Destination collisions abort before persistent writes and preserve project state byte-for-byte.
9. Transaction success requires the actual committed generated files, manifest, and source map to form one mutually consistent state and to match the planned bytes.
10. Every post-write corruption class has a stable code, fails at post-write-consistency, and triggers restoration or removal according to the transaction's initial state.
11. Post-write diagnostics contain only project-relative affected paths and safe identifiers, never private file contents or external absolute paths.
12. Adoption dry-run and doctor are byte-for-byte read-only and produce no .aif, backup, staging, Git, or external-path mutation.
13. Profile detection uses bounded file evidence, never project prose, dependency installation, scripts, network access, or external symlink traversal.
14. A future local daemon accepts only authenticated, versioned, bounded IPC requests and never treats local endpoint reachability as authorization.
15. Future project inspection, Git evidence collection, timelines, conformance, and MCP read-only tools remain bound to an explicit project root and cannot mutate project state.
16. Local Git collection uses fixed read-only commands without a shell, hooks, network access, checkout, configuration changes, or repository mutation.
17. Provider and external MCP results are untrusted evidence and cannot directly trigger adoption, sync, merge, release, or any project write.
18. MCP exposes named typed capabilities, never a generic shell, unrestricted CLI execution, arbitrary file reads, or generic writes.
19. Every MCP-triggered mutation requires a reviewed plan, explicit human approval, digest and expiry verification, root and current-state revalidation, and transactional rollback guarantees.
20. Credentials remain outside project configuration, generated output, evidence bundles, logs, source maps, and MCP tool results.
21. Persistent-memory imports are untrusted proposals and cannot silently replace canonical intent, verified evidence, or accepted records.
22. Persistent-memory acceptance requires explicit approval evidence and revalidation of the reviewed proposal state.
23. Derived memory indexes are non-canonical and deletable; external semantic providers require explicit reviewed disclosure before any data leaves the project.
24. Agent session lifecycle tracking operates strictly through typed application operations, stores state locally under .aif/memory/sessions/, redacts secret paths, and cannot silently mutate canonical intent.
25. Security finding ingestion and SARIF imports process reports as untrusted input, canonicalize paths, redact secrets, store findings under .aif/security/, and cannot execute code or alter project configuration without review.
26. Local security adapters execute strictly allowlisted read-only file inspections without shell execution, install scripts, external binaries, or network access, and normalize outputs into deduplicated SecurityFinding items.
27. Security policies and baselines are project-scoped, schema-validated files stored under .aif/security/; baseline updates require explicit maintainer invocation and policy failures exit with deterministic non-zero codes.
28. Agent mutation proposals are evaluated against versioned sandbox capability contracts stored under .aif/security/sandbox.json; proposals attempting out-of-bounds path writes or unallowlisted commands are blocked with structured violation diagnostics.
29. Continuous security audit automates verification of all active invariants (1–28) across memory, sessions, policies, baselines, and sandboxes, logging tamper-evident SHA-256 audit hashes under .aif/security/audit-report.json and returning deterministic exit code 3 on posture failure.
30. Workflow-variant summaries consume only explicitly supplied, schema-validated timelines and expose only normalized activity sequences, case identifiers, and timestamp coverage; they do not collect evidence, persist reports, reveal actors or raw payloads, or infer delay, bottlenecks, causality, or individual performance.
31. Workflow-duration metrics consume only explicitly supplied, schema-validated timeline timestamps and expose aggregate elapsed minutes with coverage; they do not collect evidence, persist reports, reveal raw timestamps or actors, or label an interval as a bottleneck, performance measure, or cause.
32. Conformance trend summaries consume only explicitly supplied, schema-validated reports for one policy and case type and expose aggregate status/severity counts; they do not expose raw evidence, identify actors, certify compliance, infer bottlenecks, or prioritize remediation.
33. Workflow repetition summaries may consume only explicitly supplied, schema-validated timelines of one case type and expose repeated activity counts; they do not infer rework, retries, delays, bottlenecks, quality, causality, or individual performance.
34. Workflow transition interval summaries may consume only explicitly supplied, schema-validated timelines and expose aggregate elapsed minutes for valid adjacent timestamp pairs; they do not expose raw timestamps or infer queue time, latency, performance, bottlenecks, or causality.
35. A future agentic harness keeps scenario, policy, scoring, execution, state, and approval authority distinct; deterministic failures cannot be overridden by model consensus, executor guarantees cannot be inferred from policy checks, and run state remains bounded, redacted, and outside the target repository by default.