# Threat Model

## Protected assets

- Source code and files inside configured project roots
- Agent, terminal, OAuth, and speech-provider credentials
- Thread history, prompts, tool activity, and permission decisions
- The ability to execute commands as the Trit service user

## Trust boundaries

The host user, configured ACP agents, configured shell commands, and explicitly managed 1MCP instances are trusted. Browser users must be authenticated through local loopback mode or a validated Cloudflare Access JWT. Remote icon and speech-provider endpoints are untrusted networks.

## Primary risks

- Forged reverse-proxy identity or cross-origin browser requests
- Project-root escape through symlinks, filesystem callbacks, or terminal working directories
- Command execution outside the intended permission decision
- Secret disclosure through configuration, logs, raw ACP events, icons, or provider context
- Malicious or compromised dependencies and release artifacts
- Irreversible database changes during an upgrade

## Controls

- Explicit authentication modes, JWT signature/audience verification, and origin checks
- Canonical project roots, symlink escape rejection, and bubblewrap-scoped ACP terminal requests
- Durable permission decisions and thread-scoped repeated approvals; optional per-agent `permissions.autoApprove` for trusted agents
- Environment indirection for credentials and redaction of browser-facing configuration
- Lockfiles, reviewed install scripts, dependency scanning, CodeQL, secret scanning, SBOMs, checksums, and build attestations when supported
- Automatic update staging verifies the exact GitHub release-workflow Sigstore identity, CT log, Rekor entry, and immutable release checksums
- Numbered migrations, consistent backups, versioned releases, health checks, and rollback

## Non-goals

Trit is not a hostile multi-tenant sandbox, a privilege boundary between users on the same Unix account, or a safe way to run untrusted ACP implementations. It must not run as root or expose an unauthenticated origin listener to the internet.