Protected assets
- Source code and files inside configured project roots
- Agent, terminal, OAuth, and speech-provider credentials
- Thread history, prompts, tool activity, and permission decisions
- The ability to execute commands as the Trit service user
Trust boundaries
The host user, configured ACP agents, configured shell commands, and explicitly managed 1MCP instances are trusted. Browser users must be authenticated through local loopback mode or a validated Cloudflare Access JWT. Remote icon and speech-provider endpoints are untrusted networks.
Primary risks
- Forged reverse-proxy identity or cross-origin browser requests
- Project-root escape through symlinks, filesystem callbacks, or terminal working directories
- Command execution outside the intended permission decision
- Secret disclosure through configuration, logs, raw ACP events, icons, or provider context
- Malicious or compromised dependencies and release artifacts
- Irreversible database changes during an upgrade
Controls
- Explicit authentication modes, JWT signature/audience verification, and origin checks
- Canonical project roots, symlink escape rejection, and bubblewrap-scoped ACP terminal requests
- Durable permission decisions and thread-scoped repeated approvals; optional per-agent
permissions.autoApprovefor trusted agents - Environment indirection for credentials and redaction of browser-facing configuration
- Lockfiles, reviewed install scripts, dependency scanning, CodeQL, secret scanning, SBOMs, checksums, and build attestations when supported
- Automatic update staging verifies the exact GitHub release-workflow Sigstore identity, CT log, Rekor entry, and immutable release checksums
- Numbered migrations, consistent backups, versioned releases, health checks, and rollback
Non-goals
Trit is not a hostile multi-tenant sandbox, a privilege boundary between users on the same Unix account, or a safe way to run untrusted ACP implementations. It must not run as root or expose an unauthenticated origin listener to the internet.