Threat Model

Threat Model

Mnemos Harness is local-first and single-owner by default.

The main threats are external: network attackers, hostile inputs, compromised extensions, confused-deputy tool calls, unauthorized secret access, and unreviewed workspace mutation.

The owner and owner-authorized agent are the trust context. If the owner grants an agent shell access, the harness must not pretend that hiding a tool result is security. Capability level is the security boundary.

v0 controls:

  • broker all extension authority through harnessd
  • deny or ask for dangerous git and filesystem actions
  • store audit records for material decisions
  • hash-chain event and audit logs
  • keep private project doctrine outside distribution repos
  • avoid cloud database or hosted sync requirements
  • confine agent workloads in Podman boxes (no net, project-only mount, ambient home denied); S3 explicit host-path allowlists for extra binds (default RO; ambient roots never grantable); S4 defaults skills and run create to Podman when healthy (JARVIS_SANDBOX=host opt-out); optional host AppArmor/SELinux for the control plane is Enterprise (see sandbox.md, D-SB-1..4 + S3 + S4 / doctor sandbox)

Multi-tenant isolation is a future opt-in mode, not the default.