Authority & Guard
Binds runtime identity to an immutable principal, authorizes Substrate operations, and audits durable mutations.
Authentication establishes who is asking. Guard decides what that principal may do. Neither identity nor grants may come from caller-selected fields.
Host-bound principals, App capability channels, Guard authorization, source injection, and atomic data audit.
A fail-closed System surface: query, content resolution, permitted mutations, Document operations, and Event append.
App channels are process-local and non-durable. Successful personal mutations persist in data.db with audit.
External credentials, runtime scheduling, Shell presentation, or Connector package trust decisions.
Host-bound identity
The Host selects a validated App and declared workload, then issues one short-lived opaque channel capability bound to an immutable principal and permission snapshot.
Host selects App workload
↓
Core issues opaque capability
↓
{ appId, workload, channelId, permissions, manifestGeneration }
↓
Guard derives grants and D0 sourceBrowser App code receives a narrow System bridge. Node workloads receive a launch-bound private transport. Neither receives a Core URL, raw Host bearer, App ID selector, Guard token, or general Host tunnel.
System surface
| Operation | Authority |
|---|---|
query | Relational SELECT/WITH over data.db; administrative SQL and writes are rejected. |
mutate / transaction | DML only on Tables in the principal's immutable write grants. |
writeDoc / deleteDoc | Only the App's implicit namespace and declared Document grants. |
writeEvent | Append only; Guard injects the runtime source. |
| DDL | Host-only structural workflow through lamarck promote / demote. |
Atomic authorization and audit
Guard authorizes SQLite's resolved side effects, applies the mutation, and writes its D0 audit record in the same transaction. Triggers, cascades, attached databases, or administrative statements cannot be used to escape the evaluated grant.
Security boundary
Guard protects the managed API path. It does not claim to defend workspace files from the local user, an administrator, user-launched terminal processes, or approved Connector code with ambient local authority. Whole-database encryption is not part of this boundary; credential encryption is handled separately by the Credential module.