@oracle-agent/oracle 0.11.0 → 0.12.0

package/SECURITY.md

@@ -27,6 +27,9 @@ In scope:
 - grant forgery, replay, or scope escalation
 - route/vault/order attestation forgery
 - secret leakage through an API response or log
+- holder-gate bypass, challenge replay, or cross-user data access in an official
+  hosted beta
+- Buzz capability forgery or audit-chain tampering
 
 Out of scope:
 
@@ -53,6 +56,9 @@ Consequences of that assumption, which are the invariants worth attacking:
    targets require an attestation minted inside the trusted boundary.
 5. **Guards are recomputed at sign and broadcast time**, not just at quote time,
    because a stale minimum is not a minimum.
+6. **The shipped public HTTP server is not a holder-authentication service.** It
+   is loopback-only and rate limited, but unauthenticated. A hosted Locals beta
+   needs a separate server-side ownership gate and per-user isolation.
 
 If you find a path where model-authored text becomes an authorized on-chain
 action without an owner signature and a policy check, that is the bug we most
@@ -68,22 +74,41 @@ the boundary suite on every push and pull request.
 
 A security claim that isn't enforced by a test is just a comment.
 
-## Residual operator notes
+## Hosted and operator boundaries
 
 These are not public-package custody holes. They are operator constraints that
 still apply after the public boundary hardening:
 
-1. **Owner-local signer modules live in the public companion**
-   [`@oracle-agent/operator`](https://github.com/demi-hl/oracle-operator)
-   (`hl-exec`, `key-vault`, `oracle-vault`). Keys stay on the operator's
-   machine. They must not be restored into this prepare-only package or its
-   npm artifact. CI fails if a pack of *this* repo includes those paths.
+1. **Owner-local signer modules live in private operator infrastructure.** The
+   operator package is not published on npm and is not part of public or holder
+   onboarding. Those modules and credentials must not be restored into this
+   prepare-only package or its npm artifact. CI fails if a pack of *this* repo
+   includes signer or vault paths.
 2. **Prepare helpers that validate executable routes require an attestation
    secret** (`requireSigned`) so they cannot be used as a softer pre-broadcast
    gate than `enforceTxPolicy`.
-3. **Daily spend ledger locks are pid + TTL based.** A live owner holds the
-   lock; a dead pid or expired lock is reclaimed. Override TTL with
-   `ORACLE_LEDGER_LOCK_TTL_MS` only if you know you need a longer window.
-4. **GitHub process controls** (branch protection, CodeQL, secret scanning,
-   Dependabot) are enabled on this public repo and are independent of the
-   package boundary tests.
+3. **Live grants have a hard 24-hour ceiling.** Public grant validation with an
+   explicit reference time and provider-neutral session grants reject a longer
+   TTL. Deployments should choose a shorter lifetime whenever possible.
+4. **Execution tool routing fails closed.** Sign, send, submit, and broadcast
+   operations are owner-only. Unknown operations inside a signer/executor
+   namespace also require owner send/execute intent; a new tool name does not
+   silently become guest-accessible.
+5. **Daily spend ledger locks are never reclaimed automatically.** An existing
+   lock refuses broadcast, even when it appears stale. After verifying that no
+   holder is active, an operator must remove a stale lock out of band. This
+   sacrifices unattended recovery to avoid a stale-reclaimer ABA race that can
+   defeat aggregate spend accounting.
+6. **Action records are not chain proof.** `normalizeActionReceipt()` records
+   caller-supplied public facts; `recordAudit()` is a process-local, best-effort
+   file helper. Neither authorizes execution or proves settlement. Report
+   success only after independently verifying the successful chain receipt,
+   expected destination/events, and expected balance delta.
+7. **Repository-host controls are not the custody boundary.** Dependabot alerts
+   may be enabled independently, while branch protection, CodeQL, and hosted
+   secret scanning depend on repository visibility and account tier. Verify the
+   live settings; do not infer them from this document. The local CI boundary,
+   packed-artifact, and secret-scan gates remain mandatory.
+8. **Holder admission is deployment code.** The npm package does not prove
+   Locals ownership or isolate hosted tenants. See
+   [docs/holder-beta.md](docs/holder-beta.md) before exposing any shared surface.