whitemagic-mcp 10.5.0 → 10.6.0

package/README.md

@@ -41,14 +41,14 @@ Or try the binary directly:
 
 ```bash
 npx -y whitemagic-mcp@next selftest   # invariant self-test + host diagnostics
-npx -y whitemagic-mcp@next --version  # wm 10.5.0
+npx -y whitemagic-mcp@next --version  # wm 10.6.0
 npx -y whitemagic-mcp@next doctor     # environment health check
 ```
 
 The binary is cached under `~/.cache/whitemagic/bin/<release-tag>/`
 (respects `XDG_CACHE_HOME`). `@next` tracks the v10 line; unpinned
 `@latest` installs fetch the stable v9 line instead. Pin the exact
-release with `whitemagic-mcp@10.5.0`, or override the release
+release with `whitemagic-mcp@10.6.0`, or override the release
 tag with `WHITEMAGIC_RELEASE`.
 
 ## Try it without installing (hosted read-only lane)

package/SECURITY.md

@@ -0,0 +1,109 @@
+# Security Policy
+
+> NOTE (2026-09-14; platform note updated 2026-10-01 for the macOS x86_64 +
+> Windows x86_64 gates): the support-window policy is decided. Supported
+> releases are the current minor and the previous minor on the install-gated
+> lines (Linux x86-64, Linux arm64, macOS arm64 + x86_64, Windows x86_64).
+> Older minors are archival.
+
+## Supported Versions
+
+| Release line | Support |
+| ------------ | ------- |
+| Current minor (latest release) | Security and bug fixes |
+| Previous minor | Security fixes |
+| Older minors | Archival — no fixes |
+
+## Reporting a Vulnerability
+
+We take the security of WhiteMagic seriously. If you have discovered a
+security vulnerability, please report it privately.
+
+**Do NOT file a public issue.**
+
+Instead, please report vulnerabilities by:
+
+1. Opening a GitHub Security Advisory (preferred)
+2. Emailing security@whitemagic.dev
+
+Please include:
+
+- Description of the vulnerability
+- Steps to reproduce
+- Affected versions
+- Potential impact
+- Suggested fix (if any)
+
+We will acknowledge receipt within 48 hours and provide a detailed response
+within 7 days.
+
+## Security Model
+
+WhiteMagic v9 is a trusted local single-user process. Its security model:
+
+- **Local-first by default**: all data stays in the local LMDB store; no
+  telemetry is sent anywhere by default — the only off-device paths are the
+  explicit opt-ins (install funnel, product telemetry) and the optional
+  read-only hosted evaluation lane.
+- **Curated tool surface**: the release profile exposes the memory/session
+  workflow; the tool archive surface is opt-in (registered total 237 at the
+  v5.8.0 release gate, 2026-08-20 — a dated figure, not today's exposure;
+  current-build exposure is profile-selected per the Q03 generated manifest,
+  with per-tool dispositions under Q04 audit).
+- **Destructive confirmation**: 12 destructive tools require an explicit
+  `route=` match plus `confirm: true` and are structurally unreachable via
+  natural-language routing.
+- **Read-only mode**: `--readonly` refuses every tool that declares writes and
+  suppresses karma, friction, and mutable-state persistence.
+- **Fail-closed compartments**: unknown compartment values get no read or
+  write access.
+- **Privacy flags**: `is_private` memories never appear in MCP read/search/
+  list/query responses; `model_exclude` memories never enter model context or
+  reasoning evidence.
+- **Exact transactions**: `transaction.begin/rollback` snapshot and restore
+  byte-equivalent records; rollback failures stay retryable.
+- **Karma chain**: SHA-256 hash chain over dispatch records, with optional
+  external Merkle anchors for tamper evidence. Pre-linkage (legacy) entries
+  are counted and disclosed per store by `wm doctor` as `N legacy
+  (linkage-only)` — they sit outside deep verification and must not be read
+  as chain-verified.
+- **Input validation**: request budgets, rate limiting, parameter caps,
+  injection filtering, SSRF protection, and path-traversal protection at the
+  MCP boundary.
+
+Important: `_meta.user_id` from an MCP client is not an authenticated
+identity. Do not deploy the MCP server as a multi-tenant authorization
+boundary.
+
+## Host Identity and Delegation Stance (2026-09-10)
+
+Context: Glama MCP-security series (MCP Dev Summit Mumbai 2026) —
+host-as-identity-blind-spot (2026-07-25), confused-deputy HR demo
+(2026-07-02), execution sandboxing (2026-06-30). Tracked as
+`rsi:proposal:active` P-OBO-1 / P-DEPUTY-2.
+
+- **Single-user local process.** WhiteMagic has no OAuth / OBO token
+  issuance or validation, no SPIFFE workload identity, and no per-user
+  scoping. The mesh node key (`WM_MESH_KEY` Ed25519, signed heartbeats)
+  names a *device/node*, never a user. See
+  `docs/S9_SECURITY_BRIEF_2026-09-10.md` for mesh-identity gaps and the
+  pending key-separation ruling.
+- **Server enforces, callers assert.** Human approval (`confirm: true`)
+  is not authorization: every destructive dispatch is re-checked
+  server-side (Dharma/Yama gates, firebreak veto + bulk-scope law,
+  compartment checks). Routing scope (gateway top-level `scope=`) and
+  tool-payload scope (inner `args.scope`, e.g. `code.claim` lease scope)
+  are separate namespaces — inner scope never re-routes (Q03 regression
+  `pinned_proxy_preserves_inner_args_scope`).
+- **Audit carries both ends where known.** Write-audit journal entries
+  record the dispatch actor from server-side context plus optional
+  OBO-shaped delegation fields (`actor_act`, `actor_on_behalf_of`,
+  `delegation_chain` — opaque, server-asserted, absent by default).
+  Client-supplied identity claims are never trusted for authorization.
+- **Four-A's self-check** (per deployment, answer honestly):
+  Administer — can you name/suspend/deprovision every node holding
+  credentials? Authenticate — short-lived node keys with rotation, or
+  standing keys? Authorize — least-privilege profiles per store,
+  destructive surface enumerated? Audit — can you replay who did what,
+  through which agent, last Tuesday, from the karma chain + journal
+  alone? Any "not really" is a known gap, not a silent assumption.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whitemagic-mcp",
-  "version": "10.5.0",
+  "version": "10.6.0",
   "description": "Local-first sovereign cognitive kernel and memory for AI coding agents over MCP - pure Rust, zero-telemetry, Landlock LSM sandbox.",
   "license": "MIT",
   "bin": {
@@ -9,7 +9,8 @@
   "files": [
     "bin/",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md"
   ],
   "engines": {
     "node": ">=18"