Security

Private by design, fail-closed by default

OMP collaboration links are bearer capabilities. The gateway treats both View and Control links as secrets, and the invariants below block a release when they regress.

• Loopback-only listeners — the production HTTP server binds only to 127.0.0.1 and optionally ::1; Tailscale Serve is the only supported remote path and Funnel is never enabled.
• Allowlisted tailnet identity — production requires a verified Tailscale-User-Login that matches an exact allowlist, and identity headers are believed only while Tailscale's tunnel device is present. A userspace-networking client makes every peer look local, so the daemon returns 403 rather than trusting the header.
• Memory-only capabilities — View and Control links exist only in the live OMP process, authenticated local IPC request memory, the gateway's in-memory store, one no-store launch response, and volatile client JavaScript. Never in files, logs, diagnostics, URLs, cookies, push payloads, browser storage, or service-worker caches.
• Metadata-only APIs — session-list and SSE responses carry bounded metadata; a capability is fetched only after an explicit tap and only for the expected generation, so stale cards fail instead of receiving a newer secret.
• Authenticated local IPC — each OMP process registers over a user-only Unix socket (or current-user named pipe on Windows) with a random per-install token of at least 256 bits; the registry is memory-only and restarts empty.
• Prompt revocation — generation N is revoked before N+1 is published; stop, shutdown, and fatal host failure unregister immediately, with a 35-second TTL as the crash fallback.
• Hardened browser surface — exact Origin validation on state-changing requests, no wildcard CORS, strict CSP, Referrer-Policy: no-referrer, and a service worker that caches only immutable shell assets.
• No transcript storage — the gateway never stores or renders transcripts; opening a session hands off to OMP's existing end-to-end-encrypted relay and client.

Out of scope in v1: mutually untrusted local accounts on a shared shell host, Portal Tunnel, and self-hosted or proxied relays. Every release runs distinctive-synthetic-secret leak scans across logs, storage, caches, URLs, and CI artifacts before it is qualified.

The full threat model, boundaries, and acceptance gates: docs/SECURITY.md · report a vulnerability privately via the security policy.

Invariants as qualified for stable v0.3.0 on 2026-09-09.