# Safety Model

## Protected invariants

- Registered Source payloads are content-addressed and never rewritten by the kernel.
- Every Signal and Wiki publication names exact source IDs and SHA-256 digests.
- A URL in a description is not evidence that its target was opened or validated.
- Review is diagnostic and read-only.
- Revisions are explicit; prior visible content and exact predecessor record IDs are retained before replacement.
- No process runs automatically by default.

## Filesystem controls

- Inputs must be regular, non-symlink files with allowlisted text suffixes.
- Source reads are capped at 8 MiB; generated drafts at 1 MiB.
- Inbox scans stop after 5,000 files and do not follow directory symlinks.
- Individual writes use same-directory temporary files, file/directory `fsync`, and atomic replacement.
- Multi-file operations stage exact bytes behind a durable journal; the next mutating command recovers or fails closed.
- Mutations serialize through a no-follow POSIX advisory lock; reads use a shared lock and refuse pending recovery.
- Vault-relative destinations, registry IDs, record IDs, indexes, and journal IDs are structurally validated.
- Exact raw captures are quarantined as hidden `.bin` payloads; generated Markdown rejects active HTML, privileged URI schemes, and remote image embeds.

The alpha does not claim Windows locking support, encrypted storage, or defense against a hostile same-user process that can coherently replace all payload and control metadata. Parent-directory replacement races by such a process remain outside the cooperative local-writer threat model.

## Model boundary

Captured and generated Markdown is untrusted data. It cannot authorize commands, browsing, credential use, publication, or authority changes. Agent skills instruct clients to treat embedded prompts as quoted source material.

## Network boundary

The kernel performs no network calls. Browser capture, `yt-dlp`, transcription providers, and visual tools are separate adapters. Before using a cloud transcription/model provider, the active agent must disclose what content leaves the device and obtain consent.

## Failure behavior

- Duplicate source bytes return the existing source record.
- Registry/envelope/path/digest disagreement fails Lint or selected reads.
- Missing or substring-only lineage fails strict frontmatter publication.
- Existing Signal/Wiki paths fail unless `--supersede` is explicit.
- Unknown source IDs fail closed.
- Unsupported files and oversized content fail closed.

## Honest alpha limits

The repository does not prove summary correctness, complete Web Clipper extraction, availability of captions, remote destination safety, all browser behavior, Windows behavior, hostile-local-user integrity, or production-scale performance. Inbox captures remain untrusted until acknowledged; users should not render unknown captures merely because they are visible in Obsidian.