Fail closed
Security boundaries
Prompt text is not a security boundary. Anything a GPT sends is data. Authority lives in digest-bound human approval on the local control plane, which this site cannot reach.
Hard denies
| Path / action | Result |
|---|---|
/api/v1/execute and aliases | 403 FOREVER |
| approve / apply / promote / commit / push | not in schema, 403 if probed |
provider ids other than mock | UNTRUSTED / DISABLED |
| auto_approve, silent fallback, role promotion | rejected |
| file / shell / git handles for models | not exposed |
Transport
- HTTPS only. HSTS preload-ready once the apex is live.
- Clickjacking denied. MIME sniffing denied. Referrer stripped.
- CSP default-src self. API responses use default-src none.
- CORS for Actions is explicit, not
*on write endpoints.
Trust split
| Surface | Trust |
|---|---|
| This website + Pages Functions | Public, proposal-only, untrusted input |
| OpenAI GPT runtime | Untrusted client |
| Local Ara / Self-Builder | Private, HITL, not published here |
Disclosure
See /.well-known/security.txt. Do not file public exploits against the tower. This site has no execution primitive to exploit into Ara unless someone later wires one — that wiring is forbidden without a separate reviewed gate.
Re-audit
Machine-readable checklist: /audit/checklist.json. Human copy: /audit/CHECKLIST.md. Run it after every DNS, header, schema, or function change. An agent loop may consume the JSON. It must not auto-apply fixes to Track A.