Preview This is the v1.0 preview line. It documents a rebuild that is still in alpha — schemas, tool names, and package contents change without notice, and nothing here is covered by a stability guarantee. For the released line, see the v0.x documentation.

Installer Threat Model

Trust boundaries and adversarial requirements for release and target inputs.

Alpha.4 status: Traversal, symlink, forged-journal, signature, digest, downgrade, same-version equivocation, and interruption paths have automated coverage. The “before beta” items below remain open hardening targets.

The installer treats an archive, descriptor, manifest, catalog, adapter, and target filesystem as untrusted until validated. It must reject absolute or parent-traversal paths, archive links and path escapes, duplicate normalized destinations, unsupported operations, unverified assets, and target symlink escapes. It must not execute release-supplied code.

Before beta, tests must cover archive size/count limits, TOCTOU and symlink races, interrupted application/recovery, malformed provenance, downgrade policy, MCP command-array injection, and secret redaction in plans and state.