Section 24Platform and Delivery
Security and safety requirements
Defines trust, isolation, permissions, resource limits, integration arming, and safeguards for untrusted or physical interactions.
Section relationships
| ID | Name | Priority | Requirement | Verification |
|---|---|---|---|---|
| SEC-001 | No implicit network access | MVP | The portable product SHALL make no outbound network connection unless the user enables a networked capability. | Test |
| SEC-002 | Untrusted asset parsing | MVP | Asset parsers SHALL enforce configured limits for size, nesting, references, decompression, geometry counts, and processing time. | Test |
| SEC-003 | Path traversal protection | MVP | Project, archive, cache, and importer paths SHALL not escape authorized roots through traversal, links, or crafted archive entries. | Test |
| SEC-004 | No asset code execution | MVP | Data import SHALL not execute asset-provided code, plugins, macros, or commands by default. | Test |
| SEC-005 | Secret redaction | MVP | Logs, manifests, reproduction bundles, and diagnostics SHALL redact configured secrets and credentials. | Test |
| SEC-006 | Dependency inventory | MVP | Every release SHALL publish or embed a software bill of materials with versions and licenses. | Inspection |
| SEC-007 | Vulnerability policy | MVP | Release candidates SHALL pass the approved dependency vulnerability policy with documented exceptions. | Inspection |
| SEC-008 | Unsafe-code policy | MVP | First-party core crates SHALL forbid unsafe Rust unless an exception is isolated, documented, reviewed, and tested. | Inspection |
| SEC-009 | External permission manifest | Beta | Every external extension SHALL declare requested filesystem, network, process, environment, shared-memory, GPU, and physical-device access. | Test |
| SEC-010 | Sandbox default | Beta | Untrusted extensions SHALL run in a Wasm sandbox or restricted process rather than in the host address space. | Test |
| SEC-011 | HIL safe default | External | HIL integrations SHALL default to disarmed physical outputs and SHALL require explicit user action to arm. | Demonstration |
| SEC-012 | Physical limits | External | HIL output SHALL enforce configured command, rate, energy, temperature, and communication-watchdog limits where applicable. | Test |
| SEC-013 | Signed releases | Beta | Official release artifacts and official extension packages SHALL be cryptographically signed. | Inspection |
| SEC-014 | Network authentication | Beta | A remotely accessible gateway SHALL authenticate peers and protect message integrity using an approved configuration. | Test |
| SEC-015 | External executable policy | Beta | Extensions, adapters, FMU hosts, controller processes, firmware emulators, and external solvers SHALL be governed by one default-deny executable policy. | Inspection |
| SEC-016 | Explicit permission grants | Beta | An external executable SHALL receive only permissions explicitly granted by the user or administrator, and grants SHALL be stored outside project-controlled data. | Test |
| SEC-017 | Permission expansion approval | Beta | Installing or upgrading an external executable SHALL require renewed approval before any filesystem, network, process, environment, shared-memory, GPU, or device permission expands. | Test |
| SEC-018 | Sandbox fail-closed | Beta | An untrusted external executable requiring unavailable sandbox enforcement SHALL remain inactive unless the user makes a separately recorded trust decision permitted by policy. | Test |
| SEC-019 | Hostile protocol inputs | Beta | Every external message, shared-memory descriptor, archive, and handle SHALL be treated as untrusted and validated against negotiated type, size, count, depth, lifetime, ownership, and capacity limits. | Test |
| SEC-020 | No remote listener by default | MVP | The portable product SHALL not open a non-loopback listening socket unless the user explicitly enables a remote capability. | Test |
Generated from the canonical specification. Edit section metadata or prose in docs/requirements.md; the website rebuilds this page and its relationships automatically.