# Security

The public `v0.1.3` release is storage hygiene only and is not an Agent-isolation boundary. The public `v0.2.0-rc.1` release candidate uses a provisioned, Developer ID-signed, notarized Broker app and a private Data Protection Keychain access group. The 3-machine/24-hour external acceptance round is deferred; this release does not claim independent security review or independent-user adoption.

The security objective is narrow: a same-user model-launched process must not retrieve a managed credential without a contemporaneous explicit user authorization. The trusted Harness host and in-process plugins are intentionally allowed to receive a credential through `ctx.credentials.resolve()`.

The boundary fails closed on missing entitlements, invalid signatures, denied or canceled authentication, locked Keychain, malformed responses, timeouts, and Broker crashes. It never falls back to the old helper, file-based storage, plaintext, or an environment value for a managed operation.

The following local evidence passed with disposable items and no recorded secret material:

- signed provisioned Broker: exact App ID/profile/group, Developer ID, Hardened Runtime, secure timestamp, universal slices;
- authenticated provider lifecycle: set, get, exact round trip, unset, post-delete absence, and clean Broker disposal;
- independent same-UID Security.framework reader, `/usr/bin/security`, copied Broker, direct invocation cancellation, and quarantined native/Intel launch checks;
- isolated DSH `0.1.0-rc.6` plugin installation, composed profile replacement, Web HTTP 200 boot, and a DSH bash-tool attempt that failed closed without returning a value;
- Apple notarization accepted and stapled: `8941cae5-75a5-4f1c-bdfb-998d1ce578c3`.

This is not an independent security audit. It does not cover a compromised macOS kernel, administrator access, debugger access to the trusted Harness host, a user approving an unexpected prompt, or independent-user adoption. Do not disclose real credentials, Keychain dumps, account identifiers, or private model configuration in issues or reports.