Security and trust boundaries

Transport security, member identity, configuration integrity, and content confidentiality are separate controls. Configure each for your net.

Member identity

Members generate their signing key locally. Public-only certificate enrollment lets an authority certify identity without receiving that private key. Enforced authorization rejects unsigned, invalid, expired or revoked member assertions at daemon boundaries.

Direct-message encryption

Required-mode direct messages use HPKE with authenticated recipient encryption keys. Message content is sealed before reaching the broker and verified after opening. Missing recipient keys fail closed. Required-mode topic encryption is not implemented; topic sends fail rather than silently use plaintext.

The broker still sees routing metadata, identifiers, timestamps and ciphertext size. Local outboxes and inboxes contain plaintext. Encryption does not protect a compromised local OS account or provide forward secrecy after theft of the member seed.

Protected credential references and configuration integrity

Operator configuration in config.json rejects inline secrets, tokens, passwords, or API keys. Credentials must be stored in separate private files referenced by file path:

• File permissions: When opening credentials, the owning transport verifies regular, non-symlink files. On Unix, credential and private key files must have no group or other permissions (such as mode 0400 or 0600). On Windows, access control lists (ACLs) are strictly inspected to ensure only the owner, current user, SYSTEM, or Administrators have access.
• Safe generation: CLI commands such as ecc login establish restrictive file permissions before any secret bytes are written to disk.
• File bounds: Token and API key files are constrained to a single non-empty line and 16 KiB maximum size.
• Parser limits: Configuration is bounded to 1 MiB and 32 nesting levels. Parsing fails closed on unknown or miscapitalized fields, duplicate keys, null values, trailing bytes, or unsupported versions.
• URI hygiene: Broker server and AI endpoint URLs strictly forbid embedded credentials, queries, or fragments.
• Shared-loader inspection: config inspect audits configuration input provenance (environment, file, built-in default, or unset) and reports the presence of overrides with credentials redacted, without opening credential files, displaying secret contents, or enumerating consumer-specific defaults and command flags.

Logging, runner bounds and diagnostic redaction

Diagnostic logging supports structured JSON and text output through standard slog handlers. The handler's redaction filter strips configured secret fields, known credential values, and URL credentials from structured log attributes and nested errors. Arbitrary payloads and unstructured logs may contain unmodeled secrets, and automatic file retention or log rotation is not implemented. Log output writes to stderr, or to a diagnostic file for the echod daemon (defaulting on Windows to log/echod-service.jsonl within the network state directory), preserving stdout for command results and MCP protocol traffic. Diagnostic file redirection is currently daemon-specific, and bootstrap logging, fatal startup errors, and full event audit coverage remain open pending further qualification.

Driven agent processes bound stdout frames and early transcript buffering: CLI stdout frames default to a 4 MiB limit (configurable via limits.drive_frame_bytes or ECHO_DRIVE_FRAME_BYTES between 1024 and 16777216 bytes). Oversized frames stop and reap the owned child process. Early transcript capture buffers at most 64 records and at most 2 KiB of raw data per record, bounding retained early payloads to 128 KiB. These bounds limit those allocations, but do not impose a total process-memory limit, session disk quota or write deadline.

Binary update and release foundations

Binary update verification primitives are implemented in current source. Production signing and an independently authenticated bootstrap trust path are still required:

• Signed metadata verification: Pure Go verifier authenticates release metadata with pinned Ed25519 keys, binding channel, monotonic sequence, version, source revision, and archive hashes to reject metadata sequence rollback and same-sequence equivocation. Sequence protection does not prohibit a newer signed catalogue advertising an older binary version; installation policy must enforce version floors. Restoring an old disk snapshot or rolling back to a valid history tail is not detected.
• Durable replay receipts: Verified releases append to an internal, bounded binary journal with checksum chains under OS-held file locking to reject older metadata sequences and conflicting same-sequence payloads across restarts.
• Startup fencing: When an explicit .echo-install directory is provisioned beside executables, startup checks enforce maintenance inhibition and check compiled version/revision generations under lock. It does not prove binary integrity or full safe activation; unmanaged installations without this directory are not eligible for automatic adoption.
• Open qualification scope: Recoverable matching-pair replacement, compatibility and health checks remain unimplemented and unqualified. There is no published end-to-end automatic updater or update notification service yet. Production key custody, root rotation, and live service conversion remain open qualification items.

Coordinator workflows and CLI subscription boundaries

When coordinating agent CLIs (Claude Code, OpenAI Codex, Antigravity) across your net, sessions execute within native user permissions and existing tooling context. Operators choose available CLIs based on local toolchains; there is no universal best coordinator claim (see installation overview):

• Subscriptions vs. API billing: Subscription-authenticated CLI sessions use their vendor plan allowances and reset rules. CLI sessions authenticated with API credentials use the applicable API billing; a subscription label does not establish API credit or model entitlement.
• Context is not quota: Remaining context window capacity inside an active session represents prompt working space, not available subscription or billing quota.
• Routing status: Account-bound usage observation, reset tracking, and freshness-aware routing remain planned coordinator capabilities rather than live enforced routing.

Replay and recovery

Read-message replay records are retained for 31 days to cover the maximum accepted message lifetime. Restart and broker replay are tested. Crash windows, restoring old state or deleting replay history mean this is not an exactly-once guarantee.

Dashboard and hosted access

The local dashboard requires authentication, binds only loopback, and returns read-only projections. It serves no broker credential file. Remote use requires HTTPS. Hosted tenant identity, SSO and deprovisioning need their own acceptance checks; a shared local password does not satisfy them.

Validation is evidence, not a promise of perfection

Tests cover malformed input, signature tampering, revocation, encryption, replay and native process behavior. Independent security review, human interaction checks and source-matched endurance remain release gates. Report vulnerabilities through the security contact.