Security Model

Security Model

The rules that hold the whole system together are ten invariants, written in AGENTS.md and enforced by tests, lint rules and infrastructure policy. Breaking one is a build break, not a review comment.

The ten invariants, in plain words

	Rule	How it is held
INV-1	No long-lived credential ever reaches the television. It holds one device-bound token for one household and nothing else. Assume it can be extracted.	Short-lived tokens; a long random secret per television where the platform can keep a file; no Ring, AWS or Bedrock credential in either TV app
INV-2	Every family-bound string passes through the Guardian. There is no second path.	One MCP server, made behind the gate; only the guarded routes serve a family television; a lint rule keeps the transports in one module
INV-3	No Ring media is kept beyond 24 hours.	The bucket's lifecycle policy, not application code
INV-4	Nothing protected, and nothing verbatim, reaches the family. Health, money, relationships, location and speech.	A deterministic lexicon, no model; property tests through the real tool paths
INV-5	Deferred cards never render during a scene. Only the door is immediate.	Property tests on the break engine
INV-6	Every agent tool call is idempotent and correlated.	A correlationId from ingress to the device and back; write tools claim each call once
INV-7	She sees her week before the family can read it.	Enforced on the write path
INV-8	The household comes from a verified token, never from a request.	No tool, route or Lambda takes a household id from a body, URL or environment
INV-9	Nobody reads a household before the resident allows them.	Only her press makes a membership allowed; every tool call asks again
INV-10	Nothing different leaves the house before she says so.	The family can never tell "kept" from "nothing happened"

Credentials

• CI holds no AWS keys. GitHub Actions authenticates over OIDC. The deploy role is narrow: it can change the stack but is explicitly denied the data plane, so merging to main does not give anyone the ability to read a household.
• Ring tokens are one Secrets Manager secret per household. Only the Ring link and the hourly refresh lambda touch them, and the Wick server never sees one.
• The release signing key for the Fire OS app is readable only by a tag-only release job in a protected environment.
• .env is a laptop file. Exactly one module reads it, and it is never baked into an image.
• Spend is bounded. An anonymous visitor's assistant, hearing and demo-account budgets are counted in the database across all instances, and an automatic AWS budget action attaches a deny policy to the model-calling roles at 100% of the monthly budget.

Threat model, briefly

Threat	What bounds it
A television's token is extracted	It is scoped to one household, expires, and grants nothing over Ring, AWS or any family surface
A family member is removed or turned down	It takes effect on their next request
Someone who knows a simulator's id	The simulator is only ever paired to demo homes; its tokens live an hour and are refused wherever a secret is held
A model says something it should not	Models never decide what is protected; the Guardian and a Bedrock Guardrail read the output
A replayed Ring webhook	HMAC verification and idempotent handling
An anonymous visitor runs up model spend	Durable per-person and global budgets, a scaling cap, and an automatic spend brake

The full model, with the known accepted exceptions written out and bounded, is in section 10 of the technical document and in AGENTS.md.

Reporting a problem

Open an issue on the repository. Do not include real household data, tokens or captures.