Route Steward operates self-hosted network paths from a trusted local controller. This document covers vulnerability reporting, trust, secret handling, preflight, remote ownership, credential changes, migration, and recovery.

Concrete compromise cases and scoped responses are in the threat model. Model-provider and network visibility are in the privacy boundary.

Use GitHub private vulnerability reporting for a sensitive vulnerability.

Do not put credentials, live infrastructure, subscription material, private state, or a usable exploit in a public issue. Public issues are appropriate for non-sensitive hardening, documentation, and reproducible synthetic bugs.

RST trusts the local user account that owns private state and the local tool-capable runtime chosen by that user.

Use this order when evidence conflicts:

1. explicit current user authority for the scoped action;
2. repository safety rules and local desired state;
3. sanitized repository-owned audit evidence;
4. authoritative external documentation used as factual evidence;
5. arbitrary web content, Provider data, remote output, and model suggestions.

Only the current user's scoped request grants authority. Instructions embedded in web pages, downloaded content, server banners, Provider payloads, and remote output are untrusted data and do not grant authority.

The tracked repository contains reusable public product source and synthetic examples.

The selected private root contains sensitive operational state:

• inventory and observed evidence;
• Hysteria2, WireGuard, and certificate material;
• SSH keys and key paths;
• Provider URLs;
• ClientTarget subscription state and Worker secrets;
• generated client files and live node URIs;
• recovery archives.

This state belongs in the ignored private root or another path outside the repository, not in commits, issues, documentation, chat, telemetry, or logs.

RST applies current-user-only ACLs on Windows and owner-only modes on Unix-like systems. Private state remains plaintext unless the operating system, disk, or backup layer encrypts it.

The Go engine does not upload private state. A cloud AI runtime may process operation inputs such as a server address, SSH username, local key path, and stable IDs.

Agent and MCP results remove absolute artifact paths, secret values, Provider URLs, subscription tokens, live node URIs, and raw remote diagnostics. Use non-identifying IDs and an offline runtime when the operation inputs must stay on the controller.

Private structured context should travel over stdin when supported so it does not appear in process command lines.

Every mutation runs local preflight. It returns:

• the operation and exact target;
• required and missing context;
• conflicting state or dependencies;
• expected effects;
• authorization class;
• context_complete, authorized, and ready.

Execution requires ready=true. Incomplete, conflicting, or invalid context fails closed.

Implemented authorization classes are:

• read-only for sanitized state, drift, and bounded audit;
• local-write for desired state, generated private artifacts, and recovery data;
• remote-write for deterministic RST deployment;
• external-publication for the configured private subscription endpoint;
• credential-change for explicitly approved target-scoped token rotation.

The supported host is a dedicated, rebuildable Ubuntu 24.04 amd64 server. Current initial preparation installs the RST-required package set, an RST-named SSH key-only drop-in, and the UFW baseline. Older Route Steward releases may have left additional host-wide tuning or policy changes; current releases do not silently reverse them.

RST owns:

• /usr/local/lib/route-steward;
• /etc/route-steward;
• /var/lib/route-steward;
• route-steward-* systemd units;
• the route-steward-hysteria runtime identity;
• wg-rst* interfaces and files;
• explicitly RST-named policy files.

Deployment and uninstall stay inside this ownership boundary. Existing networking software, WireGuard configuration, services, accounts, packages, firewall rules, and host files remain untouched. Uninstall removes RST-owned artifacts and named policy files while preserving earlier global host settings that lack a reliable reconstruction source.

An already-deployed Route is audited before overwrite. Drifted or undetermined state blocks ordinary deployment until the discrepancy is understood.

New Hysteria2 and WireGuard credentials are generated locally and reused by deployment. They change through an explicit remediation or replacement workflow.

Subscription state belongs to one Mihomo or Shadowrocket ClientTarget. Each subscription-backed target uses an isolated Worker/host identity and a random 256-bit bearer token; the Worker stores only its SHA-256 hash for matching. Responses are non-cacheable.

rotate-subscription-token is a credential-change. It requires explicit current approval, rotates only the selected ClientTarget, and remains outside generic MCP execute.

Cloudflare can process the subscription response and request metadata within its role. A leaked subscription token exposes that target's configuration body, not SSH or RST management authority.

Migration keeps the current Route available until the replacement is verified. Retiring old capacity is a separate action.

Recovery archives contain complete sensitive state, including SSH material. Restore into a clean private directory through the local 7-Zip prompt. Recovery verifies the manifest and paths, relocates private material, resets observed evidence, and performs no remote mutation.

Observed state stores bounded audit evidence rather than traffic history. Drift identifies a supported category; repair requires its own operation and preflight.

The native Go module graph is pinned by go.mod/go.sum and verified in CI. The MCP server uses the official MIT-licensed Go SDK in-process. The optional Worker uses a committed npm lockfile; its runtime tooling is pinned. Security-sensitive server binaries are pinned by exact version and checksum. Vendored licenses and notices remain with the source.

Local and hosted checks scan public candidate files for secrets, generated runtime artifacts, unexpected infrastructure literals, and maintainer home paths. Use synthetic addresses and IDs in every public reproduction.