zooqueen 2772284fd9 architecture and threat model: what this closes, and what it does not ...

Specifies the outbound credential boundary three tracks build to: egress, the
cloud-side consumer cutover, and the KMS grant. Matches the implementation.

Records the constraint that decides whether any of it is real: kms.hanzo.ai
resolves to hanzo/cloud:8000, so the secrets plane is the cloud binary, its
envelope key is in the same environment, and its authorize() returns nil for
untenanted refs. A compromised sibling could therefore read the credential
in-process without passing through egress at all. The store has to move with the
caller; until it does, the cutover changes where the key is written down and not
who can reach it.

Names three gaps in the current build rather than describing around them: grants
are per-provider so an inference caller also reaches account metadata; the KMS
hop still carries a standing client secret, now the most valuable secret in the
system; and MCL_FUTURE under a low memlock limit fails allocations later under
load, which reads as a random OOM.

States where "unstealable" is overstated: a running egress holds the plaintext,
and no design that makes the call on a caller's behalf avoids that.

2026-08-14 22:52:32 -07:00

..

architecture.md

architecture and threat model: what this closes, and what it does not

2026-08-14 22:52:32 -07:00