01 / PROPOSAL
Intent
The actor states what it wants to change and why. No filesystem effect.
Security & trust
Local is not the same as trusting.
Intralock holds private data and exposes it to browsers, agents, and extractors. The design assumes hostile documents, curious local processes, leaked tokens, and prompt injection — and makes each boundary explicit rather than implicit.
01 — Threat model
Seven zones, validated crossings.
Authority is re-established at every zone boundary. Seeing a daemon URL does not grant filesystem access; HTML extracted from a file never arrives as trusted application code; text from a model never becomes a shell command.
| Zone | Contains | Crossing rule |
|---|---|---|
| A · OS & accounts | Files, user identities, disk | Containment checked after symlink resolution |
| B · Daemon & catalog | SQLite, policy, audit, tokens | Only the daemon writes; one elected writer |
| C · Browser session | Rendered HTML, HTMX fragments | Origin, CSRF, session, capability checks |
| D · Extractors | Untrusted parsers | Subprocess, fixed temp dir, no secrets, no network |
| E · Models | Optional inference | Context manifest compared to authorization |
| F · Plugins & runners | Allowlisted tools | Typed arguments, limits, explicit approval |
| G · Remote clients | Authenticated API/MCP | OAuth audience, issuer, client binding |
Stated limit. An unprivileged application cannot defend against a privileged machine user who edits catalog files directly. The design names that boundary instead of pretending to close it.
02 — Traversal
Never authorize a request by concatenating a path.
A client supplies a logical object ID. The server resolves it through the catalog, re-resolves the root identity, normalizes the path, validates containment after symlink resolution, and checks file identity again immediately before writing.
Archive entries, extracted filenames, hard links, case-folded volumes, Unicode confusables, junctions, and ambiguous separators are all treated as possible traversal or collision sources. Symlinks outside the approved workspace are not followed by default.
Untrusted parsers run in a constrained subprocess or a stronger isolation boundary: fixed temporary directory, no inherited secrets, bounded file descriptors, CPU, memory, time, and output bytes, and no network by default. Scripts found in scanned repositories are never executed during indexing.
If full OS sandboxing is unavailable, the feature is disabled or labeled reduced-assurance. It is not called sandboxed.
Write protocol
- Named operation
- Not a generic “write file” surface.
- Affected IDs
- Explicit set, with a
max_effectsbound. - Preconditions
- Expected digest and revision.
- Destination
- Allowed paths, rechecked per effect.
- Recovery
- Staged file, journal, rollback copy.
- Partial state
- Explicit
partially_applied, never silent success.
03 — Identity
Tokens are shown once. Sessions are scoped.
Local interactive sessions use secure, HTTP-only cookies with SameSite and anti-CSRF measures. API tokens are high-entropy, narrowly scoped, rotatable, revocable, and never recoverable in plaintext after creation.
Grants bind actor identity, workspace, allowed capability set, and expiration. Only a non-reversible verifier is stored. Failed authentication is rate-limited without creating a trivial denial-of-service.
Remote MCP follows the selected protocol revision's authorization requirements: OAuth discovery and resource metadata where applicable, redirect URI and issuer validation, audience restrictions, and client identity binding. A token minted for another resource is rejected.
Exposing a loopback session through a tunnel without a deliberate remote-authentication architecture is forbidden by the deployment guidance.
texttoken lifecycle
issue → high-entropy, scoped, expiring store → verifier only (never the token) use → actor + workspace + capability check rotate → new token, old verifier revoked revoke → immediate denial, no cache window audit → ID, digest, decision, timestamp
04 — Content
Documents are data. Full stop.
Some files will contain instructions aimed at agents. Intralock treats retrieved workspace content as labeled data. A document saying “ignore previous instructions” can be quoted as evidence; it cannot gain authority.
Models — when enabled at all — never receive credentials, hidden policy details, out-of-scope files, or arbitrary full-directory dumps. A context manifest is built before the call and compared to the authorization decision.
A model-generated request for new credentials or broader scope is rejected unless a human approves it separately. Cross-file attacks, where one document tries to make the model copy another into an export or URL, are explicit test fixtures.
No-model mode makes zero network calls for inference and can produce diagnostic evidence of that fact.
Model-call ledger
Consent status · actor · provider or local engine · operation · input references and hashes · output digest · model version · token usage if known · timing · policy result · retention.
Enough trace to reproduce a decision — without retaining every confidential prompt forever.
05 — Approval
Four objects, not a boolean.
Approval is a chain of bound artifacts. If any material precondition changes, the approval becomes stale and the action returns to preview. A row in a task table cannot authorize a write.
02 / PREVIEW
Exact state
Resolved objects, three-way diff, preconditions, and expected side effects, hashed.
03 / DECISION
Named approver
A human identity bound to that preview hash, with scope and expiry.
04 / RECEIPT
Actual effects
Re-checked scope and versions, post-write digests, rollback reference, ledger entry.
Multi-file atomicity. A filesystem rarely offers a portable cross-file transaction. Use a write plan, staged files, a journal, checkpoints, rollback references, and an explicit
partially_applied state. Irreversible effects — external webhook, secure deletion, OS command — carry prominent warnings.06 — Data protection
Minimize, classify, expire.
Credentials, private content, derived excerpts, embeddings, workspace structure, identifiers, activity, audit metadata, and telemetry each get a purpose, storage location, retention, export policy, and permitted exposure path.
Audit events store IDs, digests, status, duration, and redacted error types — not document snippets or bearer tokens. Configuration is stored separately from secrets. Encryption at rest leans first on OS full-disk protection and file permissions; application-level encryption needs a real key-management and recovery model.
A “forget this indexed content” operation removes derived data and pointers and explains that it does not delete the original file or separately owned backups.
Incident controls — no AI required
- Freeze new writes
- Revoke agent grants
- Stop task runners
- Preserve audit evidence
- Recover from bounded revisions
- Verify catalog consistency
- Reopen read-only