Paired device identity
Each device owns a P-256 key. Requests sign the method, full path and query, timestamp, nonce, and body digest.
Security architecture
The supervisor cannot promote itself.
Sleep Mode is built around one invariant: a run can request more authority, but it cannot grant, infer, or manufacture that authority.
Effective permission
Organization∩Project∩Device∩Provider∩Run
Deny always wins.Defense in depth
Six controls between a prompt and an action.
The model never decides whether it has permission. Every authorization decision happens in deterministic code outside the model context.
Immutable run policy
The repository, goal, deadline, budgets, capabilities, and provider limits are signed before the local daemon launches work.
Local final enforcement
Cloud decisions are proposals. The Rust daemon verifies the signature, target, expiry, workspace, local ceiling, and exact action again.
One-action approvals
Supported provider requests bind to a canonical action digest and a crash-safe local marker immediately before release.
Fail-safe liveness
Four minutes without a newly accepted signed event pauses the run. Late replay never resumes it automatically.
Evidence, not summaries
Events, decisions, receipts, and morning briefs retain hashes, signatures, causal links, and tenant-scoped access.
Trust boundaries
Cloud coordination. Local authority.
Cloud control plane
Durable policy, normalized metadata, approvals, commands, alerts, and audit projections.
Local Rust daemon
Provider sessions, device private key, offline journal, workspace access, and the final execution decision.
Provider connector
Structured protocol translation with an explicit capability ceiling for each provider.
Human operator
Can approve a bounded action or arm a new policy; cannot mutate a command already in flight.
Hard rules
What Sleep Mode will never do.
- Turn a cloud response into an arbitrary shell string
- Auto-approve network access, payments, secrets, or destructive actions
- Replace a failed provider resume with a silent new session
- Copy full terminal transcripts to the cloud by default
- Treat repository text or model output as authorization
- Claim success without a signed device receipt
Private alpha posture
Security claims should be falsifiable.
The repository includes an ASVS-informed assessment, production isolation probes, Workerd integration tests, incident drills, dependency audits, signed release evidence, and explicit open launch blockers. An independent third-party penetration test remains required before public launch.
Inspect the architecture