Security, privacy, and the operational model
Las holds no general secret store. Signed templates and child-specific secure channels carry approved authority; the operator protects the release material that grants it.
Security and privacy#
- Protect trust-store private provenance, watermark state, signed manifest, policy files, and Skarbiec/Finance configuration from unauthorized changes.
- Las uses public verification keys, not signing keys. Never place a manifest private signing key in the workspace or a child environment.
- Ordinary child environments reject raw-secret variable names — use Skarbiec or child-owned secure transport rather than broad environment inheritance.
- Credential templates are operator-signed fixed arguments; review them as authority-bearing release content even when they are opaque identifiers.
- Child tool results can contain sensitive customer or operational data; Las does not redact ordinary child results.
- Child stderr is discarded by Las — operate child-specific logs separately when diagnostics are required.
- Children run under the Las OS account; use OS sandboxing and least privilege where product risk requires stronger isolation.
Operational model#
- Configuration: static source registry, signed release files, trust store, watermark, operator filters, explicitly allowed child variables, and optional Stado onboarding integration variables.
- State: in-memory memoized federation, child processes, pending requests, persistent sequence watermark, and device-scoped onboarding progress with an offline event queue.
- Observability: CLI JSON, first-use journey events, generic per-surface stderr availability/failure lines, child-owned logs, and MCP errors.
- Cost: local processes and child service usage; a managed organization catalogue/governance offering is a separate platform surface.
Open core and managed platform#
The local catalogue and tool federation are the community surface (`las.local`). A future managed platform may sell organization catalogue, release/governance distribution, and fleet operation under `platform.organization-catalogue`. A missing managed grant must fail closed only for that organization catalogue — it must not disable the local catalogue and federation.
Status and support#
- Maturity: public development source; coordinated workspace/release provisioning required.
- Compatibility: Node.js 18+, macOS/Linux-style local workspace paths as encoded by the child registry, and stdio MCP 2024-11-05.
- Issues: github.com/wisent-ai/las/issues; report security privately through GitHub Security Advisories without signed release material, internal paths, policy files, identifiers, child outputs, or credentials.
- License: Apache License 2.0.