How children are trusted
Every ordinary surface is admitted only through an Ed25519-verified, expiring, sequence-watermarked release manifest that binds the exact child command, digests, tools, and schemas. Any mismatch fails closed for that surface.
What a manifest binds#
- Absolute command and working directory.
- Exact argv and environment-variable names.
- SHA-256 of the launched binary and a designated code path.
- Exact tool names and the canonical SHA-256 of each advertised input schema.
- Optional credential argument templates that model-supplied arguments cannot override.
Verification mechanics#
The detached Ed25519 signature covers the domain-separated raw manifest bytes. The manifest uses strict JSON, positive sequence numbers, an RFC 3339 UTC expiry, and unique surface/tool names. The trust store selects one configured public key. The watermark rejects sequence rollback and is atomically advanced; trust store and watermark must be regular, current-user-owned files with no group/other permissions, and all four release variables must be absolute paths.
Launch-time checks#
- cwd and absolute code arguments must remain inside the workspace.
- The command must be inside the workspace or be the exact current Node or `/usr/bin/python3` executable.
- Binary/code digests must equal the manifest.
- Child `tools/list` must exactly equal the signed names and schema digests.
- Model arguments cannot overwrite signed credential templates.
- Las constructs child environments from a fixed system `PATH` and explicit per-surface names — it does not inherit the complete parent environment.
Skarbiec and Finance special policies#
Skarbiec: Las permits only `health`, `capability_available`, and `capability_request`, pins their schemas/descriptions, validates a bounded purpose/resource/target taxonomy, limits TTL to 60 seconds, use count to one, and delegation depth to zero, and validates exact result envelopes. It returns only availability or opaque capability IDs — never redeemed credentials.
Finance: not admitted through the ordinary signed-manifest map. It activates only when all finance policy/state/key/binary-digest variables are set, verifies the exact binary digest and a local proposal-only policy fingerprint, and permits only `finance_propose`, `finance_status`, and `finance_cancel`. Names containing execution/approval/signing/broadcast/beneficiary/policy verbs are rejected. This is still a local guard; the child must enforce its own proposal-only and financial authorization checks.
Recovery#
An invalid, expired, or rolled-back release, byte/schema drift, missing build/configuration, child exit/error, or policy rejection fails the affected surface while federation can remain partially available. Recovery: deploy a new signed higher-sequence release, repair exact child builds/configuration, restart Las, and repeat `las check` for the affected surface.