irrevon
Security & trust

Model output never holds authority

The primary control is architectural, not procedural: model-generated content reaches the deterministic core only through the validated intent contract, and the advisory classifier’s output cannot reach the gate or resolve APIs. That separation is enforced in code and covered by a conformance test.

Evidence: Design specificationTechnical provenance

Trust boundary

Untrusted, trusted, external

Conceptual
Prose twin: the boundary rules
  • Nothing model-generated crosses into the deterministic core except via the validated intent contract.
  • Advisory output carries no authority — architecturally enforced, and tested (the classifier cannot reach gate or resolve APIs).
  • Credentials live only in the secret store; sandbox-scope only.
  • Only effect metadata and metrics ever cross an external-partner boundary.

Evidence: Design specificationTechnical provenance

Data posture

Minimize payloads; treat the ledger as sensitive

What the ledger stores

The ledger stores intent metadata, raw stable identifiers, dispatch parameters needed for recovery, digests, transitions, receipts, probes, and findings. It does not retain raw destination response bodies, but parameters can contain personal or confidential data when an integrator puts it there. Treat the database and every evidence export as sensitive, minimize payloads, and apply operator access, retention, backup, and deletion controls.

Evidence: Verified evidenceTechnical provenance

Zero runtime telemetry; site analytics disclosed

The engine and the workbench phone home to nothing; the workbench’s no-external-request and read-only properties are enforced by end-to-end tests. This site is static, self-hosts its fonts, and makes no third-party requests. Its only measurement is Vercel’s cookie-free, same-origin Web Analytics and Speed Insights when the owner enables them: query data is redacted by default, visitors have a local opt-out, optional conversion events are allowlisted and plan-gated, and budget tests pin the fetched-script allowance to exactly those two first-party loaders.

Evidence: Verified evidenceTechnical provenance

Credential discipline

Sandbox-only credentials in a secret store; pre-commit secret scanning on every commit. A production-scope credential anywhere is an immediate stop-and-rotate incident.

Evidence: Design specificationTechnical provenance

How this is built

Supply-chain posture you can verify in the repository

Presented as practice, not promise — every control below is visible in the public repo’s configuration and CI.

Scroll table horizontally

ControlPractice
npm lifecycle scriptsBlocked by default (every allowBuilds entry is false); exact pins; frozen lockfiles in CI
Release-age delay7-day publish-to-installable minimum (minimumReleaseAge: 10080) against fresh-package attacks
ProvenanceNo trust downgrades permitted; exotic (git/tarball) transitive dependencies blocked; exclusions are narrow, named, and reviewed
CI actionsSHA-pinned with version comments; workflow linting (actionlint + zizmor, pedantic persona) in the local gate
Secretsgitleaks over the working tree and full history on every check; generic rules, no allowlisted real credentials

Evidence: Verified evidenceTechnical provenance

This site’s own headers, honestly

This site ships real response headers from its edge configuration — frame-ancestors, HSTS, nosniff, a permissions policy, a strict referrer policy — plus a per-page Content-Security-Policy <meta> tag with build-computed script hashes (a static header cannot carry per-page hashes; the meta tag cannot carry frame-ancestors — the two together cover both). script-src carries 'self' for the same-origin Vercel telemetry loaders; inline scripts still execute only with a computed hash. The full set with rationale is committed as a spec: site/docs/headers-spec.md.

Explicit non-claims

What Irrevon is not

  • Not an authorization or approval gateway. Irrevon adjudicates effect identity and reconciliation, not who may act.
  • Not an audit-compliance product. No SOC 2, no ISO certification — none exists, and none is claimed.
  • Not a hosted service. Local-first, no accounts, no billing, no SaaS.
  • The LLM never holds sole authority over an irreversible action. That is a binding design rule, not a configuration option.

Evidence: Design specificationTechnical provenance

Report a vulnerability privately

Use GitHub's private vulnerability-reporting form. Do not put credentials, private identifiers, or an undisclosed vulnerability in a public issue. The repository security policy defines scope, safe harbor, and the no-SLA disclosure posture.

Open the private report form · Read SECURITY.md

Incident taxonomy — public

Declare → classify (Sev-1..3) → contain via the deny-list → preserve evidence first → root-cause with deadlines → close only with a corrective change and a seeded regression test. The full taxonomy lives in the master document; this page links rather than restates.

Master document §12.4

Evidence: Design specificationTechnical provenance

Development threat model — also public

The project is built with AI coding agents under a written execution policy: what agents may touch, what is human-only, and which controls enforce the difference. The policy is a trust artifact in its own right.

docs/security-policy.md

Evidence: Verified evidenceTechnical provenance