Security and credentials

This guide describes implemented work brought from the former 0.67 branch into the planned 0.71.0 release, with integration still unfinished. It is not a published-build, independent-audit, or whole-product security certification.

Grid already has encrypted document storage, credential stores, authorization rules, and peer networking. This work strengthens those existing owners and connects their checks; it does not introduce another calculation engine or ask models to implement cryptography.

Encrypted documents

New document manifests authenticate their complete metadata with a dedicated key derived from the existing encryption key. Opening a document also bounds password-derivation settings before expensive work or cache lookup. Existing payload encryption is reused; this change does not require rewriting every encrypted payload.

An authenticated legacy document opens read-only. Writes require an explicit manifest-authentication upgrade tied to the exact document revision, with acknowledgment that the old document's historical authenticity is unverified. Opening or closing the document does not silently accept that acknowledgment. Malformed or unauthenticated documents do not become editable legacy documents.

The upgrade retains recovery evidence. If interrupted, preserve the document and its recovery files. Do not delete them or substitute an unsigned manifest to force the document open. The upgrade protects subsequent state; it cannot prove the origin of historical content.

Example: explicitly upgrading an opened legacy document

Open the document through the existing authenticated desktop service and read its documentId and legacyManifestSha256 from the read-only status. Review the authenticity warning before choosing to acknowledge it. The authenticated request to POST /api/desktop/v1/upgradeManifestAuthentication has this shape; replace both placeholders with values from that same opened document:

{
  "documentId": "<opened-document-id>",
  "sourceManifestSha256": "<exact-legacy-manifest-digest>",
  "acknowledgeUnverifiedHistory": true
}

The placeholders are deliberately not usable identifiers or digests. A changed source, missing acknowledgment or mismatched digest refuses the upgrade. After an external document change, reopen and inspect the new status; do not blindly retry with a newly substituted digest. Retain the historical-authenticity warning and recovery evidence after success.

Credentials and external requests

The new native instance vault builds on Grid's existing encrypted storage, permissions and atomic writes. Credentials have specific purposes and versions: a provider key, a peer-network key and a login credential are not interchangeable. A key identifier is not permission to read or use its value.

The managed-request design gives the native request owner temporary permission for a specific operation. It must check the current credential and destination at the point of sending. Closing the owner or changing the credential cancels old permissions. Selected paths must refuse unavailable authority instead of switching to an environment key or an unsigned request.

Integration is incremental. Existing provider configuration is not automatically migrated by these APIs, and the ordinary managed peer-network startup and delivery composition are still under development. A native test or registered component alone does not make a managed service available to an application.

Peer delivery and recovery

The managed delivery foundation reuses Grid's retained peer-delivery queue. Before a send, it durably holds the whole delivery and creates a temporary, nonrecoverable send permission. Each selected binding can be issued once under that permission. A crash, incomplete response, or partial success leaves uncertain work on hold for review instead of automatically sending it again.

A matching admission receipt says the receiver admitted that subset. It is not proof that the receiving model applied it. Completing the whole retained parent also requires accounting for all its remote subsets and local operations. Requeueing is safe automatically only when the owner can establish that nothing was sent or locally applied; otherwise an operator must review the uncertainty.

The first direct sender uses the existing legacy HTTP/HMAC protocol with exact numeric destinations. It does not provide TLS confidentiality or authenticate responses. It is not a substitute for selected peer HTTP v2/mTLS transport and does not make strict-mission remote transport available. Unsupported transports and credential consumers remain unavailable until their own integration is complete.

A managed source marker binds saved work to its vault incarnation and peer policy. An old or default credential configuration cannot reopen that marked source. Recreating a vault at the same path does not restore the old authority. Preserve saved state and use explicit recovery or migration; do not downgrade or delete state to bypass a refusal.

Pairing and assurance limits

LAN pairing remains unavailable until the reviewed replacement protocol is integrated. Previously saved peers remain visible for blocking or forgetting, but visibility does not retroactively authenticate those relationships or prove that every configured transport reference has been revoked.

Focused tests cover implemented storage, credential and delivery boundaries. Independent cryptographic review, remaining provider and peer integrations, cross-platform recovery checks, performance measurements, and packaged-product validation are separate unfinished work. Encryption does not lower a model's data sensitivity, and this work does not claim whole-program information-flow verification.