ShiftLock’s security model is opt-in and fail-closed for privileged operations.
- Ownership & fencing — claims, generations, monotonic fencing tokens (always on for coordination).
- Authorization — capabilities (
capability/) and policy (guard/) when enabled. - Integrity — Ed25519 signing (
security/signing), config bundles (configlock/), audit hash chains (audit/). - Containment — maintenance, lockdown, quarantine, exec allowlists (
control/*). - Detection — scanner (
security/scanner), red-team harness (security/redteam), snapshots with redaction.
| Control | Default |
|---|---|
| Privileged ops | Denied when guard/capabilities enabled |
| Shell execution | Denied (empty allowlist / dry-run) |
| Unsigned production config | Rejected when signatures required |
| Anti-replay cache | Bounded max entries |
| Event / election buffers | Bounded; drop on overflow |
| Barrier waiters / participants | Hard-capped by MaxParticipants |
| Task restarts | Bounded (not infinite) |
| Lockdown unlock | Requires expected ID + confirm + strong auth |
- Stale fencing tokens cannot overwrite newer ownership (CAS / token checks).
- Capability delegation cannot widen permissions.
- Security epochs do not decrease; advance invalidates prior capabilities.
- Audit verification detects mutation, removal, and sequence gaps (tamper-evident, not tamper-proof).
- Snapshots and incident bundles redact secret-looking fields.
- Diagnostics omit connection strings / credentials.
- Hosted multi-tenant SaaS control plane
- Arbitrary remote shell
- Perfect mutual exclusion from leases alone under a malicious backend
- Hardware-backed keys / mTLS principal binding (application responsibility; hooks only)
SecurityProfile expands to inspectable SecuritySettings (ProfileTesting, ProfileStandard, hardened/maximum variants). Overrides are explicit — no silent production weakenings.