Trust boundary for the autonomous core. Owns the autonomy / risk policy, sandbox backends (Docker, Bubblewrap, Firejail, Landlock, Noop), the audit log of agent actions, the encrypted secret store, the public-bind / pairing guard, and the redact() helper used for safe logging. Does NOT own the cross-domain EncryptionEngine (lives in encryption/) or per-channel credential storage (credentials/).
pub struct SecurityPolicy—policy.rs— assemble runtime policy fromAutonomyConfig+ workspace dir.pub enum AutonomyLevel—policy.rs—Supervised/SemiAutonomous/Autonomous.pub enum CommandRiskLevel/pub enum ToolOperation/pub struct ActionTracker—policy.rs— risk classification and per-session tracking.pub trait Sandbox/pub struct NoopSandbox—traits.rs— pluggable sandbox abstraction.pub fn create_sandbox(config: &SecurityConfig) -> Arc<dyn Sandbox>—detect.rs:1— pick the best backend for the host.- Sandbox backends:
pub mod docker,pub mod bubblewrap,pub mod firejail,pub mod landlock— domain-specific implementations ofSandbox. pub struct SecretStore—keyring/encrypted_store.rs(re-exported here) — encrypted-on-disk secret codec whose master key lives in keychain-backed storage.pub struct AuditLogger/pub enum AuditEventType/pub struct AuditEvent/pub struct Actor/pub struct Action/pub struct ExecutionResult/pub struct SecurityContext/pub struct CommandExecutionLog—audit.rs— append-only audit trail.pub struct PairingGuard/pub fn constant_time_eq/pub fn is_public_bind—pairing.rs— pairing-token check before binding the RPC server publicly.pub fn redact(value: &str) -> String—core.rs:3— uniform 4-char-prefix redaction for logs.pub fn security_policy_info() -> RpcOutcome<serde_json::Value>—ops.rs— RPC handler used by the doctor / settings UI.
src/openhuman/config/—SecurityConfig,AutonomyConfigfor policy + sandbox selection.- OS-level sandbox tools —
docker,bwrap,firejail,landlocksyscalls (per backend). - Filesystem under the workspace dir for the audit log + encrypted ciphertext payloads.
src/openhuman/cron/scheduler.rs— wraps shell jobs inSecurityPolicy::from_config.src/openhuman/tools/local_cli.rs,tools/ops.rs, and mosttools/impl/{system,network,memory,agent}/*.rs— every executable tool consultsSecurityPolicy.src/openhuman/tools/impl/network/{curl,http_request,composio}.rs— risk-classify outbound calls.src/openhuman/memory/tools/{store,forget}.rs— sensitive-write tracking.src/openhuman/agent/tools/delegate.rs— sub-agent dispatch goes through autonomy gate.src/openhuman/security/credentials/— usesSecretStoreandredact.
- Unit:
pairing_tests.rs,policy_tests.rs,keyring/encrypted_store_tests.rs. core.rs#[cfg(test)] mod tests— round-tripsSecretStoreencrypt/decrypt,redact()cases,PairingGuarddefaults.- Sandbox-backend smoke: each backend file has its own
#[cfg(test)]blocks where the binary is available.