# Security boundaries and release review

HOLD separates the sandboxed renderer, trusted desktop broker, local inference process, approved project folders, isolated test containers, paired devices and optional external connections. Model output, tool responses, imported data and project documents are untrusted. Tool permissions are enforced outside the model.

## Enforced boundaries

| Boundary | Enforcement | Recorded verification |
| --- | --- | --- |
| Desktop renderer | No Node integration; Chromium sandbox/context isolation; restrictive CSP; navigation/new windows blocked; IPC restricted to exact main frame and named operations | Native desktop acceptance and controller rejection tests |
| Curated models/runtimes | Immutable publisher revisions, full SHA-256, exact lengths, approved redirect hosts, pinned runtime manifests checked before packaging | Download/runtime tests, actual CPU/Vulkan/CUDA runs and archive validation |
| Local imports/updates | Bounded GGUF metadata parser, full streaming hash, copied content-addressed file; updates from fixed catalog publisher only, separate native check/install review, current version retained | Import/update tests and actual native import/restart |
| Inference transport | Ephemeral authenticated loopback listener; bearer withheld from renderer; fixed executable/arguments without a shell | Actual unauthorized request returns HTTP 401; real inference and cancellation |
| Project access | Native root grant; bounded text only; sensitive paths excluded; traversal/UNC/ADS/device/link/hardlink rejection; open-file identity checks | Adversarial paths plus actual Windows link/junction tests |
| File changes | Immutable one-use reviewed proposal, exact previous contents, native confirmation; encrypted durable multi-file journal and compare-before-restore | Actual edits/checkpoints/restart; crash and conflict recovery tests |
| Git | Selected exact files/diffs; repository metadata containment; hooks, external filters/diff and inherited configuration suppressed; native mutation approval | Actual Git fixtures and native UI acceptance |
| Local test execution | Fixed pinned Node Linux image; copied approved source only; no original project mount; read-only root/source; UID 65534; no network/caps; default seccomp/no-new-privileges; CPU/memory/PID/tmp/output/time limits; inspect before start | Actual Docker boundary tests and native UI run/cancel/cleanup |
| Cleanup uncertainty | Owned-container lease persists; failed/unknown cleanup blocks subsequent runs; no automatic job replay | Failure/cancellation/timeout/output-overflow and durable lease tests |
| Agents/delegation | Persisted per-agent grants intersect at each delegation; shared task/time/token/tool/depth limits; one inference slot; no unrestricted host shell or spending | Queue/delegation/cancellation/loop/permission regressions and actual local agents |
| MCP and websites | Explicit endpoint/host/tool grants; OS-protected credentials; exact native approval; bounded output; redirects and private-address egress refused | Adversarial connection/web tests and native approval fixtures |
| Photos | Bounded PNG/JPEG input; isolated Chromium decode with no Node/network/files; pixel/dimension/output limits; metadata-free JPEG result; compatible vision model required | Actual local vision and native attachment/edit/export/restart tests |
| Voice | Trusted main-frame audio grant expires; one-minute local capture; transcript reviewed; fixed local speech helper with bounded PCM/output/time; text only, no SSML | Actual installed Windows synthesis/transcription and capture-permission fixtures |
| Search | Pinned local embeddings, OS-encrypted indexes, source hashes and scoped opaque handles; memory opt-in; deletion/edit/disable invalidation; no automatic prompt insertion | Actual Nomic retrieval and saved-history UI/restart tests |
| Pairing | Off by default; explicit private interface; expiring one-use invitation; native device approval; pinned TLS plus signed requests; replay/session/rate/budget checks; revocation cancels work | Real TLS protocol tests, desktop UI and Android native pairing |
| Remote requests | Exact provider/model/input review; credentials in protected main process; no unapproved transfer; bounded streaming/output/cancel; no replay after restart | Owned endpoint and native Power acceptance |
| Storage/import | Serialized atomic writes and encrypted backups; strict schema; fresh permissions required after import; corrupt data preserved; prior backup removed on deletion | Core corruption/concurrency/import tests and native encrypted restart |

An external tool or remote request can intentionally transmit approved data. Approval is a capability for that specific disclosed operation; it is not proof that the recipient is trustworthy. Provider terms and retention remain the provider's responsibility. Paid execution stays disabled when a real provider cannot enforce the disclosed cap. Public contributor workloads are not admitted to the desktop runner.

## Threat-model limits

The local llama.cpp parser is a native user process, not a hostile-model OS sandbox. Curated hashes verify provenance/integrity, not absence of exploitable parser bugs. Arbitrary GGUF imports are explicitly unreviewed. The container runner isolates test code; it does not retroactively sandbox the model parser or make Docker immune to kernel vulnerabilities. Keep the OS, Docker and native runtime patched and use trusted models.

A process already running as the same OS user can read memory or race filesystem operations. File identity checks and atomic writes defend normal use and static escapes, not a compromised account. OS-backed encryption depends on that account. Models and original project files are not encrypted by HOLD. Portable exports are plaintext. Logical deletion does not guarantee SSD erasure, and exported/system-backup copies remain outside the app's control.

Windows speech depends on installed language resources; native synthesis/transcription tests do not certify physical microphone hardware or answer accuracy. Android emulator acceptance does not establish physical-device thermals, battery life or iOS security. Runtime archives for macOS/Linux and prepared build workflows do not establish native-platform certification.

## Dependency and release review

Fresh owner-approved registry audits on 2026-10-15 reported zero production findings and eight moderate development-tool findings. Fresh mobile audits reported fifteen high entries propagated from upstream build/development dependency roots. Those findings and dependency-scope analysis are retained; a production bundle inspection is not a substitute for an updated advisory audit. The owner explicitly authorized the dependency-metadata audit; fresh full and production reports are saved. The reviewed [sprintf-js advisory](https://github.com/advisories/GHSA-hp3w-g68c-fv3c) lists no patched version. Mobile upstream patch availability is recorded in mobile-audit-remediation-v2.json. Forced downgrades of Electron Builder, Expo or React Native were not applied merely to suppress findings.

Source review and adversarial tests are useful evidence, not a penetration-test certification. Release requires owner signing identities, final license/security review, clean-device testing on the advertised platforms, verified artifact provenance and explicit publication approval. No public marketplace, payment settlement, public deployment or automatic paid workflow is enabled.

See [verification](/reference/docs/VERIFICATION.md), [requirements](/reference/docs/REQUIREMENTS.md), [isolated execution](/reference/docs/isolated-execution-v2.md), [agent execution](/reference/docs/agent-execution-v2.md), [pairing](/reference/docs/pairing.md) and [privacy](/reference/PRIVACY.md).