Version: Current
Historical release snapshot. These docs are frozen. Read current docs.
Trust Controls
Trust Controls
Section titled “Trust Controls”This page lists platform security controls and the evidence behind each one. Every row carries the date it was observed. The page reports evidence status only. It makes no SOC 2, ISO 27001 or legal assurance claim.
Important: This is evidence of controls, not a guarantee of security.
not_evidencedandpartialmark areas where evidence is missing or incomplete.
Control Status
Section titled “Control Status”| Status | Meaning |
|---|---|
| evidenced | Verified, with supporting evidence |
| partial | Some evidence, but incomplete |
| not_evidenced | No evidence recorded |
Controls
Section titled “Controls”| ID | Control | Products | Status | Evidence | Observed | How Checked |
|---|---|---|---|---|---|---|
AUTH-OIDC-001 | OIDC authentication with passkey-first flow (Pocket ID) | auth, studio, console | partial | src/content/docs/surfaces/auth.md | 2026-11-05 | Reviewed auth surface docs in this repo; docs state passkey-first OIDC and fail-closed behavior but do not include full OIDC/PKCE config or test output. |
AUTH-PASSKEY-002 | Passkey/WebAuthn support for authentication | auth, studio, console | partial | src/content/docs/surfaces/auth.md | 2026-11-05 | Auth docs state passkey-first flow and owner passkey login verified on 2026-11-02; no per-host/live verification run in this worker session. |
AUTHZ-TENANT-003 | Authorization/tenant boundary enforcement (foreign IDs return 404) | acumen, console, studio | not_evidenced | None | 2026-11-05 | No tenant-boundary tests or code references available in this docs checkout; PROGRAM-SECURITY ledger not present locally. |
AUTHZ-SCOPES-004 | Per-tool scopes in tcp-mcp | acumen, tcp-mcp | not_evidenced | src/content/docs/surfaces/acumen.md | 2026-11-05 | Acumen surface docs reviewed; no tcp-mcp scope implementation/test evidence present in this repo. |
AUDIT-AUTH-005 | Audit log entries for authentication/authorization actions | acumen, console, auth | not_evidenced | None | 2026-11-05 | No audit schema, log samples, or test output available in this checkout. Runtime audit records must live in suite Postgres per DB-first rule; no DB evidence collected. |
SECRETS-REF-006 | Secrets referenced by path/name only, never by value | acumen, console, docs | partial | README.md, src/content/docs/index.mdx | 2026-11-05 | Docs repo guidance states no credential values and pages name env vars/paths/key IDs; this is repo-local documentation evidence, not a full product scan. |
SECRETS-NO-LOG-007 | No secret values in logs or UI | acumen, console | not_evidenced | None | 2026-11-05 | No runtime log/UI evidence or tests in this docs checkout. |
SSRF-GUARD-008 | SSRF protection in Studio | studio | not_evidenced | src/content/docs/surfaces/studio.md | 2026-11-05 | Studio docs reviewed; no explicit SSRF guard implementation or tests found in this repo. |
RATE-LIMIT-009 | Per-IP authentication rate limiting | acumen, console, auth | not_evidenced | None | 2026-11-05 | No rate-limit config, middleware, or test output available in this docs checkout. |
CSRF-010 | CSRF protection for state-changing operations | console, acumen, auth | not_evidenced | None | 2026-11-05 | No CSRF/Origin protection implementation or tests available in this docs checkout. |
BACKUP-SCRIPT-011 | Fleet backup script exists and is tested | ops | partial | tools/deploy.sh | 2026-11-05 | Docs deploy script creates a timestamped backup of the target directory before rsync; this is local repo evidence only, not fleet-backup/restore test evidence. |
BACKUP-RESTORE-012 | Restore drill results documented with date | ops | not_evidenced | None | 2026-11-05 | No restore drill results found in this repo. Owner approval required for restore-over-live-data actions; none performed. |
TLS-EVERYWHERE-013 | TLS 1.2+ on public endpoints (read-only live check) | acumen, console, docs, chat | partial | scripts/trust-live-check.sh, scripts/trust-live-check-output-20261105.txt | 2026-11-05 | Read-only curl checks from this worker environment on 2026-11-05 (committed output). tcp.systems/ai.tcp.systems reachable with curl TLS verify result 0; chat.tcp.systems returned HTTP 502; docs.tcp.systems TCP 443 not reachable from this environment. Not a fleet/CI/per-host guarantee. |
TLS-CERT-VALID-014 | Valid TLS certificates on public hosts (read-only live check) | acumen, console, docs, chat | partial | scripts/trust-live-check.sh, scripts/trust-live-check-output-20261105.txt | 2026-11-05 | Read-only curl checks from this worker environment on 2026-11-05 reported ssl_verify_result 0 for tcp.systems, ai.tcp.systems, chat.tcp.systems. docs.tcp.systems unreachable from this environment. Environment-dependent; not a certificate inventory or fleet guarantee. |
DEP-PINNING-015 | Dependency pinning via lockfiles | docs | evidenced | package-lock.json, pnpm-lock.yaml, package.json | 2026-11-05 | Repo contains npm and pnpm lockfiles; AGENTS.md/ci require both to stay in sync. Lockfile parity check attempted in this environment (see evidence log) and is environment-dependent. |
SBOM-016 | SBOM generation | docs | not_evidenced | None | 2026-11-05 | No SBOM artifact or generation output found in repository. |
VULN-SCAN-017 | Vulnerability scanning | docs | not_evidenced | None | 2026-11-05 | No vulnerability scan results found in repository. No third-party probes performed. |
INCIDENT-RUNBOOK-018 | Incident/runbook documentation exists | ops, docs | partial | src/content/docs/runbooks/index.md, src/content/docs/runbooks/status.md | 2026-11-05 | Runbook pages exist in docs repo; completeness/currency for all products not verified from this checkout. |
STATUS-HONESTY-019 | Status page shows unprobed/unknown/degraded states honestly | status, docs | partial | src/content/docs/surfaces/status.md, /home/kivox/wt/ops/SUPPLY-CHAIN/docs/trust/verification-2026-10-20.md, scripts/trust-live-check-output-20261105.txt | 2026-11-05 | Reviewed status surface docs and dated ops verification (2026-10-20). Live probes on 2026-11-05 from this worker showed mixed status endpoint behavior (404/302/502/unreachable by host). External ops evidence is a dated snapshot, not a live guarantee. |
RETENTION-020 | Data retention schedule documented | ops | partial | /home/kivox/wt/ops/SUPPLY-CHAIN/docs/trust/retention-schedule.md | 2026-11-05 | Reviewed dated retention schedule in ops worktree (2026-10-20). Evidence is external to this docs repo; schedule contains known gaps and is not a live runtime enforcement proof. |
EGRESS-POLICY-021 | Egress/probe restrictions followed in evidence collection | ops, worker | evidenced | scripts/trust-live-check.sh, docs/evidence/TRUST-EVIDENCE-PACK.md | 2026-11-05 | Live-check script probes only public tcp.systems/ai/chat/docs hostnames and documents that 23.88.44.32 is never probed. No third-party probes performed. |
RADAR-HISTORY-022 | Radar rotation/history purge (owner-blocked) | ops, security | not_evidenced | docs/evidence/TRUST-EVIDENCE-PACK.md | 2026-11-05 | Owner-blocked per card instructions/history-rewrite constraints. No rotation, history purge, or destructive action performed in this worker session. |
Evidence Sources
Section titled “Evidence Sources”- Documentation: checked against pages in this repository
- Security program (external): PROGRAM-SECURITY ledger entries are cited where available. Not every source repo is in this checkout.
- Live checks: read-only probes against public hosts (
scripts/trust-live-check.sh). The dated output is committed underscripts/. - External ops records: some controls cite ops trust records outside this repo. Those paths are marked as external.
Last Verified
Section titled “Last Verified”Controls were last observed on 2026-11-05.
The latest live check output is in scripts/trust-live-check-output-*.txt.
- Controls without evidence are marked
not_evidenced - Partial means some verification exists, but it is incomplete
- Every operational claim carries the date it was observed
- No SOC 2, ISO 27001 or similar assurance is claimed
docs/evidence/TRUST-EVIDENCE-PACK.mdseparates local build evidence from live, per-host and CI evidence