Security model

The Phase-1 boundary is deliberately small: a foreground CLI with no local or remote control plane.

No execution authority

The CLI opens no daemon, listener, background service, browser connection, machine-pairing route, terminal, relay, reverse tunnel, LAN port, or generic proxy. It does not launch providers, supervise processes, create worktrees, run a score, or mutate a repository.

The signed-in qualification console is read-only. Firebase sign-in creates a web session only and is never a credential for local execution.

Provider boundary

bernato providers reads provider metadata from the local environment. It does not install a provider, sign in on your behalf, read provider credentials, change provider approval settings, or execute a provider. Discovery does not qualify availability.

Evidence boundary

bernato evidence verify processes an input-bounded bundle offline. It checks the bundle's internal hashes and signature. Without an independently obtained and pinned key, a valid result proves only that the bundle is internally self-consistent. It does not prove who created it, when it was created, or that a remote service attested to it.

Release boundary

There is no public binary, supported platform, qualified provider, or active commercial offer. Test artifacts and source-built binaries are not supported releases.

Report suspected vulnerabilities privately to security@bernato.dev. Do not include credentials, private source, or evidence bundles in a public report.