Security model

The Phase-1 boundary is deliberately small: a foreground CLI with no local or remote control plane.

No qualified execution authority

The CLI opens no daemon, listener, background service, browser connection, machine-pairing route, terminal, relay, reverse tunnel, LAN port, or generic proxy. It does not launch providers, supervise processes, create worktrees, run a qualified score journey, or mutate a repository. The public score command links the supporting foundations but production qualification refuses before state creation.

The signed-in qualification console is read-only. Firebase sign-in creates a web session only and is never a credential for local execution.

Provider boundary

bernato providers returns a fixed catalog without reading PATH or the filesystem. It does not install a provider, sign in on your behalf, read provider credentials, change provider approval settings, or execute a provider. Every catalog row remains disabled and unqualified.

Evidence boundary

bernato evidence verify processes an input-bounded bundle offline. It checks the bundle's internal hashes and signature. Without an independently obtained and pinned key, a valid result proves only that the bundle is internally self-consistent. It does not prove who created it, when it was created, or that a remote service attested to it.

Release boundary

There is no public binary, supported platform, qualified provider, or active commercial offer. Test artifacts and source-built binaries are not supported releases.

Report suspected vulnerabilities privately to [email protected]. Do not include credentials, private source, or evidence bundles in a public report.