security model doc

SECURITY.md

@@ -0,0 +1,47 @@
+# CORTX Security Model
+
+## Threat model
+
+CORTX gives a language model the ability to rewrite its own operating rules.
+The core risk: **the model (or a user manipulating the model via prompts)
+escalates self-editing beyond policy text into something dangerous** — its
+weights, its code, its identity, or credentials.
+
+## Defense layers (all enforced in code, not prompt text)
+
+1. **Whitelist** — only `constitution`, `tool_rules`, `metacognitive_rules`,
+   `refusal_rules`, `playbook` are editable. Anything else is rejected.
+2. **Locked sections** — `security_rules`, `identity`, `weights`, `code`,
+   `admin_token`, `system_prompt` can never be edited through the channel.
+   Attempts are rejected *and* logged.
+3. **Size caps** — 8,000 chars/section, 8 edits/turn.
+4. **Rate limit** — 40 edits per rolling hour. Violations blocked and logged.
+5. **Hash-chained audit log** — every edit and every rejected attempt is
+   appended as `hash = sha256(prev_hash + entry_json)`. Anyone can run
+   `audit.verify()` to prove the log is untampered.
+6. **Approval mode** — admin can require human sign-off before edits go live.
+7. **Rollback** — config is version-pinned; admin restores any prior version.
+8. **Isolation** — the edit channel reaches only policy-text files. It has no
+   filesystem path capability, no code execution, no network access beyond the
+   config repository. Weights, code, and tokens live in a different trust zone
+   and are physically unreachable from the edit path.
+
+## What the security model does NOT guarantee
+
+- **Edit wisdom.** The boundary guarantees edits are *valid and bounded* — not
+  that they are *good*. A small model can write worse rules than it started
+  with. Review the audit log in production; that is why it exists.
+- **Prompt-injection resistance of the base model.** The boundary is enforced
+  in code, so no prompt can cross it — but the model's *content* remains its
+  own responsibility.
+
+## Verifying the audit log
+
+```python
+ok, n = editor.audit.verify()
+assert ok, "audit log tampered at entry %s" % n
+```
+
+## Reporting
+
+Security issues: open an issue on the repo or contact ChatPBC Labs.