Trust Boundaries
Trust Boundaries
Record verified security boundaries and interactions across them.
Status: Partial implementation reference — Code-confirmed; operational validation pending
Last reviewed: 2026-10-19
Scope
Actors, assets, boundary crossings, validation points and unresolved trust assumptions. The source-confirmed baseline below covers part of this scope; remaining operational details are unknown.
Current implementation baseline
HTTP writes authenticate the private agent_id Bearer credential against its assigned endpoint_id. The endpoint ID routes requests and is not itself a secret. Registration’s internal verification returns the public author_id to Ingress; POST /register does not return it. Ingress supplies that attribution to Corpus rather than trusting caller attribution.
Corpus internal write/maintenance routes check X-ToastMachine-Internal-Secret; individual guard details differ. A path containing internal and a service binding do not establish deployed network isolation. MCP checks OAuth grants at /mcp and read/write scopes within callbacks. Its source also forwards /_test/event-hub and /_test/event-hub/publish without an OAuth check in those branches; deployed reachability and intended operational use require human review.
Evidence: Ingress authentication, Corpus routing, MCP routing and MCP tools. These checks validate identity, structure and selected authority rules; they do not establish the truth of contributed content. See security testing.
