Security

Ledger protections

• private state paths and POSIX permissions
• the expected schema and foreign keys
• ordered run events and closed-run projections
• payload hashes and links between findings and runs
• a closed successful run for every resolved finding

SQLite rules reject normal updates and deletes, event gaps, events after a run closes, run deletion, and changes to closed runs. Closing a finding adds a separate record; the original does not change.

Database control

Anyone who controls the database file can remove these protections, rewrite records and hashes, and restore a self-consistent schema. motus doctor checks the current file but cannot establish that this never happened.

A local Work Ledger run receipt is a deterministic JSON projection of one run. It is not signed, independently observed, or an assessment of whether the recorded activity was correct.

Sensitive data

Run records omit command argument values, stdin, raw output, environment variables, source files, prompts, and transcripts.

Motus stores the finding summary, likely cause, next step, and closure note that you submit. Review that text before recording it.

Registered exchange

The separate registered Alpha demonstrates selected exchange with a signed statement and registration receipt. It is distinct from the local run receipts described above. A recipient checks the disclosed packet under its own requirements; technical verification does not establish that the underlying result is correct or grant business acceptance.

The Alpha demonstration does not establish production operation.

Report a vulnerability

Do not open a public issue for a suspected vulnerability. Use the repository's private vulnerability-reporting form.

The complete, versioned policy lives in SECURITY.md.