Security
Motus enforces append rules and checks the current consistency of its local SQLite ledger.
Ledger protections
- private state paths and POSIX permissions
- the expected schema and foreign keys
- ordered run events and closed-run projections
- payload hashes and links between findings and runs
- a closed successful run for every resolved finding
SQLite rules reject normal updates and deletes, event gaps, events after a run closes, run deletion, and changes to closed runs. Closing a finding adds a separate record; the original does not change.
Database control
Anyone who controls the database file can remove these protections, rewrite records and hashes, and restore a self-consistent schema. motus doctor checks the current file but cannot establish that this never happened.
A receipt is a deterministic JSON projection of one run. It is not signed, independently observed, or an assessment of whether the work was correct.
Sensitive data
Run records omit command argument values, stdin, raw output, environment variables, source files, prompts, and transcripts.
Motus stores the finding summary, likely cause, next step, and closure note that you submit. Review that text before recording it.
Report a vulnerability
Do not open a public issue for a suspected vulnerability. Use the repository's private vulnerability-reporting form.
The complete, versioned policy lives in SECURITY.md.