Decision 0004
Eight processes, three trust tiers
Architecture decision record 0004: Eight processes, three trust tiers
Context
The agent has full authority over the machine, so the process boundaries are the security model. The first draft put policy, secrets, audit and health inside the agent daemon; the review pointed out that an immune system living in the process the agent can hang is not an immune system.
The three plans
- Grok:
tacid-agentd,tacid-inferenced,tacid-voice; the agent dies without taking the TUI or the shell with it. - Fable:
taciddas a user service plus a polkit-gated privileged helper for rebuilds. - Codex: four trust zones (UI, agent runtime, sandbox executor, privileged system service with typed operations only).
Decision
| Process | User | Network | Role |
|---|---|---|---|
tacid-stem | root | none | Typed operations; keeper-only socket; refuses boot, disk-encryption, TPM and Secure Boot key changes without owner-present confirmation. |
tacid-keeper | own | IPAddressDeny=any | Policy, reversibility classifier, taint, approvals, secrets broker, audit sink, health gate and rollback, snapshots. |
tacid-egress | own | outbound by allowlist | The only network path for agent processes; credential injection; ledger; airgap. |
tacidd | tacid | via egress | Sessions, agent loop, facts, memory, rendering and building, model clients. Holds no secrets. |
tacid-infer | own, GPU | none | Supervises sandboxed inference subprocesses; treated as hostile input. |
tacid-session | the user | via egress | User-context tools, untrusted parsers in sandboxes, voice, desktop interop. |
tacid-shell, tacid | the user | — | Renderers of protocol state. |
tacidd requests, the keeper authorizes, the stem executes. Approvals travel client → keeper,
never through tacidd. Cloud credentials are injected by the egress proxy, so a compromised
tacidd cannot exfiltrate a key. One tacidd per machine, always running, headless-first; user
work is dispatched to that user’s tacid-session.
Consequences
- More processes than a chatbot needs; each is a trust boundary and a systemd unit with its own hardening.
- The stem is small enough to be read in an afternoon and is fuzzed.
- The keeper is the heart of the security model and is part of the signed core (ADR-0014).
Alternatives rejected
- Everything in one daemon: simpler, and false about isolation.
- Per-user agent daemons: two brains per body; conflicts on system state.
- Polkit-gated helper: needs a session agent that does not exist on a serial console (ADR-0005).