Hard invariants enforced outside the agent

Context

Some rules must hold no matter what the model, a web page, a README, a tool or a compromised tacidd says. They are enforced in the keeper and the stem and cannot be changed by the agent.

The three plans

• Grok: policy evaluated on the daemon, not by the model; secrets never in the system prompt; hash-chained audit.
• Fable: the agent never has root; tacid.agent human-only.
• Codex: ten security invariants (§90), prompt-injection rules, secrets by opaque handle, exact target identity for destructive operations.

Decision

The invariants are listed normatively in SECURITY.md. Additions after review: the agent cannot write tacid.agent.*, tacid.policy.* or its own level; the audit sink is a root-owned append-only file written by the keeper with its head sealed to a TPM counter or the owner’s remote, because a hash chain on the same disk under the same user is theatre; secrets have mechanics (protected-path deny list, secret:// handles, a scrubber on every tool result, memory write and audit line); the stem refuses LUKS-slot, TPM-enrollment, Secure-Boot-key and bootloader changes without owner-present confirmation, or “the previous generation always boots” is void; memory derived from untrusted content is never loaded as instructions; approvals are bound to a transaction id and delivered client-to-keeper.

Consequences

• The invariants are the acceptance tests of the security review and the injection corpus.
• Changing one is an RFC and a superseding ADR, never a pull request.

Alternatives rejected

• Trusting an aligned model: alignment is not an authorization mechanism.