Public dry run dryrun-a43e907efd9d

Source commit: a43e907efd9d1561c23fe73499478e881f868355

Public tree identity: sha256:453dea30195485dd8939f575a69b39f4bb7acd84c4df23f8aa29b55d044f2673

docs/security.md

@@ -0,0 +1,48 @@
+# Security
+
+## Authority
+
+Clusterflux separates four authority lanes:
+
+- Client sessions for people.
+- Agent public-key signatures for non-interactive workflows.
+- Node public-key signatures for enrolled workers.
+- Operator credentials for hosted administrative actions.
+
+The server derives tenant, project, identity, and permission scope from the
+authenticated lane. Request-body identity fields are not authority.
+
+## Sessions and keys
+
+Human login uses the configured identity provider and an opaque, nonce- and
+PKCE-bound transaction. The CLI never accepts provider claims or authorization
+codes as a session.
+
+Enrollment grants are short-lived and single-use. Node and agent signatures bind
+the canonical request body, timestamp, nonce, key fingerprint, and scope.
+Forged, replayed, expired, revoked, cross-tenant, and body-modified requests
+fail.
+
+Keep ".clusterflux/session.json", node private keys, agent private keys, and
+operator credentials out of source control. Use protected environment files or
+your secret manager.
+
+## Execution
+
+The coordinator does not run arbitrary native user commands. Nodes execute
+commands within their reported capabilities. Linux container environments use
+rootless Podman and avoid privileged defaults.
+
+Bundle size, canonical argument size, handle count, logs, task history, Debug
+Epoch state, relay state, and coordinator collections are bounded. Resource and
+relay reservations happen before unaffordable work or transfer begins.
+
+## Artifacts
+
+Artifact links are scoped, expiring, revocable, and bound to live metadata.
+Digest, size, producer, task attempt, and retaining source are checked. The
+coordinator retains metadata and bounded relay spool state, not durable artifact
+bytes by default.
+
+Report security issues privately to the repository owner rather than opening a
+public issue with credentials, keys, or exploit details.