Security

Nexus Cerebri is pre-release research/development software.

Never commit secrets, credentials, production calendar data or personal training data. Treat planning/execution separation, permissions, redaction and idempotency as security boundaries.

Security-sensitive architecture changes require an ADR. A future implementation repository should define a private vulnerability-reporting channel before public production use.

Foundation implementation boundary

The REST app binds to 127.0.0.1:3000 and exposes no execution route. It has no production authentication. Client CPIR policy/capability fields are planning inputs, not trusted execution credentials. Trusted application code must construct live authorization from authenticated identity and current provider state before calling the executor.

The provided ledger and adapter are in-memory test tools. They do not survive process failure. Production adapters must implement durable atomic claims, optimistic concurrency, reconciliation and explicit retry policy. Never retry uncertain writes by clearing an idempotency key. Partial execution is represented explicitly and does not imply rollback.

Tracing records a validated TraceId, not request bodies, event titles or descriptions. HTTP/Node inputs and core search work have explicit bounds. The development API is not hardened for hostile multi-user traffic. Repository checks detect selected credential patterns; they are not a comprehensive secret audit. The project uses the MIT license; a private production disclosure channel still needs to be configured before production use.

Dependency advisory gate

CI installs cargo-audit 0.22.2 with cargo install cargo-audit --version 0.22.2 --locked, using the repository Rust toolchain. The dedicated Rust dependency advisories job runs cargo audit --file Cargo.lock --deny warnings on every existing push/PR trigger. The committed lockfile is not regenerated by the scan. RustSec's database is fetched fresh; known vulnerabilities and all reported warnings (including unmaintained, unsound and yanked dependencies) fail the gate. Fetch/tool errors also fail it. There are no ignored Rust advisories, target filters, stale-database allowances or severity exclusions.

This matches the dependency graph against known advisories; it is not a general Rust security proof, source-code audit, reachability proof or guarantee against undisclosed vulnerabilities. Record the scanner version, database revision and result in qualification evidence. Review scanner releases during release qualification and update the CI/local command together; no arbitrary installer script or floating scanner version is used.

For any finding, inspect the dependency path, affected version/API, reachable functionality and available upgrades first. Prefer a compatible tested upgrade. Any exceptional ignore requires an explicitly reviewed entry here with advisory ID, reason, affected scope, owner and review/expiry date, plus matching tool configuration. Never add blanket or undocumented ignores. The npm gate remains npm audit --audit-level=high for root, Lab and site; lower-severity reports remain visible and must be assessed in qualification evidence rather than reported as zero findings.

Workflow dependencies and permissions

All uses: references in CI and Pages are pinned to full upstream commit SHAs with exact release tag comments. Resolve pins from the action repository's Git tag object, following annotated tags to commits when needed. Weekly GitHub Actions Dependabot PRs update these pins through normal review and CI; they do not auto-merge. A pinned commit limits drift, not the action's possible impact. CI and its advisory job have only contents: read; checkout does not persist credentials. Only the main-branch Pages deployment job receives pages: write and id-token: write alongside read-only contents. Existing push, PR and main-only Pages trigger semantics are preserved. Browser failure artifacts contain synthetic test evidence, expire after seven days and are not releases.