Trust and boundaries
Security
Nucleus is being built around least privilege, explicit authority, receipts, deterministic execution, and honest failure reporting.
GATE 0 / GATE 1 NOT COMPLETE
Local static checks and simulations do not prove production durability, cryptographic trust, or live-provider correctness. Production execution authority remains gated.
Control model
- Mission, task, run, constitutional digest, authority identity, and monotonic authority epoch stay bound.
- Protected effects require scoped approval; approval records bind the exact call and policy decision.
- Unknown, partial, failed, cancelled, and non-cancellable effects reconcile before a mission can claim success.
- Sensitive values are represented by references and are redacted before telemetry export.
Reporting
A public vulnerability intake and response SLA are still required before broad third-party release. Do not include credentials, private keys, personal data, or exploit payloads in ordinary support messages.