Production deployments (atom.qwixl.com, npm @qwixl/*) are treated as production environments. This document describes controls and residual risks.

┌─────────────────────────────────────────────────────────┐
│  Owner-controlled shell (your host)                     │
│  ┌─────────────┐  ┌──────────────┐  ┌─────────────────┐ │
│  │ Catalog +   │  │ Shell chrome │  │ OwnerStore +    │ │
│  │ resolver    │  │ (confirm,    │  │ attestation log │ │
│  │             │  │  data req)   │  │ (local)         │ │
│  └──────┬──────┘  └──────────────┘  └─────────────────┘ │
│         │ cross-origin iframe (sandbox: allow-scripts)  │
│  ┌──────▼──────┐                                         │
│  │ Module      │  no parent DOM / storage access         │
│  │ bundles     │  (separate registry origin in prod)    │
│  └─────────────┘                                         │
└─────────────────────────────────────────────────────────┘

1. Index entry exists and semver matches
2. Not on revocation list
3. Manifest bytes match index integrity
4. Owner trust policy (requireIntegrity default true)
5. Sigstore bundle shape + in-toto subject digest match when signatureUrl present (required on production)
6. Bundle bytes match bundleIntegrity
7. syncRevocations() evicts installed modules when list updates

Optional owner policy (self-hosted / dev Settings only):

Curated-store CI (pnpm registry:verify) requires publisher DIDs on the allowlist and a valid signatureUrl (digest-anchored Sigstore shape) on every listing; registry:verify:strict adds Fulcio/Rekor crypto (--fulcio). Precedent: npm only-allow publisher allowlists + browser extension store curation.

Self-host and local-SLM owners choose their own model; Atom does not claim token-level filtering of every reply. Hosted fleet may set:

Shell chrome (catalog composition, consequential approval, D031 quarantine) remains the structural backstop. Full note: docs/04-security/07-custom-agent-slm-posture.md (private working tree).

• iframe sandbox="allow-scripts" — opaque origin; cannot read parent localStorage
• Init: shell sends { type: "init", props } after { type: "ready" } from module
• Outbound events validated against manifest events list
• Modules hosted on registry origin in production (cross-origin from shell)

LLM connection metadata on production uses sessionStorage (tab-scoped); keys stay in memory.

• Binds 127.0.0.1 by default
• CORS limited to localhost shell/embed origins
• Not deployed — do not expose without authentication

Each hosted agent receives a bearer token at signup. It is equivalent to root access on that owner's agent (inbox, MLS, connectors, export, business data).

Operator rule: treat ATOM_ADMIN_TOKEN and signup responses like production root credentials. Rotate on compromise via re-provision or export→self-host.

This repo’s apps/control-plane is a local stub for pnpm dev:hosting only. It does not orchestrate remote agent fleets. Operators who run their own hosting stack should keep provision secrets and fleet tooling outside this Apache-2.0 tree.

Rate limits (M21.2): /signup 5 per 15 min per IP; /handles/check 30 per min per IP.

• Sigstore signing keys and npm publish tokens live in CI secrets only — never in the repo.
• Run pnpm registry:verify --require-integrity --signatures before registry deploy.
• Compromise of publisher keys is the supply-chain threat integrity hashes cannot fix alone.

Public operational priority: shell production guards → control-plane rate limits → room admission defaults.

Security issues: GitHub security advisories on Qwixl/Atom.

Abuse / LE contact (curated store & hosted fleet):

SLA (curated reference registry / managed hosting): csam and malware/phishing → same-day triage goal; illegal-content / scam → within a few business days; spam/other → best-effort queue. Federated third-party indexes remain owner-controlled — Atom cannot globally revoke them (Q23). Law-enforcement requests against hosted agents: metadata + suspend history only (no MLS plaintext).

Module / registry abuse (M-TS-04): owners can Report a catalog listing from Settings → Registry. Control plane logs POST /module-abuse-report. Operators follow docs/04-security/06-registry-revocation-runbook.md (update revocations.json, redeploy; shells evict via syncRevocations()).

Comms / contact abuse (M-TS-08): Messages → Contact → Report (or room member menu). Control plane logs POST /comms-abuse-report (metadata only — no MLS plaintext). Block/Mute already enforced on agent backends. Operators follow docs/04-security/08-comms-abuse-runbook.md; hosted peers may escalate to suspend.

Module ratings (M-TS-11): Settings → Registry stars from ratings.json; POST /module-feedback queues curator updates — see docs/04-security/09-module-ratings-feedback-runbook.md.

Sigstore (M-TS-03): CI pnpm registry:verify requires signatureUrl on every curated listing (digest-anchored DSSE via atom-registry sign / pnpm registry:sign-all). Fulcio/Rekor keyless signing: atom-registry sign --fulcio (OIDC / SIGSTORE_ID_TOKEN / GitHub Actions id-token) and weekly smoke .github/workflows/registry-fulcio-smoke.yml. registry:verify:strict / --fulcio verify crypto when bundles are Fulcio-signed.

• SECRET-STORE.md
• API-v1.md