Threat Model: When Reused Agent Context Becomes an Attack Surface

Memory changes the threat model because text from an earlier session can influence a later one. A useful design must answer who wrote the slice, which scope can read it, and what happens when its assumptions expire.

Assets and adversaries

Assets include session JSONL, repository paths, stored results, and provider credentials. Threats include prompt content that escapes an injection boundary, cross-project retrieval, stale direct reuse, symlink attacks on local stores, and accidental formula execution in TSV exports.

Implemented controls

Semantix sanitizes ANSI/C1 characters, escapes injection markers, guards TSV formula prefixes, writes local stores atomically with restrictive permissions, and includes scope in slice identity. L3 checks dependency fingerprints and rejects reuse when a file changes or disappears.

go build -o semantix ./cmd/semantix
go vet ./...
go test ./...

Failure policy

Retrieval and embedding are optimization layers; failure should skip them and continue the harness. Permission or verification uncertainty is a safety boundary; failure should reject the shortcut. This split is summarized as cache fail-open, security fail-closed.

Residual risk

L2 content is still untrusted input to a model. Sanitization cannot make an outdated instruction correct, and Windows permission semantics differ from Unix modes. Operators must avoid ingesting secrets and should test scope isolation on their deployment. The security document also lists sandbox and credential-management items that remain checklist work, so this is not a certification claim.

A security check that did not pass

Security claims are more useful when the failed check is visible. On 2026-08-12, main at e93668e was tested with Go 1.26.5 on Windows/amd64:

go test -count=1 ./kernel/slice ./cmd/semantix

The run failed on two file-mode assertions:

FAIL TestFileStoreKeepsPerm0600: store file perm = 666, want 600
FAIL TestRunUsageWithEvolve: evolve state perms = 666, want 600

I would not translate Unix-style 0600 directly into a cross-platform security guarantee. Windows ACLs need a platform-specific test and documented behavior. Retrieval, cache, and injection packages passed in the same full run, but these failures keep the stronger security claim open. The practical decision is to avoid secrets in stored slices and to verify the storage directory ACL in the deployment environment.

Sources and limitations

• Security design — threat list, controls, and open checklist.
• Quickstart — commands and supported release paths.
• M0 gate report — what passed, what is conditional, and what remains unverified.
• Source and tests — implementation is the final authority.