Design-intent reference and simulation. Not a shipped product, not a medical device, no clinical claims.

Docs home | API reference

Threat model (STRIDE)

Scope: TAL edge (network proxy form factor), control plane, policy bundles, receipts, admin console. Simulation context; no clinical systems.

Assets

Policy signing key, edge receipt keys, policy bundles, receipt chains, tenancy and role bindings, the protected link to the legacy device.

Spoofing

  • Threat: unenrolled programmer or cloned identity requests a session. Control: enumerated devices, unknown source denied, revocation list in the signed bundle, explicit source lists for control rules. Residual: identity in the proxy form factor comes from flow metadata; strong device attestation is a production requirement.
  • Threat: forged policy bundle. Control: Ed25519 signature over canonical digest, trusted keyId set at the edge.
  • Threat: admin impersonation. Control: designed passkeys; demo login is flagged and must be disabled before any real tenant.

    • Tampering

  • Threat: altered bundle in transit or at rest. Control: digest and signature verification, rollback refusal.
  • Threat: altered or deleted receipts. Control: hash chain from GENESIS with per-receipt signatures; any edit breaks verification offline.

    • Repudiation

  • Control: every decision and every policy action is an attributable, signed or logged event. Author and approver are recorded separately.

    • Information disclosure

  • Control: proxy does not decrypt TLS; receipts carry flow metadata only. Tenancy scoping on reads. Residual: demo receipts endpoint accepts writes without auth (demo only; production requires edge identity on ingest).

    • Denial of service

  • Threat: telemetry flood or bulk sync crowds out control. Control: per-flow token buckets and strict priority with control on top; per-class tail drop.
  • Threat: control plane unreachable. Control: local policy at the edge, refresh about 5 min, hard expiry about 24 h; after expiry the edge fails closed. Preservation-First: denial never changes implant firmware or therapy.

    • Elevation of privilege

  • Threat: author self-approves. Control: separation of duties enforced in the router.
  • Threat: compromised but enrolled endpoint. Control: it is limited to the operations, classes, initiators, windows and rates its rules allow.
    • flowchart TB
  subgraph Untrusted
    D[Devices and networks]
    U[Admin browsers]
  end
  subgraph Trust boundary: edge
    E[TAL edge]
  end
  subgraph Trust boundary: control plane
    CP[Router + RBAC]
    K[(Signing key secret)]
    DB[(D1 events, policies, receipts)]
  end
  D --> E
  U --> CP
  CP --> K
  CP --> DB
  CP -- signed bundles --> E

    Phase 2 additions

    * Stolen enrollment token: single use, hashed at rest, short TTL; a used token shows used_by in the console.

    * Rogue gateway: only registered gateway keys can fetch bundles or post receipts; receipt chains are verified against that key on ingest, so forged or reordered receipts are rejected.

    * Rogue device: the gateway installs only WireGuard peers named in a signed bundle; revocation removes the peer on the next bundle (SSE pushed, under a minute in practice).

    * Replay of signed requests: 5 min timestamp skew window and body hash binding.

    * Open proxy abuse on hosted gateways: proxy ports need a short lived device credential, destinations stay default deny, --deny-private blocks internal ranges, and cloud metadata and link local ranges are always blocked.

    * Admin takeover: passkeys (phishing resistant, origin bound) and HttpOnly SameSite=Strict sessions; the bootstrap token only registers a passkey and grants no operations by itself.

    * Public data exposure: the public live view redacts device names to roles and hides destination addresses.