Trust Model

Threat Model Summary

Identity and Signing

SSH ED25519 for Git

Every commit on main is signed with SSH ED25519:

git verify-commit HEAD
# Good "git" signature for [email protected] with ED25519 key SHA256:...

The trust anchor is the signer's public key published in ~/.ssh/allowed_signers. CI enforces signature verification on every PR.

Verified Chezmoi Installer

The install.sh script prefers tools/ci/install-chezmoi-verified.sh, which:

1. Downloads chezmoi from the upstream release URL
2. Verifies the SHA256 checksum against a hardcoded, version-pinned value
3. Falls back to get.chezmoi.io only if the verified path is unavailable

No unverified binary is ever executed.

Secrets

Three Layers

1. Repository-managed config (dot_config/**/*.tmpl) — checked into Git, no secrets
2. Local-only config (~/.config/*.local) — gitignored, user-edited
3. Encrypted secrets (Age-encrypted private_* files, SOPS YAML) — checked in, decrypted on apply

Example encrypted file:

dot_config/api-keys.yaml.sops.yaml  # SOPS-encrypted, safe to commit

Decryption uses the user's Age private key at ~/.config/age/keys.txt. Chezmoi invokes age or sops automatically during apply.

Secret Scanning

CI runs three independent scanners:

All three must pass for a commit to be merged.

Agent Policy Enforcement

AI agent operations (Claude Code, Codex, Copilot, Antigravity CLI, etc.) are governed by the Model Context Protocol (MCP) policy in dot_config/dotfiles/mcp.json and validated by dot mcp.

Policy Structure

{
  "policy_version": "2026-01",
  "allowed_servers": ["fs", "shell", "github"],
  "denied_tools": ["network.raw", "fs.write:/etc"],
  "attestation_required": true,
  "signature": "<ed25519-signature>"
}

Enforcement Points

1. On agent start — dot mcp --strict validates the registry matches the policy hash
2. Per-tool call — MCP-aware agents check the policy before invoking a tool
3. On commit — dot attest records the active policy hash in the attestation log

Violations are logged to ~/.local/state/dotfiles/mcp-violations.log and reported by dot doctor.

Attestation

dot attest generates a signed JSON document containing:

{
  "version": "0.2.527",
  "timestamp": "2026-04-16T09:00:00Z",
  "host": {
    "hostname_sha256": "...",
    "kernel": "Darwin 25.4.0",
    "arch": "arm64"
  },
  "identity": {
    "ssh_key_sha256": "...",
    "git_signer": "[email protected]"
  },
  "policy": {
    "mcp_policy_sha256": "...",
    "agent_profile": "architect"
  },
  "tools": {
    "chezmoi": "2.72.2",
    "mise": "2026.4.0"
  },
  "git": {
    "head": "abc123...",
    "branch": "main",
    "signed": true,
    "verified": true
  }
}

The document is:

• Signed with the user's SSH ED25519 key
• Stored at ~/.local/state/dotfiles/attestation/YYYY-MM-DD-HHMMSS.json
• Optionally published to ~/.dotfiles/docs/attestations/ for team review

Verifying Someone Else's Attestation

dot verify --attestation <path>
# ✓ Signature valid (ED25519)
# ✓ Policy hash matches repository
# ✓ Tool versions within supported range

Fleet Trust Propagation

Across multiple hosts, trust is established by:

1. Each host generates its own SSH key pair
2. Each host's public key is added to ~/.ssh/allowed_signers on every other host
3. Attestations from any host can be verified by any other host
4. dot fleet compares attestations across the fleet and flags drift

See Fleet Architecture for the full model.

CI-Level Gates

Principles

• Local-first — nothing leaves the workstation unless the user opts in
• Zero trust in transit — every network-fetched artifact is checksum-verified
• Machine-readable evidence — human-readable summaries are backed by signed JSON
• Reversible — dot rollback undoes any change with a single command

See Also

• Security Policy
• Threat Model
• MCP Policy Reference
• Attestation Operations