Security model

A custom machine is code the owner did not write, so the Ownbox assumes nothing of it.

• Its own unit. It runs as a user of its own (aiosm-<slug>), with no privileges and no way to gain them.
• No network. The unit has no network of its own: its one connection is a local socket to its door. Every fetch is made by the Ownbox, only to the hosts the owner approved, and only over https.
• No file of the Ownbox's. The Ownbox's files, its settings and its database are not in the unit. The machine sees its own code and packages read-only, and writes only its own data folder.
• Keys stay with the Ownbox. The Ownbox attaches a key to a request for that key's own host, and blanks it from anything handed back. The machine never holds it.
• One door. Every call is checked against the grant the owner approved, metered where it costs, and recorded in the Ownbox's own log.
• Limits it cannot raise. Memory, CPU, processes, file size and crashes are capped by the unit itself (Limits), so one machine cannot starve the Ownbox.
• A person decides. Nothing installs until the owner taps Approve, after reading every permission. Approve holds only for the exact code the card showed: its files are sealed and hashed, and checked again as they install. On a partner's Ownbox, Ownbox reviews that exact code too.
• Stranger text is data. What a person wrote, or a page said, reaches the machine and the owner's AI as quoted data, never as an instruction.
• The owner keeps control. Rollback returns to the version before, Remove takes its code away, and its data stays on the Ownbox.