Security boundaries

Lumenlan CLI is not a universal remote shell. Its purpose is to keep every local action inside a boundary that can be explained, constrained, and reviewed.

Profiles cannot impersonate each other

Verification runs only registered, versioned strict specifications. Inputs cannot contain arbitrary commands, argument arrays, shells, interactive terminals, dynamic scripts, or an equivalent escape hatch. The same input and version should produce the same result. Uncertainty is represented explicitly as blocked or undecidable.

Workspace can run project processes, scripts, and capability adapters, but only when a signed ExecutionGrant and local ExecutionPolicy both allow the action. A grant binds the actor, project, machine, tool, scope, file range, expiration, and revocation identifier. Caller arguments cannot elevate a profile. An ordinary workspace grant also cannot trigger high-risk effects such as sending, deleting, publishing, paying, or changing production.

Results and sensitive information

The CLI reports machine facts and execution evidence; it does not write a business verdict. Results carry the tool version, profile, interface, provenance, real process status, resource limits, and artifact digests. Workspace output cannot masquerade as evidence required from verification.

The CLI does not retain long-lived credentials. Secrets, message bodies, contacts, and unrelated paths must not enter ordinary logs, diagnostics, or audits. A one-time upload destination is used only for its artifact submission and is not echoed into the normal result. Projects must still protect workspace files, grants, and local policy, apply restrictive file permissions, and revoke authorization when it is no longer needed.

Platform differences

macOS and Linux can use qualified workspace sandbox backends. Windows currently supports the base CLI, verification, and stdio MCP protocol surface. Workspace v1 safely returns blocked when no qualified Windows sandbox backend is present instead of falling back to unsandboxed execution. This is expected protection, not a verification failure.

Remote identity, transport, and machine selection are not implemented inside the CLI. Local MCP remains stdio-only by default, with independent network listening disabled.