Skip to contentSkip to navigation
Tune.Toys Docs
v0.1.1Open app
View as Markdown

Trust and service boundaries

Which data is trusted, which code is trusted, and who may do what on which host? This document states the trust boundaries the platform is designed around. It is a design, not a se

Which data is trusted, which code is trusted, and who may do what on which host? This document states the trust boundaries the platform is designed around. It is a design, not a security certification: no implementation or external audit is implied by anything here.

Status: design with a partial implementation. Source validation, bounded expansion, API authorization checks, native credential separation, hosted upload access control and (v0.0.6) the sealed connections, the envelope-encrypted vault and the SSRF-guarded request proxy exist with fixtures; worker isolation, release signing, upload scanning and incident handling are release-gate requirements, not features. See SECURITY.md and implementation status.

Boundaries at a glance#

%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#FAFAF7', 'primaryTextColor': '#1C1C1B', 'primaryBorderColor': '#1C1C1B', 'lineColor': '#64645F', 'fontFamily': 'DM Sans, Inter, system-ui, sans-serif'}}}%%
flowchart LR
  subgraph UNTRUSTED["Untrusted data"]
    SRC["Toy source JSON"]
    ARCH["Archives · assets · manifests"]
    REQ["User and agent requests"]
  end
  subgraph VALIDATE["Validation and admission"]
    V["Bounded structure · references<br/>recursion · expansion · paths · digests"]
    C["Compiler admission<br/>trusted primitive catalog"]
  end
  subgraph TRUSTED["Trusted curated code"]
    API["API modules<br/>owner · visibility · recheck on read"]
    ENGINE["Rust engine<br/>no prompts, no waits in the callback"]
    BRIDGE["Native bridge<br/>exact sender · shape · bounds · generation"]
  end
  WORKER["Isolated worker (planned)<br/>bounded CPU/memory/disk/time<br/>no production credentials"]
  HOST["Host grants<br/>mic · camera · files · network · remote"]

  SRC --> V --> C --> ENGINE
  ARCH --> V
  REQ --> API
  API -.-> WORKER
  BRIDGE --> ENGINE
  HOST -. explicit grant per session .-> BRIDGE

  classDef bad fill:#F0442E,stroke:#1C1C1B,color:#FAFAF7
  classDef shared fill:#DCEBDD,stroke:#1C1C1B,color:#1C1C1B
  classDef host fill:#DED8F0,stroke:#1C1C1B,color:#1C1C1B
  classDef planned fill:#FAFAF7,stroke:#64645F,color:#64645F,stroke-dasharray:4 3
  class SRC,ARCH,REQ bad
  class V,C,API,ENGINE,BRIDGE shared
  class HOST host
  class WORKER planned

Input and execution#

Source JSON, archives, assets, extension manifests and user/agent requests cross an untrusted boundary. Before preparation, validate bounded structure, graph references, recursion, expanded size, asset paths and digests, decoded resource sizes and capability requirements. Schema validation does not establish runtime safety, DSP compatibility, file integrity or permission.

ClaimCurrent code
Draft schema, references, domains and portsChecked by the shared validator
Bounded nesting and expansion, Frames, safe pathsChecked
Rendering of admitted primitivesShared engine renders admitted multichannel primitives from a bounded catalog
Archive reading, package resolutionNot done by source validation
Asset byte and signature verificationRelease packages verify digests; source validation itself does not
Sandboxing executable codeNot provided; there is no executable user code in the first profile

Keep these claims separate in errors and UI. Native code is trusted curated code in the first profile; arbitrary generated scripts and native libraries are deferred. Worker jobs, when they exist, run with bounded CPU, memory, disk and time, isolated workspaces, no production credentials by default, dependency and network allowlists, and explicit artifact upload authority. Uploaded archives need traversal, symlink, decompression-bomb, media-decoder and malware controls before public ingestion; today hosted uploads are limited to invited accounts.

Identity and privacy#

Authorize every project revision, dependency, artifact and preview against the caller. Owner, workspace and visibility checks belong in API modules, not only in front-end hiding. Catalog indexes may cache public metadata but must recheck access at retrieval. Preserve a visibility audit trail; deletion/retention and dependency revocation policies must be published before launch.

Account identity, publisher verification and signing identity are separate things. A digest proves content integrity, not the publisher's trustworthiness. A signature authenticates a release under a key and policy, not its musical quality. Key rotation, compromised-release handling and artifact retention are managed independently of mutable catalog aliases.

Host authority#

ActionGrants device or network access?
Installing or bookmarking a ToyNo
Accepting an agent proposalNo
Restoring a saved DAW projectNo
An explicit grant for a specific endpoint in this host/sessionYes, until revalidation

Capabilities name required and optional services; grants authorize specific endpoints in the current host and session. Rebinding and reconnect follow explicit revalidation. The audio callback never performs permission prompts or waits on authorization.

Embedded web UIs load declared resources and restrict navigation. Privileged bridges validate exact sender and origin, command shape, bounds, instance and generation, and the allowed operation. Displayed text is escaped and supported asset formats are sanitized. Bearer tokens live in server sessions or native credential stores and are redacted from telemetry.

Connections, vault and the request proxy#

Identities, connections and vault entries are separate tables with separate keys (connections and vault). Implemented with HTTP fixtures; no external security review has been done, and the keys are not provisioned in any environment.

BoundaryRule
Portable dataToys, takes, exports, logs and node data name a vault slot or a requirement (secret:<slot>, connection:<provider>), never a value or token. Host-local file and connection references stay in browser storage
Connection tokensSealed with AES-256-GCM under TUNETOYS_CONNECTION_KEY, bound to the row, refreshed and used only by the API. The Picker route is the one exception: it returns a short-lived drive.file access token to the owner, never the refresh token
Vault valuesEnvelope encryption: a per-account data key sealed by TUNETOYS_VAULT_KEY, each secret sealed under it with the slot as associated data. Vault.use is the only decryption path, for one upstream call inside the proxy or the LLM route; no route returns a value
Key bindingA catalog slot's value is sent only to its addon's hosts; a custom slot only to hosts in the person's own allowlist (SECRET_HOST). The platform's own model key is never used for ai.chat
SSRFThe proxy admits only enabled addon hosts and the person's exact-host allowlist, resolves first, refuses private, loopback, link-local, CGNAT, metadata and other non-public ranges, connects to the checked address and re-checks every redirect (≤ 3)
Scrapingweb.scrape goes through the proxy, which honours robots.txt and never runs scripts; HTML is parsed with a bounded parser in the browser
Logs and errorsUpstream calls are logged by host, status, size and duration; error bodies are truncated and scrubbed of the secret
Transport and callersSecret-bearing routes refuse plain HTTP except loopback, accept only browser sessions (never API keys or Player bearers) and pass the Origin/CSRF guard for writes
The workerReceives neither the connection key nor the vault key; export and convert jobs need neither
Device vaultSigned-out keys in tunetoys.vault.device.v1 under a non-extractable WebCrypto key. Anything running in the page can use them; offered only for direct-route addons, labelled as such, and refused by the proxy and the LLM route
Embedded pagesThe web widget's iframe is sandboxed without allow-same-origin, loads on click and relays postMessage only with the declared exact origin; the Google Picker script loads only on "Open from Drive…"
ReplayA replayed take never executes side-effect nodes: their recorded outputs are injected, so replays and offline renders make no network calls

Observability#

Trace request, candidate, revision, build, release and runtime-generation IDs without logging raw private Toy content or audio by default. Collect crash and performance reports under an explicit privacy policy. Optional model or evaluation upload must identify the service and retention; private projects are never silently used for training.

Release gates#

Dependency and license inventory, signing/notarization policy, authorized asset delivery, worker isolation, backup/restore rehearsal and basic abuse/rate limits are required before the relevant roadmap gates, not implemented features.

Implementation#

Edit this page on GitHub

esc

↑ ↓ move↩ open⌘↩ new tabesc close