Capability-security runtime for autonomous agents and tools. Every operation requires an explicitly registered capability; authorizations are short-lived, single-use, cryptographically-signed tickets. Missing rules evaluate to refusal.
e179d2b.View Evidence →0 npm Runtime Deps
In security-critical packages
Risk Engine
Caller cannot demote risk (INV-04)
Signed Tickets
Replay yields ok: false (INV-09)
Fail-Closed on Missing
Seatbelt / bwrap / AppContainer
Every invocation follows an explicit fail-closed path. Select a tested scenario below to trace how registry lookups, authoritative risk checks, and single-use tickets behave in repository tests.
files.read({ path: "src/config.ts" })files.read v1 is registered with immutable inputSchema. Version and name match exactly.
{ "name": "files.read", "version": 1, "risk": { "base": "low" } }Tested behavior corresponds to repository automated tests. See /docs/evidence for full scope and limitations.
The repository currently contains automated tests covering the 12 properties listed below. Evidence level varies by property and platform.
Only registered capabilities can execute. Unknown capability strings return decision: 'denied'.
A missing policy rule is a denial, never an implicit allow. There is no silent fallback or permissive degraded state.
Caller claims can never lower risk. RTQ independently calculates risk from declared base rating and operation factors.
Tickets are signed with HMAC-SHA256 and bound to exact operation parameters. Second redemption attempt returns ok: false.
Scanning grants zero permissions. Mobile devices sign a cryptographically random challenge nonce; substitution is rejected.
If platform sandbox tooling cannot be initialized, execution halts. Uncontained execution is never permitted by default.
Security-critical packages declare zero npm runtime dependencies. Inspect the exact TypeScript and sandboxing constructs that power RTQ.
Every tool or action is explicitly defined with immutable schemas and an authoritative base risk score.
import { createRTQ } from "@rtq/security";
const rtq = createRTQ({
signingKey: process.env.RTQ_SIGNING_KEY!, // Key never leaves host memory
});
// Explicit registration is mandatory. Unknown operations are rejected.
rtq.registerCapability({
name: "workspace.readFile",
version: 1,
description: "Read utf-8 contents of a workspace file",
inputSchema: {
type: "object",
properties: {
path: { type: "string", pattern: "^[a-zA-Z0-9_/.-]+$" },
},
required: ["path"],
additionalProperties: false,
},
risk: {
base: "low", // Authoritative base risk computed by RTQ
factors: ["fs_read", "workspace_contained"],
},
execute: async (ctx, input) => {
// RTQ executes this capability through its configured sandbox path.
return { ok: true, data: await ctx.fs.readFile(input.path, "utf-8") };
},
});RTQ delegates execution containment to operating system security facilities rather than relying only on userland JavaScript abstractions. Evidence is measured separately for each backend.
Mechanism: Apple Seatbelt (sandbox-exec driver)
Apple has marked Seatbelt deprecated in modern macOS. This test does not prove resistance against local kernel exploits.
sandbox-exec -f /tmp/rtq-profile.sb /bin/sh -c "run_capability"Passing CI does not constitute a mathematical proof. Below are the 12 automated checks asserted on every commit to main at commit e179d2b.
Calling rtq.authorize() for 'shell.exec' without registration returns decision: 'denied'.
Requested version 2 for version 1 capability returns decision: 'denied'.
Registered capability with zero matching rules evaluates to decision: 'deny'.
Caller claimedRisk: 'low' cannot demote high base risk; still requires approval.
origin: 'unknown' is not treated as local and escalates to require approval.
High and critical risk operations reject automatic approval by default.
bwrap argv contains --unshare-net; unsupported network allowlist throws.
buildSandboxEnvironment() strips keys matching 'secret', 'token', and 'API_TOKEN'.
Second redemption of an authorization ticket via rtq.execute() returns ok: false.
HMAC-SHA256 signature covers ticket bindings and status, detecting tampering.
Replacing a capability with v2 invalidates outstanding tickets issued for v1.
Approval signed for challenge A is rejected when submitted to challenge B.
Security software that promises everything delivers nothing. RTQ establishes clear boundaries. We distinguish between what is implemented, what is automatically tested, and what has not been established.
Security-critical packages declare zero third-party npm dependencies. Import only what you need, or use the pipeline façade via @rtq/security.
@rtq/core0 Third-Party DepsSecurity-model types, capability registry, atomic ticket store, and schema validation.
@rtq/risk0 Third-Party DepsAuthoritative risk computation engine. Ignores caller claims to lower privilege.
@rtq/policy0 Third-Party DepsDefault-deny declarative rules evaluator. Missing rules evaluate to refusal.
@rtq/crypto0 Third-Party DepsRFC 8785 Canonical JSON, HMAC-SHA256, constant-time compare, and nonce validation.
@rtq/approvalInteractiveVerification strategies, QR challenge-response protocols, and mobile pairing.
@rtq/sandboxOS DelegationAdapters for macOS Seatbelt, Linux bubblewrap, and Windows AppContainer.
@rtq/auditRedacted TrailStructured, tamper-evident event logging with automatic secret and token redaction.
@rtq/clarificationBounded LoopStructured interactive questions for missing parameters with timeout invariants.
@rtq/securityPrimary FaçadeUnified pipeline façade (createRTQ) binding registry, policy, tickets, and sandbox.
@rtq/cliOperator ToolingActionable operator tooling for verifying invariants, testing sandboxes, and diagnostics.
Inspect the evidence matrix, browse source lines pinned to commit e179d2b, or explore the quickstart integration guide.