Alpha Release · Apache-2.0 · Zero npm Runtime Dependencies

RTQRisk-Adaptive Capability Security Runtime

Capability-security runtime for autonomous agents and tools. Every operation requires an explicitly registered capability; authorizations are short-lived, single-use, cryptographically-signed tickets. Missing rules evaluate to refusal.

Alpha Software: RTQ has not undergone an independent security audit. Every claim is tied to CI evidence at commit e179d2b.View Evidence →
$npm install @rtq/security
Explore CI EvidenceRead Docs
Package Deps

0 npm Runtime Deps

In security-critical packages

Authoritative

Risk Engine

Caller cannot demote risk (INV-04)

Single-Use

Signed Tickets

Replay yields ok: false (INV-09)

Delegated Sandbox

Fail-Closed on Missing

Seatbelt / bwrap / AppContainer

Interactive Execution Simulator

The RTQ Security Pipeline

Every invocation follows an explicit fail-closed path. Select a tested scenario below to trace how registry lookups, authoritative risk checks, and single-use tickets behave in repository tests.

rtq-runtime-inspector
Command:files.read({ path: "src/config.ts" })
01. Capability RegistryINV-01 & INV-02LEVEL 1 — UNIT TESTED

Registered Capability & Schema Match

files.read v1 is registered with immutable inputSchema. Version and name match exactly.

Stage 1 of 6
Runtime State Inspector
CI TESTED
{ "name": "files.read", "version": 1, "risk": { "base": "low" } }

Tested behavior corresponds to repository automated tests. See /docs/evidence for full scope and limitations.

Repository Tested Properties

Tested Security Properties at a Glance

The repository currently contains automated tests covering the 12 properties listed below. Evidence level varies by property and platform.

INV-01 (Unit Tested)

Explicit Surface Registration

Only registered capabilities can execute. Unknown capability strings return decision: 'denied'.

INV-03 (Unit Tested)

Strict Default-Deny Policy

A missing policy rule is a denial, never an implicit allow. There is no silent fallback or permissive degraded state.

INV-04 (Unit Tested)

Authoritative Risk Computation

Caller claims can never lower risk. RTQ independently calculates risk from declared base rating and operation factors.

INV-09 (Integration Tested)

Single-Use Signed Tickets

Tickets are signed with HMAC-SHA256 and bound to exact operation parameters. Second redemption attempt returns ok: false.

INV-12 (Integration Tested)

Challenge-Response Approval

Scanning grants zero permissions. Mobile devices sign a cryptographically random challenge nonce; substitution is rejected.

INV-07 (Construction Tested)

Fail-Closed Sandbox Initiation

If platform sandbox tooling cannot be initialized, execution halts. Uncontained execution is never permitted by default.

Inspectable Security Primitives

Clean Code. Zero Fluff. Verifiable Logic.

Security-critical packages declare zero npm runtime dependencies. Inspect the exact TypeScript and sandboxing constructs that power RTQ.

Every tool or action is explicitly defined with immutable schemas and an authoritative base risk score.

import { createRTQ } from "@rtq/security";

const rtq = createRTQ({
  signingKey: process.env.RTQ_SIGNING_KEY!, // Key never leaves host memory
});

// Explicit registration is mandatory. Unknown operations are rejected.
rtq.registerCapability({
  name: "workspace.readFile",
  version: 1,
  description: "Read utf-8 contents of a workspace file",
  inputSchema: {
    type: "object",
    properties: {
      path: { type: "string", pattern: "^[a-zA-Z0-9_/.-]+$" },
    },
    required: ["path"],
    additionalProperties: false,
  },
  risk: {
    base: "low", // Authoritative base risk computed by RTQ
    factors: ["fs_read", "workspace_contained"],
  },
  execute: async (ctx, input) => {
    // RTQ executes this capability through its configured sandbox path.
    return { ok: true, data: await ctx.fs.readFile(input.path, "utf-8") };
  },
});
Guaranteed Invariants:
Explicit registry: non-registered capabilities cannot execute
Base risk cannot be demoted by caller claims
Typed JSON Schema validation at the boundary
Delegated Platform Isolation

Platform Security Delegation

RTQ delegates execution containment to operating system security facilities rather than relying only on userland JavaScript abstractions. Evidence is measured separately for each backend.

macOS (Apple Seatbelt)

Mechanism: Apple Seatbelt (sandbox-exec driver)

LEVEL 3 — REAL OS ENFORCEMENT
Isolation Primitives Delegated
  • Dynamic Scheme-based profile generation
  • Explicit subpath allowlists for filesystems
  • Network egress blocking when network: 'none'
  • Child process spawning restricted to allowlisted paths
What This Test Does NOT Prove:

Apple has marked Seatbelt deprecated in modern macOS. This test does not prove resistance against local kernel exploits.

Execution Command
Runner: macos-15
sandbox-exec -f /tmp/rtq-profile.sb /bin/sh -c "run_capability"
CI Runner:macos-15 (GitHub Actions runner)
Verified Commit:e179d2b
Fail-Closed On Missing:YES
Automated CI Properties (tests/invariants)

12 Security Properties Tested in CI

Passing CI does not constitute a mathematical proof. Below are the 12 automated checks asserted on every commit to main at commit e179d2b.

View Full Evidence Chains →
INV-01LEVEL 1 — UNIT TESTED

Explicit Surface: Unregistered Denied

Calling rtq.authorize() for 'shell.exec' without registration returns decision: 'denied'.

Not Established:Does not prove internal security of registered capability handlers.
INV-02LEVEL 1 — UNIT TESTED

Explicit Surface: Version Mismatch Denied

Requested version 2 for version 1 capability returns decision: 'denied'.

Not Established:Does not establish automatic backward-compatibility migration safety.
INV-03LEVEL 1 — UNIT TESTED

Default-Deny Policy Semantics

Registered capability with zero matching rules evaluates to decision: 'deny'.

Not Established:Does not prevent operators from authoring overly permissive allow rules.
INV-04LEVEL 1 — UNIT TESTED

Authoritative Risk Downgrade Immunity

Caller claimedRisk: 'low' cannot demote high base risk; still requires approval.

Not Established:Declared risk values are set by developers; RTQ does not mathematically prove exploitability.
INV-05LEVEL 1 — UNIT TESTED

Unknown Origin Escalation

origin: 'unknown' is not treated as local and escalates to require approval.

Not Established:Relies on caller/host integration honestly supplying caller origin metadata.
INV-06LEVEL 1 — UNIT TESTED

High/Critical Approval Non-Automatic

High and critical risk operations reject automatic approval by default.

Not Established:Custom policy rules could explicitly grant overrides if misconfigured.
INV-07LEVEL 1 — UNIT TESTED

Sandbox Network Deny-by-Default

bwrap argv contains --unshare-net; unsupported network allowlist throws.

Not Established:This invariant tests argument assembly; live kernel network drop tested in darwin.test.ts.
INV-08LEVEL 1 — UNIT TESTED

Ambient Secrets Stripped from Env

buildSandboxEnvironment() strips keys matching 'secret', 'token', and 'API_TOKEN'.

Not Established:Does not prevent processes from reading secrets stored on accessible disk paths.
INV-09LEVEL 2 — INTEGRATION TESTED

Single-Use Ticket Replay Rejection

Second redemption of an authorization ticket via rtq.execute() returns ok: false.

Not Established:Relies on in-memory ticket store state within single process; not distributed across nodes.
INV-10LEVEL 1 — UNIT TESTED

Ticket Cryptogram Tamper Check

HMAC-SHA256 signature covers ticket bindings and status, detecting tampering.

Not Established:Assumes the HMAC signing key is kept confidential in host process memory.
INV-11LEVEL 2 — INTEGRATION TESTED

Capability Version Invalidation

Replacing a capability with v2 invalidates outstanding tickets issued for v1.

Not Established:Tickets for other unchanged capabilities remain redeemable until TTL expiration.
INV-12LEVEL 2 — INTEGRATION TESTED

Approval Substitution Rejected

Approval signed for challenge A is rejected when submitted to challenge B.

Not Established:Does not protect if device private keys are extracted by a physical attacker.
The Security Contract

The Honest Security Contract

Security software that promises everything delivers nothing. RTQ establishes clear boundaries. We distinguish between what is implemented, what is automatically tested, and what has not been established.

1. What Is Implemented

Repository Logic

  • Explicit Registry: Unknown capabilities reject execution at the boundary.
  • Authoritative Risk: Caller claimedRisk cannot downgrade declared risk levels.
  • Signed Tickets: HMAC-SHA256 bound to exact parameters and action.
  • Zero npm Runtime Deps: Security-critical packages declare 0 third-party npm deps.
  • Sandbox Backends: macOS Seatbelt, Linux bwrap, and Windows AppContainer adapters.
Source in packages/*
2. What Is Tested in CI

Automated Verifications

  • Replay Rejection (INV-09): Calling execute() with an already consumed ticket returns ok: false.
  • Default Deny (INV-03): Evaluator returns deny when zero matching rules exist.
  • Real OS Seatbelt (macOS): Live kernel driver blocks unauthorized file writes on macos-15.
  • Approval Replay (INV-12): Cryptographic challenge signature for A is rejected when sent to B.
  • Env Sanitization (INV-08): Secrets and token variables are stripped prior to child launch.
3. Not Established

Explicit Non-Claims

  • No Independent Audit: RTQ has not undergone a formal third-party security audit.
  • No Formal Proof: Automated CI test passes are empirical checks, not mathematical proofs.
  • Compromised Host Kernel: Root-level kernel exploits bypass userland sandboxes.
  • Rubber-Stamping Approvers: Cryptographic challenge signing cannot force human diligence.
  • Side-Channel Attacks: No hardware-level mitigation against CPU cache timing leaks.
Modular Architecture

10 Focused Packages

Security-critical packages declare zero third-party npm dependencies. Import only what you need, or use the pipeline façade via @rtq/security.

@rtq/core0 Third-Party Deps

Security-model types, capability registry, atomic ticket store, and schema validation.

@rtq/risk0 Third-Party Deps

Authoritative risk computation engine. Ignores caller claims to lower privilege.

@rtq/policy0 Third-Party Deps

Default-deny declarative rules evaluator. Missing rules evaluate to refusal.

@rtq/crypto0 Third-Party Deps

RFC 8785 Canonical JSON, HMAC-SHA256, constant-time compare, and nonce validation.

@rtq/approvalInteractive

Verification strategies, QR challenge-response protocols, and mobile pairing.

@rtq/sandboxOS Delegation

Adapters for macOS Seatbelt, Linux bubblewrap, and Windows AppContainer.

@rtq/auditRedacted Trail

Structured, tamper-evident event logging with automatic secret and token redaction.

@rtq/clarificationBounded Loop

Structured interactive questions for missing parameters with timeout invariants.

@rtq/securityPrimary Façade

Unified pipeline façade (createRTQ) binding registry, policy, tickets, and sandbox.

@rtq/cliOperator Tooling

Actionable operator tooling for verifying invariants, testing sandboxes, and diagnostics.

Evidence-Backed Capability Security

Inspect the evidence matrix, browse source lines pinned to commit e179d2b, or explore the quickstart integration guide.