[rockyshi1993]

Why

Phase 1 of the approved Interactive full-delivery roadmap is merged into main at 9bac8f86347a405efe068f96423ae3e501005061. The real Grok Build acceptance report showed live-model participation but no Windows Host isolation or C12/S13 native source attestation. We must freeze the trust model before touching Core.

Design artifacts

• Trusted Host V2 security and direct Grok Build design
• 30-threat attack model
• 19 OS/IPC security cases and 15 native Grok acceptance cases
• Bounded adversarial self-review and remaining independent review gates
• Updated full roadmap Phase 0/1 complete, Phase 2 review pending.

Proposed architecture

• Keep FlowKit P0-A Compiler, Program ABI, Coordinator, SQLite WAL/FULL/CAS and Ed25519 Host receipt V1 unchanged.
• Host owns separate protected OS identity, signing key/Store, authorization and authenticated origin/event evidence.
• Windows: separate service principal and file ACL; default portable transport is local loopback TLS/mTLS with protected Bridge credentials. Windows Named Pipe requires separately reviewed DACL and client-SID enforcement; cannot rely on default Node Pipe security.
• Linux: distinct UID/GID and real read/write-denial tests; scripted nobody tests do not prove live Grok isolation.
• Grok Build: use direct CLI/native JS tool loop without ACP prerequisite; capture original tool_call start event and correlate exact Pending/results before Host signs; explicitly test tool_call_update deadlock and fabricated source logs.
• Provider-native signing is not assumed to exist; model-entered sessionId, usage.signature, Host self-signed unobserved JSON, client TLS cert alone cannot pass provenance.
• After a second adversarial design pass: Bridge and Host sharing HOST_USER are explicitly one trusted TCB, not separately OS-isolated; distinct BRIDGE_USER is required if signer isolation from Bridge is an additional guarantee.
• Host-only OBSERVED/SIGNED/ACKED outbox covers signed-receipt crash before CAS and proof expiry; SEC-18/19 and NAT-15 are newly frozen as pre-implementation tests.

Review and safety gates

Design PR only. No production Core/SDK/Program ABI/schema changes; no executable Host implementation; no release. This PR cannot pass Windows/Grok native security by CI alone. P0/P1 threats are enumerated with practical negative tests. Marking the PR green does not close C12/S13, C08 or M6.

Required review

1. Independently inspect trust principals and two-hop Bridge credential custody.
2. Check whether the direct Grok CLI emits a trustworthy tool_call start event before the tool submits; if not, require a separate two-stage design.
3. Verify that source attestation level is not overstated beyond Host-observed evidence.
4. Check Windows ACL/Service and actual OS negative cases are implementable on a dedicated Windows security runner.
5. Check no hidden change to M5 signed receipt V1, Public Task shape or old P0-A semantics.
6. Ensure all TH-001..030, SEC-01..19 and NAT-01..15 identifiers map to a test, evidence and a responsible future phase.
7. Review the Host-only receipt Outbox recovery before CAS, signer proof expiry and evidence retention.
8. Review whether Bridge and Host sharing one OS account is correctly treated as a single trusted computing base.

Merge policy: Keep Draft until independent security review and exact-HEAD documentation CI. Do not automatically begin Phase 3 production security implementation on a merely green docs PR.

Exact-HEAD CI and review evidence

• HEAD: d1c7c76d03780f04a5b761699cdbc9ac82f0b86c.
• GitHub Actions 43025742100: 7/7 jobs SUCCESS.
• Ubuntu 24.04 × Node 22.13.0/24.22.1 and Windows 2025 × Node 22.13.0/24.22.1: 369/369 tests PASS in each of the four cells, zero failures/skips.
• Linux M5 OS-user isolation + M6 scripted Host integration: 11/11 PASS on each Node version, with the existing cross-UID access-denial proof.
• Website build: PASS.
• Automated document consistency: TH-001..030, SEC-01..19, NAT-01..15, DR-01..15 enumerated; no missing IDs or unclosed Markdown code fences.

Important limitation: these checks confirm existing implementation regression and document compatibility, NOT Windows secure Host ACL tests, Grok Build native source provenance or Phase 3/4 implementation.

External independent security review is still required to approve the architecture before Phase 3.

External Grok F-01–F-07 review reconciliation (2026-11-11)

• Original external review: FlowKit-PR14-Trusted-Host-V2-Independent-Security-Review-Grok.md, SHA-256 3d4f14298b5d347d5deb7f34ce9256e79bade70d28965cfa85a94453108293fb; verdict CONDITIONAL PASS against frozen commit d1c7c76d03780f04a5b761699cdbc9ac82f0b86c.
• F-01 confirmed, Phase 3 entry/exit and H3-02/Phase 4 tool gates made explicit; no precondition that Grok tool binding is already live before OS isolation work.
• F-02 confirmed design gap, not all proposed assumptions: direct Grok tool registration is through a configured MCP tool (preferred PoC) or a separately verified constrained Node tool, not --tools registering arbitrary JS. toolInputDigest and receiptHash now have distinct meanings. Native tool_call timing/large-input binding not yet demonstrated.
• F-03 confirmed: TH-017/TH-023 upgraded to P0; TH-028 remains P1 with a hard Phase 4 stop.
• F-04 real Windows mechanism: cross-principal handle inheritance unverified; inherited-handle negative tests added to SEC-02/03 and Host launch rules.
• F-05 confirmed default Windows Named Pipe risk from Microsoft official docs; the review's exact per-Node SDDL measurements lack replayable script and are not represented as independently reproduced.
• F-06 confirmed: C12 row added to acceptance crosswalk; Grok vs FlowKit request IDs separated; Outbox canonical normalized receipt bytes and receiptHash bound to proofId for safe expiry handling.
• F-07 unresolved external artifact evidence: V0.3 and V0.6-R5 formal original bodies and full SHA-256 unavailable in this review environment. Conformance BLOCKED; prior historical report or roadmap cannot substitute for originals.

Changes are documentation-only, not security implementation. PR stays Draft; do not merge until focused independent re-review of revisions and recovery of formal contract originals. Exact-HEAD CI is not Windows ACL/native Grok security evidence.

Second external Grok re-review — 2026-11-11

Reviewed frozen commit 51a759975abcaee928faf50aec99ebed324fdfcc with FlowKit-PR14-Trusted-Host-V2-F01-F07-Targeted-Rereview-Grok.md (uploaded SHA-256 4528278eddb1ade36c8a388c4ad4181f93f8d364a323ca54b0a4c19ea4ee3062). Verdict: CONDITIONAL PASS.

• F-01 remained PARTIAL/P1 because H3-05 depended indirectly on H3-02 and Phase 4 NAT-14; corrected to H3-05 ← H3-01 only for OS-only tests. Separate minimal pre-implementation Grok tool-call capability probe from formal Phase 4 NAT-14. H3-04 completes active-ingress/signer tests before full Phase 3 exit.
• New F-R2-01 P2: Secure Windows/Linux Profile and final conclusion still implied mandatory mTLS despite optional topology. Corrected: two OS principals, secrets/DB/handle isolation mandatory; loopback TLS/mTLS, named pipes and an additional Bridge process are optional only with actual use. SEC-05 still tests the actual candidate ingress; SEC-07 may be N/A—NO_LISTENER only if no TLS endpoint exists.
• F-02 PARTIAL/P1 remains: Grok native MCP tool event ordering, rawInput/receiptHash association and model-side result transport require actual headless PoC before H3-02; no claim of NAT-14 PASS.
• F-03, F-05, F-06 remain CLOSED at document-contract level; F-04 remains PARTIAL pending Windows actual cross-principal inherited handle tests.
• F-07 formal V0.3 requirements and V0.6-R5 technical design originals and full SHA-256 remain NOT_VERIFIABLE/BLOCKED; historical ChatGPT sandbox paths were not accessible to current tools and were not treated as evidence.

Updated docs-only head records the independent second review and remediation. PR remains Draft until targeted diff recheck and formal requirements provenance resolution. No FlowKit Core, SDK, JS Program ABI, SQLite schema or M5 receipt V1 changes; no main merge or release. Existing scripted CI cannot pass Windows native OS isolation or C12/S13.

Latest exact-HEAD Phase 2 review patch

• Head 316e426aa8d96e4a6b6bee8afd35c0cd313fd244: Actions run 43045141302 7/7 SUCCESS.
• Four OS/Node cells (Ubuntu 24.04 and Windows 2025 × Node 22.13.0/24.22.1) each ran 369/369 tests PASS, 0 failed, 0 skipped; Linux scripted cross-UID Host isolation Node 22/24 each 11/11 PASS; website succeeded. These are existing regression tests, not Phase 3 Windows Secure Host or native Grok N evidence.
• F-01/old P1 design dependency cycle repaired: H3-05 OS-only tests depend only on H3-01; H3-02 tool registration/sign-before-completion check is a preliminary capability PoC, never a claimed NAT-14 PASS; H3-04 later completes integrated active-ingress/Outbox/receipt tests; formal NAT-14 is Phase 4.
• F-R2-01/new P2 deployment-profile conflict repaired: both secure profiles require two actual OS principals and tested secrets/DB/handle isolation, but mTLS/TCP listener/additional Bridge are optional when not used. SEC-05 still tests actual model-result ingress; SEC-07 becomes N/A—NO_LISTENER only when that TLS endpoint genuinely does not exist.
• Scope: changes are docs only; no production Core/JS Program/SQLite Schema/Ed25519 v1 changes.
• Still BLOCKED: actual Grok MCP tool_call timing/rawInput binding (F-02/NAT-14), real cross-principal secret-handle denial (F-04), and full-body V0.3 requirements/V0.6-R5 formal design provenance (F-07).
• Decision: keep Draft and unmerged. A final focused diff re-review should examine only F-01 and F-R2-01. No full M6, C12 or S13 acceptance claim.

Third-round final review — F-01 and F-R2-01 CLOSED

• Grok Build final targeted report: FlowKit-PR14-F01-FR2-01-Final-Targeted-Review-Grok.md; SHA-256 7936d6cef9d3c26f5870eb2303fe52c6f215487e740c1fa57787e06716c67933. It independently reviewed frozen HEAD 316e426aa8d96e4a6b6bee8afd35c0cd313fd244 and marked F-01 and F-R2-01 CLOSED at design-document level.
• Final cross-check found no new P0/P1. A minor Windows checklist ambiguity was additionally clarified: loopback certificate tests apply only if a listener exists; protected Bridge-client tests apply only if a separate Bridge is deployed. No-listener/no-separate-Bridge cases still test the actual candidate ingress through SEC-05/06.
• Roadmap and design status now reflect: F-01/F-R2-01 CLOSED; F-02/F-04 PARTIAL; F-07 NOT_VERIFIABLE / formal V0.3 and V0.6-R5 conformance BLOCKED.
• Current docs-only HEAD: b9d0c1efe17c386f798e30b4331f7bd90a1936e3. Exact-HEAD CI: run 43096045021 (pending at time of update).
• No source, tests, types, Program ABI, SQLite schema, or receipt V1 changes. This PR may be merged only as an explicitly Draft/conditional design record; merge does not authorize Phase 3 or declare contract conformance/M6/C12/S13 PASS. User decision required before changing PR state or merging.

---

Note

Low Risk
Documentation and traceability updates only; no runtime, authentication, or data-handling code paths are modified.

Overview
Documentation-only Phase 2 design record for Trusted Host V2 and native Grok Build bridging—no Core, SDK, or test code changes.

The delivery roadmap is revised for post–Phase 1 main (9bac8f8), merged PR #13 / closed PR #7, and Phase 2 CONDITIONAL status after three rounds of Grok review (F-01/F-R2-01 closed at doc level; F-02/F-04 partial; F-07 formal V0.3/V0.6-R5 conformance still BLOCKED). Phase 3/6 text now spells out optional TLS/mTLS/listeners (NO_LISTENER), H3-05 OS-only tests depending only on H3-01, and that Grok tool evidence is not required before OS isolation work.

Four new draft artifacts freeze the intended security posture without implementing it: deployment design (MODEL_USER vs HOST_USER TCB, Host-only tool observation, Ed25519 receipt v1 unchanged), 30-threat matrix, SEC-01–19 / NAT-01–15 acceptance tiers (P/M/T/N/V), and a review ledger reconciling DR-01–15 and F-01–F-07. Cross-cutting rules added in docs include rejecting default Node Named Pipe as secure IPC, mandatory validation of actual model ingress paths, sign-before-tool_call_update timing (NAT-14), and Host-only OBSERVED/SIGNED/ACKED outbox recovery.

Merge is framed as an explicitly limited design record; it does not authorize Phase 3 implementation or M6/C12/S13 pass.

^{Reviewed by Cursor Bugbot for commit 42961d8. Bugbot is set up for automated code reviews on this repo. Configure here.}