Threat model
Cursors assumes unreliable networks, duplicated messages, compromised discovery infrastructure, disappearing bodies, stale state, malicious executors, leaked capabilities, and users who reconnect after long partitions.
It does not assume one global online authority or one failure-free cluster.
Protected properties
- Integrity: cursor and grant records cannot be altered without detection.
- Authenticity: signatures bind records to explicit cryptographic identities.
- Attenuation: delegation cannot silently gain scope, rights, time, or budget.
- Replay visibility: envelopes deduplicate and effects return stable receipts.
- Causal history: fan-out, migration, and joins remain in the cursor DAG.
- Trust portability: a seized domain cannot replace pinned keys.
- Secret separation: durable public cursor graphs contain identifiers, not private keys or bearer secrets.
Threats and first responses
| Threat | First response | Still open |
|---|---|---|
| record tampering | canonical bytes, domain-separated hashes, Ed25519 signatures | algorithm transition and formal verification |
| capability escalation | verify attenuation at issuance and use | revocation distribution and double-spend domains |
| mailbox replay | content IDs and deduplication | bounded storage and adversarial flooding |
| repeated external effect | stable effect key and receipt | replicated/partitioned redeemer semantics |
| domain seizure | signed manifests and key pins | censorship and traffic analysis |
| stale bootstrap | epochs, expiry, predecessor/successor chain | long-offline recovery UX |
| malicious executor | narrow grants, immutable inputs, output verification | isolation, attestation, private computation |
| hostile Lua source | stored source profile, allowlisted calls, declared capabilities, no ambient loaders/FFI | hardened full Lua parser and embedded-VM sandbox |
| stale worker result | worker leases, task generations, idempotent result admission | distributed executor partitions |
| SQLite query escalation | one-statement limit, sqlite3_stmt_readonly, authorizer, row/time/byte budgets |
broader app-scoped projection policy |
| body loss | published checkpoints and portable continuations | effects in uncertain state |
| equivocation | signed branches remain visible | which applications require consensus |
| Sybil/DoS | scoped trust and resource budgets | public admission and reputation design |
| DHT head forgery or rollback | pinned BEP44 Ed25519 key, minimum sequence, epoch, expiry | threshold keys and long-offline recovery |
| swarm eavesdropping | encrypted manifest and encrypted payload chunks | traffic analysis, invite compromise, cover traffic |
Signed swarms are untrusted availability
Cursors does not attempt to make a public BitTorrent participant trustworthy. Invitation holders pin the signed DHT directory and decrypt the current manifest. The resulting torrent remains an untrusted availability fabric: strangers may store, request, replay, delay, or flood ciphertext blocks. Hashes and authenticated encryption reject altered data; cursor and capability verification reject unauthorized history and effects.
“Nobody can join the swarm” is not a defensible property once an infohash leaks. The actual boundary is that unauthorized participants cannot obtain plaintext or create accepted authority. A hostile participant that only mirrors valid ciphertext may incidentally improve availability, but it is never counted as a trusted body.
Cryptographic status
The executable v0 uses platform Web Crypto SHA-256 and Ed25519 because they are reviewable and available in current Node and browsers. This is a prototype choice, not an assertion that a production suite is finished.
Hash inputs are domain-separated and use Cursors's typed canonical encoding. Protocol records carry explicit versions. Algorithm replacement must be an intentional version/transition design, not unconstrained per-message “crypto agility.”
Ambient authority is forbidden
An executor does not gain access because it runs as root, knows a path, shares a UID, received an object ID, or happens to inhabit the same machine. Host adapters must translate explicit grants into narrow local handles and revoke those handles when the facet or lease ends.
Restricted Lua source is data until its profile, declared capabilities, placement, and program graph are validated. The shipped browser compiler is deliberately not a general Lua runtime: it exposes no load, require, package loader, filesystem, network, DOM, database, debug library, or FFI. SQLite callbacks remain deterministic and non-effectful. Effects enter an outbox transaction and require a separately leased executor plus a stable receipt.
Neither Lua VM memory nor a C/Wasm stack is a checkpoint format. Only explicit serializable continuation state may cross a body boundary.
Uncertain effects
The hardest failure occurs after an effect may have happened but before its receipt becomes durable. Each effect adapter must state which semantics it can provide:
- safely retryable;
- queryable by stable idempotency key;
- compensatable;
- at-most-once within one authority domain;
- consensus-backed;
- inherently uncertain and requiring human resolution.
Cursors must show uncertainty rather than laundering it into “success” or “failure.”
Human-presence claims
No web mechanism can prove that a visitor is not automated or AI-assisted. Root invitations, mailbox-key proof, tiny quotas, rate limits, and optional resource challenges can bound abuse and raise its cost. They must not be described as proof of humanness. The first remote service therefore admits only root-granted mailboxes and keeps public self-enrollment closed.
Before real deployment
- commission independent protocol and implementation review;
- choose production key custody and recovery flows;
- specify manifest threshold and rollback rules;
- isolate executors and device cells;
- fuzz every decoder and graph verifier;
- add resource limits before parsing attacker-controlled values;
- build revocation and audit interfaces people can understand;
- define metadata privacy and traffic-analysis mitigations;
- run adversarial partition, clock, replay, and equivocation simulations.