# Security and privacy

Reliora is local-first and deterministic. The runtime does not read agent chats, observe shell commands, call an LLM, access the network, load remote content, send telemetry, or run a background process.

## Trust boundary

Every experience is untrusted data and advice. A record may contain text copied from failures or third-party systems, so it cannot override user or project instructions. Agents are explicitly told to ignore embedded requests to reveal secrets, exfiltrate data, bypass safety, change rules, or execute unverified commands.

Search rank and `strong` labels do not establish truth. Verify the record's applicability and the resulting code against the current project.

## Secret screening

Before writing an experience or feedback notes, Reliora screens for common high-risk forms including private-key blocks, provider tokens, bearer tokens, JWT-like values, credentialed URLs, and credential assignments. The error identifies the category without echoing the suspected value.

This is defense in depth, not a guarantee. Review records before sharing or committing `.reliora/`. Never store `.env` contents, private keys, passwords, tokens, personal data, production payloads, or raw private logs.

## Bounded input and validation

- CLI and stored JSON files are limited to 1 MiB.
- Fields, arrays, lineage, notes, and event history have explicit bounds.
- Unknown schema fields are rejected.
- IDs, timestamps, lineage targets, outcomes, and impacts receive semantic validation.
- Record lookup uses UUIDs, preventing path traversal.
- Writes use sibling temporary files and atomic rename; temporary files are cleaned after failures.
- Invalid stored experiences are isolated with warnings so one corrupt file does not hide valid data.

## Instruction-file safety

Agent setup writes only a marked managed block and local metadata. It preserves user-owned text and refuses damaged/duplicate markers, unexpected metadata, unsafe paths, shadowing conflicts, and silent integration-type switches. Removal does not delete the experience library.

## Workspace discovery

Reliora searches parent directories for project configuration, but does not inherit a workspace located only at the filesystem root or user home from an unrelated nested directory. This avoids accidentally attaching temporary or unrelated projects to a broad personal workspace.

## Version control

`.reliora/` is ignored in this repository. For another project, ignore it when experiences are private. If a team intentionally versions the library, review every change as sensitive project documentation and apply normal access control.