ARCHITECTURE NOTE · ARC-120
Minimize control records and keep authority outside the browser.
The protection model limits stored fields, separates secret material from static assets, uses opaque session references, restricts local process access, and defines deletion and recovery boundaries.
1. Data classes
| Class | Examples | Primary protection |
|---|---|---|
| Authentication | Salted password digest, MFA digest | Static server configuration; never browser-delivered |
| Session | Token digest, CSRF secret, expiry, last seen | Server database and host-scoped cookie |
| Operations | Resource requests, settings, state | Role checks and parameterized persistence |
| Audit | Actor, action, resource, outcome, request ID | Append-oriented application path and restricted view |
| Recovery | Case ID, submitted username, source digest | Uniform response and bounded request rate |
2. Minimization and separation
The static site contains no plaintext credential, private connector key, provider tenant secret, session database, or audit source address. Integration views expose registry aliases and operating state only. Bulk object payloads and regional worker internals are not stored in the control-plane database.
Source addresses entering audit or recovery records are transformed using keyed HMAC. This supports correlation without storing the clear address in those tables.
3. Session and credential protection
Passwords use unique random salts with PBKDF2-HMAC-SHA-256 at 600,000 iterations. Session tokens contain high-entropy random material and are stored only as SHA-256 digests. Server-side idle timeout, absolute expiry, logout revocation, and a maximum active-session count limit exposure.
4. Host and process boundary
The application runs as a dedicated unprivileged account with a restrictive umask, read-only system protection, no Linux capabilities, no privilege escalation, private temporary and device namespaces, filtered system calls, and network access limited to localhost. The only writable application path is the control database directory.
The deployment does not modify the gateway services, tunnel interfaces, public transport ownership, or firewall policy. The web origin and Control API remain loopback-only.
5. Backup and recovery
Release backups capture application files, origin configuration, service definition, and a consistent SQLite copy before deployment. Recovery validates the previous application health, origin configuration, and process bindings before service is considered restored. Backups inherit restricted access and should be removed when their retention purpose ends.
6. Retention and deletion
Session rows are deleted on logout, idle timeout, absolute expiry, or active-session cap enforcement. Operational, recovery, and audit retention follows the Data Retention Standard. Deletion requests must preserve records subject to an active security, legal, or incident hold.