Security · The family

lockhub safety model

The hub never runs a request, never sees its results, and never sees values in clear.
A Lock executes only on a decision signed by the hub key it pinned, bound to the exact plan that was approved.
Chat facades (Slack, Telegram) show masked screens only and answer only non-production reads and writes; a lockfamily.yaml can narrow this routing, never widen it.
Quitting lox run stops serving decisions: pending tickets wait at the hub for the next lox run (fail closed).
Whoever can open the facade socket is the host's human: your host account, never an agent container.