Security, evidence, and lineage

Scopwis is designed so model intelligence can propose analytical work without becoming the authority for data access, query safety, evidence validity, or report publication.

Deterministic boundaries

The Rust host owns:

actor and source authorization;
typed read-only query validation;
method registration and parameter contracts;
execution budgets;
artifact IDs, revisions, and lineage;
evidence references in Analysis Artifacts;
ReportSpec validation;
high-impact mutation boundaries.

The reasoning model cannot widen those boundaries through prose.

Evidence-first answers

A material finding must reference evidence produced in the current authorized run. Query and mining results become immutable artifact envelopes. The model receives bounded observations rather than unrestricted raw payloads.

When a later synthesis/provider step fails, completed evidence is preserved instead of being erased.

Query safety

Scopwis compiles typed query plans rather than executing model-supplied arbitrary SQL. DDL and DML are outside the Agent data plane. Multi-table work uses bounded inspected relations and validated equality joins.

Source and credential isolation

Provider credentials, connection-profile secrets, OAuth provider tokens, and model API keys stay server-side. Public Bootstrap and normal Agent observations are secret-free.

External MCP/capability tools are projected only after local policy approval. Remote metadata is not trusted as authorization.

A report is valid only when its data bindings and provenance resolve to authorized artifacts. Public shares are explicit, revocable, revision-bound snapshots with a reduced projection.

Lineage

Artifacts retain producer, revision, upstream inputs, and trace ownership. Payload TTL can remove large data bytes without rewriting historical lineage. This lets a later reader distinguish “artifact existed but payload expired” from “analysis returned an empty result.”

Dependency security checkpoint: 2026-10-03

The statistical backend preserves Augurs's supported algorithms and its two pinned rv APIs. Scopwis carries the original rv 0.16.5 and 0.18.1 sources with only their LRU dependency requirements changed. The workspace selects upstream lru 0.18.4, which includes the mutable-iterator fix (RUSTSEC-2026-0002) and the key-destructor panic fix (RUSTSEC-2026-0253). CI checks the active dependency routes, unchanged source hashes and retained MIT notices; statistical and cache regressions exercise compatibility.

rsa 0.9.10 remains reported by RUSTSEC-2023-0071. Upstream has no patched release at this checkpoint. The locked callers are SQLx MySQL authentication and OpenDAL's request-signing dependencies. SQLx uses a server public key to encrypt the client password with OAEP; it does not hold the server's RSA private key. Google service-account signing and Azure client-certificate assertions use randomized, blinded signing through reqsign rather than accepting ciphertext for private-key decryption. This narrows the current exposure; it does not make the upstream advisory disappear or prove resistance to every timing attack.

Scopwis does not expose an RSA private-key decryption API or introduce a custom cryptographic patch. Existing MySQL and cloud-storage capabilities are retained, and no advisory is added to an ignore list. A change to these calling boundaries requires a fresh security review. Deployment teams must account for the unresolved RSA dependency; a green pull-request dependency delta is not evidence of a clean full dependency audit.