Provider security and state boundaries

A single-host filesystem reference must not be mistaken for a distributed control plane.

Keep private state private

Expose only the provider public directory. Private configuration and state must be owned by a dedicated unprivileged account with protected modes and trusted parent directories. Root runtime, symlinks, foreign ownership and malformed stores fail closed. Preserve replay, key-binding, registry and operation state in consistent backups.

Validate every activation

The HTTPS endpoint accepts POST JSON only, caps requests at 16 KiB and rejects stale timestamps and replayed nonces. Key binding is atomic. The operator must also configure trusted proxy signalling, edge throttling, body and time limits, monitoring and logs that omit secrets.

Scale without dropping guarantees

Local flock and atomic rename provide a single-host reference. Multi-host workers require equivalent transactional locking, replay protection, idempotency and ownership guarantees. Do not clear key-binding or operation files as a recovery shortcut.