Security is a set of enforced boundaries

Distinguish implemented safeguards from the operational controls your deployment must provide.

Implemented in the module

Ed25519-signed activation, HTTPS verification, validated entitlement limits, bounded provisioning responses and protected local storage constrain accepted configuration. SIP host validation rejects configuration-injection characters. Ownership fingerprints protect unrelated or unexpectedly changed native objects.

Implemented in the references

Customer and resource isolation, scoped evidence, immutable receipt origins, replay protection, request limiting and safe operational diagnostics are represented in the public examples and regression tests. Their presence does not prove a private adapter implements the required authority correctly.

Required from operators

Provide secure customer authentication, CSRF controls, least-privilege carrier access, safe proxy configuration, durable idempotency, assignment locking, backups and incident procedures. Keep entitlement limits authoritative upstream because local root access controls the PBX. No security certification or penetration-test claim is made.