DOCS · EVIDENCE

Battle Tested

Cortex has completed a structured 12-checkpoint hardening campaign. This page is the public evidence ledger: it distinguishes controls that exist from properties that have survived adversarial testing.

What the campaign covers

Cortex has a deliberately narrower surface than a browser IDE, but high authority inside its selected workspace. The campaign concentrates on authentication and proxy trust, workspace confinement, provider credentials, OpenCode subprocess lifecycle, hostile model output, durable conversations, resource bounds, releases and integrated recovery.

Evidence standard

Every completed checkpoint must include regression tests for repaired findings, focused adversarial evidence, the complete Go and frontend gates, rebuilt Nift output, updated affected documentation and separate clean commits for Cortex, website source and generated website output. A planned test is never reported as a passed test.

CX00 evidence

Cortex now registers 20 API routes through one typed inventory. Every route has a unique path, allowed-method set and public or authenticated-session boundary; exactly five authentication bootstrap and OAuth routes are public. The browser, proxy, Cortex process, workspace, OpenCode, provider and persistence trust boundaries are recorded alongside the starting risk register.

The baseline passed the complete Go suite, race detector and vet. Route-registry tests fail if a route is duplicated, lacks methods or a handler, uses an unknown boundary, or is accidentally made public.

CX01 evidence

The real HTTP server now bounds request headers, header-read time, body-read time, idle connections and request URIs while deliberately leaving the global write timeout disabled for streamed agent runs. Each API route enforces its declared methods; request bodies require JSON when present, are size-bounded, reject unknown fields and reject trailing documents.

Security headers and Cache-Control: no-store are asserted across successful and failing API responses. Focused tests also cover unsupported methods and content types, strict decoding, generic panic containment and the server timeout contract. The complete Go suite, race suite, vet and a production build passed.

CX02 evidence

Concurrent first-run setup produces one winner. Sessions are random HttpOnly, SameSite Strict cookies, expire after seven days, are capped at eight and are all revoked by process restart. A password change requires the current password, revokes every existing session and rotates the current browser onto a fresh session.

Login failures are throttled per direct client with a bounded tracker. TOTP enrollment is session-bound and expires after ten minutes; accepted login codes cannot be replayed during their validity window. Google OAuth state is single-use, expires after ten minutes, is capped at 128 outstanding requests, retains the original callback URI and uses PKCE S256. Unauthenticated auth-state responses no longer expose the configured Google identity or client ID.

CX03 evidence

Every authenticated session now carries a separate random CSRF token. Mutations require exactly one matching X-Cortex-CSRF header and a structurally valid same-origin Origin; setup and login also reject cross-site submissions. Origin parsing rejects duplicates, userinfo, paths, queries, fragments and scheme or host mismatches.

Forwarding headers are ignored by default. --trust-proxy accepts a single forwarded scheme and client address only from Cortex's direct loopback peer; ambiguous chains and remote peers fail closed. --public-origin pins the canonical external scheme and Host. Focused tests cover hostile peers, forwarding ambiguity, Host/Origin shapes, missing and duplicate CSRF credentials, valid mutations and cross-site login.

CX04 evidence

Cortex canonicalizes every existing browse, preview, launch and restored-conversation workspace at its point of use. Lexical traversal and symlink chains that resolve outside the configured root fail closed; an in-root symlink to an in-root target remains usable. Directory responses stop above 5,000 entries, previews stop above 2 MiB, and only regular files are previewed.

Focused tests retain external-symlink, permitted internal-symlink and restored-workspace cases. This is an application boundary, not an operating-system sandbox: OpenCode still has the host account authority inside its selected workspace.

CX05 evidence

Provider configuration is bounded and parsed strictly at startup. Corrupt settings now stop Cortex with a diagnostic instead of being silently replaced. Atomic replacement files and the final settings file are owner-only. Provider model identifiers reject controls and key material is size-bounded.

Public settings expose configuration status, never key values. Subprocess failures are redacted against every configured API key and the Google OAuth client secret. Keys are protected at rest by host filesystem permissions rather than application encryption; processes running as the Cortex account can still inspect memory and environment.

CX06 evidence

Agent launches resolve one fixed opencode executable and pass an argument array without a shell. Cortex admits at most four simultaneous runs, registers each under an opaque run ID and exposes authenticated cancellation. Request disconnects also cancel their run. Terminal paths release the run slot and registry entry.

On Unix, cancellation targets the child process group so descendants do not outlive the supervised run. Windows currently relies on Go direct-child cancellation and retains that platform limitation. OpenCode remains deliberately auto-authorized within the selected workspace.

CX07 evidence

Provider NDJSON is bounded to 1 MiB per line, 4,096 events and 32 MiB per run. Crossing an aggregate limit cancels the process and emits an explicit Cortex-owned truncation event. Stderr and surfaced diagnostics remain bounded and secret-redacted.

The transcript renderer constructs model text with text nodes. Its limited Markdown links accept only explicit HTTP(S) URLs and open with noopener noreferrer. Provider-reported tool shapes are labelled as provider reports and cannot select Cortex-owned done or error state. These controls do not make model output truthful or prevent prompt injection within an authorized task.

CX08 evidence

Bulk conversation import now executes as one SQLite transaction: one invalid conversation rolls the entire batch back. Startup deterministically changes persisted running conversations and agent runs to interrupted because their child process cannot survive restart. Search and list results stop at 250 rather than loading an unbounded history.

Migrations are transactional, future schemas fail closed, foreign keys are enabled, WAL uses FULL synchronization, and the database file is owner-only. Token and cost fields are explicitly provider-derived estimates, not authoritative billing facts.

CX09 evidence

Cortex admits at most 128 concurrent HTTP requests. Saturation returns 503 with Retry-After: 1, and focused tests prove the server accepts work again as soon as capacity returns. Agent runs remain capped at four and SQLite at eight connections.

Other retained bounds include eight authentication sessions, 128 OAuth states, 5,000 directory entries, 250 conversation results, 32 open browser conversations, 20 closed conversations and 500 retained events per tab. Race tests exercise concurrent settings access. These are safety limits for one node, not throughput promises.

CX10 evidence

The release workflow builds exact three-file archives for Linux, macOS and Windows on amd64 and arm64, requires a semantic release tag and publishes SHA-256 checksums. Repository history is scanned for binaries, databases and archives.

The installer requires HTTPS with TLS 1.2 or newer, downloads the checksum manifest, verifies the selected archive before extraction, stages the executable beside its destination and atomically renames it only after verification. Download, manifest or checksum failure cannot replace an existing Cortex binary.

CX11 evidence

The clean-source closure gate combines the complete Go suite and race detector, vet, native and six-target builds, fuzz seeds for identifiers, provider values and workspace resolution, frontend parser/render checks, release smoke, Nift currency, link validation, Git integrity and binary/secret history hygiene.

The initial contract is now frozen. Retained limitations remain part of the result: Cortex is not an OS sandbox; Windows lacks Unix process-group cancellation; API keys trust the host account; model output can be deceptive; provider and OpenCode behaviour remain upstream dependencies.

Retained boundaries

• Cortex delegates coding-agent execution to OpenCode and currently configures that subprocess with automatic tool permission inside the chosen workspace.
• The configured workspace root is an application boundary, not an operating-system sandbox.
• Provider behaviour and upstream model safety are external dependencies; Cortex must contain and render their output defensively.
• Remote exposure requires deliberate TLS, proxy and host configuration. Loopback remains the safer default.

Evidence maintenance

Future security claims must retain a regression, command and tested platform. A material boundary change reopens the affected checkpoint and updates this page in the same commit sequence.