Trust & security

Security & threat model

The threat model is scoped to the hosted, multi-tenant product. The open-source local CLI runs entirely on your own machine and is out of scope — when you run a stagenet locally, you are your own trust boundary.

Tenant isolation

Tenants are mutually distrusting and may run arbitrary, untrusted Solana program bytecode inside their stagenet — that is the point of the product. The hard boundary is therefore between one stagenet runtime and everything else; a stagenet executes adversarial code and is treated as hostile. Cross-tenant isolation is defended in depth:

• Each stagenet has its own account store and data directory — no shared account namespace.
• Every /v1/* query is filtered by the authenticated tenant_id; a lookup that doesn't match returns NotFound, so one tenant cannot even enumerate another's slugs.
• Each stagenet runs as a separate OS process today; production hardening runs each pod under runtimeClassName: kata (Firecracker microVM) with per-tenant CPU/memory quotas.
• API keys are SHA-256-digested at rest, shown once, tenant-scoped, and revocable; upstream RPC keys (which carry ?api-key=) are deliberately never logged.

Attestation integrity

The rustag-attest crate produces a signed, Merkle-rooted proof of the exact mainnet-derived state a program was tested against. The signing digest is built from a fixed field order with length-prefixed, domain-tagged fields rather than from JSON — JSON key/whitespace ordering is not canonical and must never affect what a signature commits to. The state_root is a binary SHA-256 Merkle root over the pubkey-sorted account set, with leaves (0x00) and nodes (0x01) domain-separated to prevent second-preimage attacks. Account leaves commit to consensus-visible fields only; the internal dirty/clean/pinned bookkeeping is deliberately excluded.

let attestation = Attestation::create(manifest, &keypair); // Recompute the state root from `accounts`, confirm it matches the// manifest, and check the Ed25519 signature — no server, no network.let report = attestation.verify_against(&accounts)?;assert!(report.is_valid()); // Forging any signed field (e.g. att.manifest.slot = 999) breaks the signature.

Audit-log tamper-evidence

AuditLog is an append-only, hash-chained log — the SOC 2 groundwork. Each entry carries a monotonic seq, a prev_hash, and its own hash; the chain is genesis-anchored at the all-zero hash. Any insertion, deletion, or edit anywhere in the log breaks the chain from that point forward, and verify() returns Err(index) at the exact first inconsistent entry.

Service levels

SLO targets apply to the hosted control plane and stagenets — local/CLI stagenets run on your own machine and are best-effort. Targets are deliberately modest; under-promising at this stage is intentional.

The error budget is the inverse of the availability target (0.5%/month); when exhausted, reliability work ships before features. Failure modes are explicit: a cold-fetch mainnet RPC failure serves stale cached data with a warning and never panics; on a realtime WebSocket disconnect the caller reconnects while Clean accounts keep their last value and Dirty/Pinned accounts are never touched.

Known limitations

RustAG implements the Phase 2 spec with deliberate single-node substitutions — each satisfies the same contract as the eventual target, so the swap is additive, not a rewrite:

• Streaming mirror — an accountSubscribe WebSocket instead of native Yellowstone gRPC. Sub-second push with zero lock-in. Live filter updates on an open subscription and built-in auto-reconnect are not yet done.
• Datastore — SQLite + moka instead of Postgres + Redis; correct for the single-node MVP. The Postgres migration and Row-Level-Security policies are not yet done.
• Multi-tenant isolation — child-process isolation instead of Kata + Kubernetes; the kube-rs orchestrator and a running Kata cluster are not yet done.
• Auth & billing — SHA-256-digested API keys instead of Clerk + Stripe; billing is deferred.
• Observability — tracing spans + a JSON /api/metrics time-series; a Prometheus-format /metrics scrape endpoint is deferred.

Other open items: cargo audit / cargo deny are not yet wired into CI; examples exist under examples/ but CI does not execute them; crates are not yet published to crates.io / npm; client-compatibility is validated against @solana/web3.js but not yet the @solana/kit or Rust solana-client matrices.

FAQ

rustag attest -s demo                       # -> .rustag/demo.attestation.json (signed, Merkle-rooted)rustag verify demo.attestation.json -s demo # offline; exits non-zero if INVALIDrustag scan -s demo --fail-on high          # CI gate: exits non-zero at/above 'high'