# ADR 0007 — Threat model and trust zones

Status: accepted (2026-07-07) · Plan: rev 3, Security model section

## Context
The control plane can restart services and (eventually) mutate config
fleet-wide. Compromise of any one container must not equal compromise of
the fleet.

## Decision
Trust zones as Docker networks: net-front (Caddy→api only), net-data
(Postgres), net-ops (SSH egress, actuator only). Hermes holds no SSH keys;
the actuator uses a restricted key (command=/from= in authorized_keys)
until the /executions gateway fully brokers actions. Caddy is an explicit
trust root but the API independently validates OIDC JWTs — network origin
is defense-in-depth, never the auth (this enables the LAN break-glass API
binding; the Hermes gateway remains mesh-only). Policy changes are
dual-controlled with before/after hash auditing and a startup
hash-vs-known-good check. Approval tokens are single-use HMAC, hashed at
rest, TTL-bound.

## Consequences
- Documented residual risks: plaintext LAN break-glass hop (emergency use),
  Postgres as shared dependency of all roles, macOS host itself unmanaged
  by the OS.
- Rotation cadences: actuator SSH key 6mo, machine tokens 90d, webhook
  HMAC 1y — scheduler raises expiry signals 2 weeks ahead.