Ghostget limits authority before an agent reaches the web.

Foreign data is parsed; authority is selected separately

Ghostget treats CLI input, URLs, manifests, packages, plugin messages, provider responses, browser output, files, durable state, and subprocess diagnostics as untrusted. Foreign values are strictly parsed and bounded, and sensitive values are redacted from terminal output, receipts, and diagnostics.

Operations expose semantic jobs such as messaging.list, not raw cookies, selectors, scripts, arbitrary HTTP, native command arguments, or every signed-in tab. The exact auth locator is bound to one provider account and transport. Ghostget does not silently move between an official API, browser session, linked-device store, pinned local CLI, or portable plugin.

Account-bound reads stay under local custody

A successful R1 provider read with a verified account subject can publish an encrypted snapshot of the exact validated query and bounded provider output. The same query can later load from local ciphertext without contacting the provider. Within those snapshots, inputs, account subjects, cursors, private identifiers, and provider output remain inside authenticated local encryption. The separate owner messaging host retains private plaintext history and journals; see the privacy guide for storage and retention boundaries.

A failed refresh or publication does not erase the last verified snapshot. Replacing or removing an auth locator rotates its local lifetime identity, so ciphertext from an earlier account incarnation cannot become current after recreation. Exact provider paging and completeness semantics are retained rather than being translated into invented certainty.

Risk levels keep reads and writes distinct

R1

A reviewed read with no intended remote mutation.

R2

One bounded, normally reversible change.

R3

An externally visible or consequential change.

R4

Blocked.

Generic R2 and R3 operations create an exact, short-lived preview. The confirmation binds the adapter, transport, account realm, input, attachment hashes, side effect, contract hash, and dispatch schedule. The separate owner messaging host can submit an exact prepared plan under explicit managed permissions and a revocable conversation grant with action, expiry, interval, and capacity limits. Its messaging.automation.* catalog entries are permission ceilings, not commands available through generic invoke or confirm; current account and runtime capabilities must also admit the action.

If a request left the machine but its response was lost, Ghostget retains the indeterminate result and does not retry or switch transport. A separate reconciliation needs exact external evidence. Cancellation or revocation stops remaining work but does not prove an already-started action was unsent. Provider acceptance is distinct from delivery or read status.

Provider drift fails closed

A changed origin, account proof, request, status, field, or response shape returns the affected operation to capture-required. That state is an inert reservation. It cannot plan or execute until authorized evidence establishes a newly reviewed contract.

This rule keeps capability gaps visible. For example, LinkedIn's official contact adapter does not grant authority to its separate consumer-web inbox adapter, and an Instagram inbox summary does not authorize an individual thread read. Review current state in the provider capability attestation.

A provider CLI is pinned bytes behind a semantic contract

A source plugin can use the local-cli transport only when it records the exact executable SHA-256 for every supported platform and binds every upstream archive or release-manifest artifact that the provider publishes. Each operation owns a fixed argument template and strict projection. Callers cannot select a command, flag, endpoint, target, environment variable, plugin, or output path.

Ghostget starts the exact executable without a shell under private config, data, cache, and temporary roots. It strips ambient credentials and defaults, enforces its own deadline and byte bounds, and treats a lost or malformed post-dispatch response as indeterminate. A version range, package-manager channel, tag, launcher, or reported version cannot replace executable-byte identity.

Portable plugins are contained, not treated as hostile code

Source plugins ship as trusted in-process code. A portable plugin requires an explicit trust decision for one verified, content-addressed bundle and runs through a denied-by-default child-process protocol. The protocol limits the services a well-behaved plugin can request and contains ordinary crashes.

It is not a hostile native-code sandbox. Plugin code still runs with the ambient operating-system authority of the current account. Review code before trusting it, keep Ghostget state on a trusted local filesystem protected for that account, and follow the plugin verification workflow.

Archive integrity is verifiable, but local same-user processes remain trusted

Completed media archives use versioned manifests and SHA-256 records that ghostget verify recomputes. Ghostget invokes media tools without a shell and does not persist cookies, request headers, signed media URLs, raw yt-dlp metadata, or transport fragments.

Archive locks and atomic same-volume publication coordinate Ghostget processes. They are not a boundary against another process running as the same user. Keep archive roots and transcription configuration on a trusted local filesystem, obtain selected native tools and models from trusted sources, and use verification to detect later changes.