Wrench limits authority before an agent reaches the web.

Foreign data is parsed; authority is selected separately

Wrench treats CLI input, URLs, manifests, packages, plugin messages, provider responses, browser output, files, durable state, and subprocess diagnostics as untrusted. Foreign values are strictly parsed and bounded, and sensitive values are redacted from terminal output, receipts, and diagnostics.

Operations expose semantic jobs such as messaging.list, not raw cookies, selectors, scripts, arbitrary HTTP, or every signed-in tab. The exact auth locator is bound to one provider account and transport. Wrench does not silently move between an official API, browser session, linked-device store, or portable plugin.

Account-bound reads stay under local custody

A successful R1 read with a verified account subject can publish an encrypted snapshot of the exact validated query and bounded provider output. The same query can later load from local ciphertext without contacting the provider. Inputs, account subjects, cursors, private identifiers, and provider output remain inside authenticated local encryption.

A failed refresh or publication does not erase the last verified snapshot. Replacing or removing an auth locator rotates its local lifetime identity, so ciphertext from an earlier account incarnation cannot become current after recreation. Exact provider paging and completeness semantics are retained rather than being translated into invented certainty.

Risk levels keep reads and writes distinct

R1

A reviewed read with no intended remote mutation.

R2

One bounded, normally reversible change.

R3

An externally visible or consequential change.

R4

Blocked.

R2 and R3 operations create an exact, short-lived preview. The confirmation binds the adapter, transport, account realm, input, attachment hashes, side effect, contract hash, and dispatch schedule. If a request left the machine but its response was lost, Wrench retains the indeterminate result and does not retry or switch transport. A separate reconciliation needs exact external evidence.

Provider drift fails closed

A changed origin, account proof, request, status, field, or response shape returns the affected operation to capture-required. That state is an inert reservation. It cannot plan or execute until authorized evidence establishes a newly reviewed contract.

This rule keeps capability gaps visible. For example, LinkedIn's official contact adapter does not grant authority to its separate consumer-web inbox adapter, and an Instagram inbox summary does not authorize an individual thread read. Review current state in the provider capability reference.

Portable plugins are contained, not treated as hostile code

Source plugins ship as trusted in-process code. A portable plugin requires an explicit trust decision for one verified, content-addressed bundle and runs through a denied-by-default child-process protocol. The protocol limits the services a well-behaved plugin can request and contains ordinary crashes.

It is not a hostile native-code sandbox. Plugin code still runs with the ambient operating-system authority of the current account. Review code before trusting it, keep Wrench state on a trusted local filesystem protected for that account, and follow the plugin verification workflow.

Archive integrity is verifiable, but local same-user processes remain trusted

Completed media archives use versioned manifests and SHA-256 records that wrench verify recomputes. Wrench invokes media tools without a shell and does not persist cookies, request headers, signed media URLs, raw yt-dlp metadata, or transport fragments.

Archive locks and atomic same-volume publication coordinate Wrench processes. They are not a boundary against another process running as the same user. Keep archive roots and transcription configuration on a trusted local filesystem, obtain selected native tools and models from trusted sources, and use verification to detect later changes.