Tor is down
The declared route is unreachable. The run stops. It does not retry over clearnet, and it does not queue the message for later.
MRD-0201 route_unavailable
Threat model
Assume the traitor is inside.
An agent reads untrusted text and then acts with your credentials. Sooner or later it will be talked into something. hermes-mordred is built so that the worst outcome of that is a refusal, not a leak.
Who is trusted, who is not.
Trusted
- The Secure Enclave or TPM on this machine.
- The local policy file you wrote and can read.
- The mordred plugin code, which is MIT and auditable.
- The operating system you already trust with the disk.
Not trusted
- The agent, and every string it has ever read.
- Remote inference providers, paid or otherwise.
- Slack, Discord, mail relays — any gateway in the path.
- The network, including the one you are on right now.
- Us. We ship code; we never see your runs.
Untrusted
- Agent & prompts
- Gateways
- Remote inference
- The network in between
Assumed hostile, or one prompt away from it.
Policy — hermes-mordred
- Route declared? ✓
- Secrets in prompt? ✗
- Payload encrypted? ✓
- Log writable? ✓
Any ✗ stops the run. It never downgrades to a weaker path.
Trusted — hardware
- Secure Enclave
- TPM 2.0
The private key is generated here and never leaves. Signatures come out; key material does not.
Every guarantee, and how you check it yourself.
A claim you cannot verify from your own terminal is marketing. Each row below ends in a command.
| Guarantee | How it is enforced | How you verify |
|---|---|---|
| The private key never leaves the device. | Generated in the Enclave/TPM with export disabled at creation. Signing happens behind the platform helper. | mordred keyvault attest |
| Traffic only goes where you declared. | Egress is denied by default; the run inherits one route from policy and cannot open another. | mordred network show |
| Gateways carry ciphertext only. | Message bodies are sealed to the recipient key before the transport client is handed anything. | mordred e2e inspect --last |
| Secrets do not reach remote inference. | Prompts are scanned on the way out; a match halts the call rather than redacting silently. | mordred guard test |
| Nothing runs with a broken guarantee. | Startup evaluates the whole policy; an unmet clause aborts the run with a reason code. | hermes-mordred status |
[TBD]Final subcommand names pending CLI freeze.
What fail-closed actually looks like.
Three ordinary situations. In each one the safe move is to stop, say why, and leave the decision to you — never to continue on a weaker path because it was more convenient.
A prompt carries a key
The agent pasted a credential into context. The call to the provider never opens; the matched span is named in the log, not its value.
MRD-0142 secret_in_prompt
The log cannot be written
Disk is full or the log key is unavailable. Unrecorded work counts as unsafe work, so the run stops there too.
MRD-0310 audit_unwritable
[TBD]Reason-code numbering to be confirmed against the implementation.
The audit log is yours alone.
Append-only, encrypted to the device key, and written before the action it describes. It records decisions and reasons — never the secret that triggered them.
- PATH
- ~/.mordred/audit.age
- CIPHER
- age · device key
- ROTATION
- daily · kept locally
mordred audit tail
09:14:02 ALLOW e2e.seal → slack:#ops · 1.4 kB ciphertext
09:14:02 ALLOW network.open → route=tor · declared
09:17:41 DENY guard.prompt → MRD-0142 secret_in_prompt
match: aws_access_key · span 412–432 · value not recorded
09:17:41 HALT run aborted · exit 1
09:22:08 ALLOW keyvault.sign → enclave · key not exported
What this does not protect against.
The honest half of a threat model. If your adversary is on this list, hermes-mordred is not enough on its own.
- 01
A compromised operating system or root-level malware.
Everything here assumes the OS is honest.
- 02
Traffic analysis.
A route can hide content and destination; it cannot hide that you are working at 3am.
- 03
A recipient who chooses to leak.
End-to-end encryption ends at someone else's screen.
- 04
Physical access with your unlocked session.
Hardware keys stop extraction, not use.
- 05
A prompt injection you deliberately approve.
The guard can refuse; it cannot overrule you.
[TBD]Engineering to confirm this list before launch.
Found a hole in this?
Report it privately. We answer within 72 hours and credit reporters who want it.
Verify it yourself
hermes-mordred status