HRA coordinates local Codex accounts and can control active coding sessions. Treat a vulnerability that crosses an account, device, process generation, filesystem root, or execution lease as security-sensitive.

Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting for this repository. Include the affected version, platform, reproduction steps, expected boundary, observed result, and whether credentials or provider mutations were exposed.

Until the first stable release, only the latest published beta receives security fixes.

HRA does not sync Codex credentials, raw reasoning, approval secrets, environment values, or arbitrary tool output. Cloud commands do not bypass local Codex permissions. Account switching is explicit and never used to evade provider limits.

The CLI stores HRA's revocable device credential, workspace encryption key, and local signing authority as immutable generations below its private state root. Custody directories must be owned by the current user with mode 0700. Value files must be single-link mode-0600 regular files and are read through bounded no-follow descriptors. The detached Bun daemon never opens a Keychain prompt. HRA forces both pinned Codex credential stores to file mode and verifies their effective settings, so Codex credentials remain separately owned by each profile's isolated CODEX_HOME.

Facts-memory authority is host-derived from one exact account and session. Agent commands cannot select its store, directory, authority, rule set, or purge capability. HRA persists only opaque hashes, exact public heads and receipts, lifecycle state, and expiry metadata. Release-verified Oh v0.2.0 remains the semantic authority behind a narrow broker port; its immutable tag resolves to commit 89fb133 in HRA's lockfile.

The local Oh adapter confines each store to one canonical current-user-owned mode-0700 session directory outside HRA's lifecycle SQLite. It enforces and reads back mode 0600 on the main SQLite file, observed WAL and SHM files, and its no-follow metadata sidecar. Cleanup quiesces the store, rejects links and path escape, revalidates the bounded tree, renames the whole directory to a host-derived quarantine, and removes that quarantine before committing a purge receipt. These path checks protect against accidental and cross-boundary traversal. They do not sandbox another process running as the same operating-system user, and they do not erase backups or filesystem snapshots.