Nucleonic

THE FOUNDATION

Trust is a boundary.
Then a relationship.

A teammate earns your trust by doing the little things well. These twelve rules are what make that possible on Nucleonic.

Nucleonic is in development. These automated checks are not a certification or a production audit. System checks exercise the implementation with local services. Boundary checks use isolated components or test doubles and cannot replace missing system evidence. The first release uses a separate container per teammate; stronger microVM isolation is planned.

Results recorded . Download the results

The trust run failed or did not finish. These results are partial; passing checks do not establish a complete run.

  1. One teammate. One private world.

    A teammate cannot read another teammate's memory, conversations, files or logins.

    System checks: passed (4/4). Boundary checks: passed (5/5).

    View the checks

    System checks

    • Passed: trust-01 system: PGlite context and writes cannot cross teammates in one account
    • Passed: control memory retains teammate isolation in the canonical RLS repository
    • Passed: routines: event throttling, durable duplicate keys and fenced event payloads
    • Passed: templates: name-and-job blank conversation, connected Inbox backfill and metadata event produce proactive messages

    Boundary checks

    • Passed: 1Password: selected-vault metadata projection cannot expose fields, foreign vaults or website query secrets
    • Passed: trust-01/11 (browser): teammate profiles cannot be borrowed and destruction removes the entire disk
    • Passed: trust-01: context and memory are scoped to one teammate
    • Passed: trust-01/trust-02: fresh importer identities and memory stay in their host account and teammate
    • Passed: Chief accepts only addressed structured status, rejecting context, instructions and approvals
    Test status: passed

  2. Your account stays yours.

    Another person's account cannot read your data. The boundary belongs in the database, too.

    System checks: passed (11/11). Boundary checks: passed (5/5).

    View the checks

    System checks

    • Passed: control memory retains teammate isolation in the canonical RLS repository
    • Passed: billing: a signed webhook cannot bind another account, and retries grant a plan once
    • Passed: billing: forged, replay-window and live webhooks are rejected before a plan or gateway share can change
    • Passed: billing: referral grants both accounts one month, rejects self and duplicate rewards, and protects expiring shares
    • Passed: billing: only 1,000 founding reservations, stable Checkout retries, expiry and lifetime pricing
    • Passed: app: authenticated transport, account-scoped ledger, CSRF decisions and durable Undo through real Control routes
    • Passed: core-04: control rejects superuser and BYPASSRLS roles
    • Passed: trust-02: routes cannot read or change another account
    • Passed: verified identity provisions one personal account
    • Passed: WebSocket updates are scoped to the signed-in account
    • Passed: routines: authenticated routes, RLS and composite ownership exclude foreign routines

    Boundary checks

    • Passed: 1Password: selected-vault metadata projection cannot expose fields, foreign vaults or website query secrets
    • Passed: trust-01/trust-02: fresh importer identities and memory stay in their host account and teammate
    • Passed: core-05: create ignores supplied IDs including deleted IDs
    • Passed: core-11: high-risk auto still asks and foreign principals cannot execute
    • Passed: core-12: unsafe legacy repository and schema are absent
    Test status: passed

  3. Logins live outside the computer.

    A teammate uses a reference to a secret. A separate vault supplies it only to the service you connected. The teammate never holds the raw secret.

    System checks: pending (0/1). Boundary checks: passed (25/25).

    Still pending: evidence that raw secrets stay out of a real teammate process.

    View the checks

    System checks

    • Not run: trust-03 + trust-11 + no-direct-internet: real DockerRunner, vault, live heap, Chromium proxy-only and profile deletion on Docker host

    Boundary checks

    • Passed: 1Password: selected-vault metadata projection cannot expose fields, foreign vaults or website query secrets
    • Passed: Outlook: method, path and grant policies deny cross-service, token endpoint and off-origin access before transport
    • Passed: Outlook: only handles enter auth headers, fetched instructions remain fenced, next-call revocation is live
    • Passed: Outlook proxy admits pinned MIME replies with header-only credentials and refuses ungranted bodies and revoked connections
    • Passed: 1Password: mail/model approval arguments cannot authorise credential use or select a field
    • Passed: 1Password: revocation/takeover while app approval is open prevents resolution and fill
    • Passed: 1Password: ungranted destination fails before approval, vault policy checks before resolving
    • Passed: 1Password: each use needs a fresh app approval and returns no sink or SDK secret
    • Passed: 1Password: resolving is single-use, live-gated and invalid after the fill callback returns
    • Passed: trust-03/05/12 (browser): credential, code, card and challenge pages request human input, never model-readable approvals or values
    • Passed: trust-03: encrypted at rest and substituted only at the host boundary
    • Passed: trust-03 / trust-08 (Google refresh): both tokens stay encrypted and only a handle returns
    • Passed: V01-header-only: stored Calendar and Gmail data cannot contain injected secrets
    • Passed: V02-refresh-private: token exchanges are vault-only and token endpoints are not egress
    • Passed: V03-host-routes: direct sends, draft sends and deletes cannot bypass runTool
    • Passed: V04-host-bound: unsubscribe hosts never receive Google credentials
    • Passed: V08-reflections: encoded and split credential reflections are withheld
    • Passed: V11-real-chain: runTool to real Gmail connector to real proxy enforces approvals and next-call revocation
    • Passed: trust-03 (Gmail boundary): Google receives only a vault handle via the injected proxy
    • Passed: trust-03 (Gmail egress): redirects and off-provider URLs cannot carry handles
    • Passed: trust-03 (unsubscribe boundary): an ungranted mail-header host is never contacted
    • Passed: trust-03 (Calendar boundary): only a vault handle reaches the injected Google proxy
    • Passed: trust-03 (Calendar egress): off-provider calls fail before fetching
    • Passed: trust-03: importer refuses credential fields and discards connection transports
    • Passed: trust-03 boundary: OSS export rejects unreviewed files, secrets, URLs and symlinks without copying private history
    Test status: pending

  4. Every bit of work has a name on it.

    Every model call is attributed to one teammate and checked against its share before it starts. You can see what used your plan.

    System checks: passed (3/3). Boundary checks: passed (2/2).

    View the checks

    System checks

    • Passed: V12-errors: unbilled provider errors cost zero; reported usage is charged exactly
    • Passed: V12-stream: admission timeout is cleared when provider streaming starts
    • Passed: trust-04: every model call is attributed and counted before send, then ledgered, including abort

    Boundary checks

    • Passed: routines: proactive cron, restart deduplication and last-five audit/ledger estimates in share terms
    • Passed: routines: parallel workers and messages share one durable teammate execution lease
    Test status: passed

  5. Your settings are the rules.

    An action outside the autonomy you gave a teammate cannot run. The check happens when the tool is called, including in routines.

    System checks: passed (8/8). Boundary checks: passed (29/29).

    View the checks

    System checks

    • Passed: templates: name-and-job blank conversation, connected Inbox backfill and metadata event produce proactive messages
    • Passed: core-02-outbox: completed action survives receipt failure and replays exactly once
    • Passed: core-06: approved actions expire and bind to the exact live connection
    • Passed: core-09: undo uses live runTool gates and executes outside transactions
    • Passed: core-09-outbox: undo completion and evidence recover after a follow-up write failure
    • Passed: core-09-approval: an Ask undo resumes once after a human decision and denial releases its claim
    • Passed: two successful undos demote the class and evidence persists
    • Passed: routines: takeover, revocation and in-app approval gates apply to scheduled tool calls

    Boundary checks

    • Passed: core-11: high-risk auto still asks and foreign principals cannot execute
    • Passed: Outlook: method, path and grant policies deny cross-service, token endpoint and off-origin access before transport
    • Passed: Outlook proxy admits pinned MIME replies with header-only credentials and refuses ungranted bodies and revoked connections
    • Passed: 1Password: mail/model approval arguments cannot authorise credential use or select a field
    • Passed: 1Password: revocation/takeover while app approval is open prevents resolution and fill
    • Passed: 1Password: ungranted destination fails before approval, vault policy checks before resolving
    • Passed: trust-03/05/12 (browser): credential, code, card and challenge pages request human input, never model-readable approvals or values
    • Passed: V03-host-routes: direct sends, draft sends and deletes cannot bypass runTool
    • Passed: V11-real-chain: runTool to real Gmail connector to real proxy enforces approvals and next-call revocation
    • Passed: Outlook: queued send rechecks original arguments and blocks revoke/takeover without retry
    • Passed: Outlook security regression: atomic reply MIME has exactly the original sender and no editable intermediate draft
    • Passed: Outlook: generic filing cannot become deletion by targeting Deleted Items
    • Passed: Outlook calendar: gate denial prevents irreversible cancellation I/O
    • Passed: Connectors: stable model profile counts all connected tools and cannot expose hidden undo or exceed twelve
    • Passed: 1Password security regression: malformed truthy approvals and biometric results fail closed
    • Passed: trust-05/08 (browser): live admission revocation prevents the next tool and no navigation is sent
    • Passed: trust-05: off, ask, first week and high risk do not execute
    • Passed: undo-send: runtime receipt cancels the connector queue ID before delivery
    • Passed: undo-label: runtime receipt restores the previous label set
    • Passed: undo-calendar-update: runtime receipt restores previous fields and the returned ETag
    • Passed: undo-calendar-create: dedicated reversible cancellation cannot delete an unrelated event
    • Passed: V06-reply-from: automatic replies use exactly one original From, never a changed Reply-To
    • Passed: V07-unsubscribe-mail: fixed content and one recipient prevent mail-authored sends
    • Passed: V10-custom-labels: file cannot mutate any Gmail system label
    • Passed: trust-05 / trust-10 (Gmail boundary): the trusted gate sees exact arguments at call and dispatch
    • Passed: trust-05 / trust-10 (Calendar boundary): delete is irreversible and cannot bypass the gate
    • Passed: Inbox golden transcripts: ten synthetic bills and ten metadata triage cases pass with no sends or payments
    • Passed: trust-05/trust-06: imports cannot activate routines, add executable paths or change autonomy
    • Passed: new template defaults keep Bills sends/payments Off and purchases/bookings Ask
    Test status: passed

  6. An email is data. Never an instruction.

    Web pages, emails and documents are marked as untrusted content. We report the fencing checks separately from the measured red-team pass rate. No model is immune to prompt injection.

    System checks: passed (1/1). Boundary checks: passed (19/19).

    Tool-result fencing: passed.

    Red-team pass rate: not yet measured.

    No eval report was supplied.

    View the checks

    System checks

    • Passed: routines: event throttling, durable duplicate keys and fenced event payloads

    Boundary checks

    • Passed: 1Password: selected-vault metadata projection cannot expose fields, foreign vaults or website query secrets
    • Passed: Outlook: only handles enter auth headers, fetched instructions remain fenced, next-call revocation is live
    • Passed: V06-reply-from: automatic replies use exactly one original From, never a changed Reply-To
    • Passed: V07-unsubscribe-mail: fixed content and one recipient prevent mail-authored sends
    • Passed: Inbox golden transcripts: ten synthetic bills and ten metadata triage cases pass with no sends or payments
    • Passed: trust-05/trust-06: imports cannot activate routines, add executable paths or change autonomy
    • Passed: trust-06 (browser): malicious page instructions and closing delimiters remain fenced data; blocked proxy has no direct fallback
    • Passed: trust-06: every tool result is fenced and cannot escape its envelope
    • Passed: core-03: all event payloads are escaped inside the tool-result fence
    • Passed: V13-presort: classified mail never reaches search or watch model context
    • Passed: trust-06 (Gmail boundary): instruction-like mail remains untrusted data
    • Passed: trust-06 (Calendar boundary): event content is fenced as untrusted data
    • Passed: trust-06/trust-12: imported text cannot confirm itself or become policy
    • Passed: trust-06: imported memories and role text cannot close the review fence
    • Passed: trust-06 boundary: failed suite collection and builds cannot leave a successful publication status
    • Passed: trust-06 boundary: publication separates fencing, missing system evidence and measured model trials
    • Passed: avatar upload boundary rejects active content and remote bodies without network access
    • Passed: Chief accepts only addressed structured status, rejecting context, instructions and approvals
    • Passed: every new template ships injection goldens with forbidden action assertions
    Fencing: passed

  7. The right access, for the right person.

    In a team account, each person sees only what their role allows. Team accounts are planned for a later release.

    System checks: passed (4/4). Boundary checks: none registered.

    View the checks

    System checks

    • Passed: billing: a signed webhook cannot bind another account, and retries grant a plan once
    • Passed: core-04: control rejects superuser and BYPASSRLS roles
    • Passed: routines: authenticated routes, RLS and composite ownership exclude foreign routines
    • Passed: trust-07: a non-owner cannot reach account routes
    Test status: passed

  8. Disconnected means disconnected.

    Revoke a connection and the next tool call is blocked. A running teammate does not get to keep using an old login.

    System checks: passed (3/3). Boundary checks: passed (12/12).

    View the checks

    System checks

    • Passed: core-06: approved actions expire and bind to the exact live connection
    • Passed: core-09: undo uses live runTool gates and executes outside transactions
    • Passed: routines: takeover, revocation and in-app approval gates apply to scheduled tool calls

    Boundary checks

    • Passed: Outlook: only handles enter auth headers, fetched instructions remain fenced, next-call revocation is live
    • Passed: Outlook proxy admits pinned MIME replies with header-only credentials and refuses ungranted bodies and revoked connections
    • Passed: 1Password: revocation/takeover while app approval is open prevents resolution and fill
    • Passed: 1Password: resolving is single-use, live-gated and invalid after the fill callback returns
    • Passed: trust-03 / trust-08 (Google refresh): both tokens stay encrypted and only a handle returns
    • Passed: V11-real-chain: runTool to real Gmail connector to real proxy enforces approvals and next-call revocation
    • Passed: Outlook: queued send rechecks original arguments and blocks revoke/takeover without retry
    • Passed: trust-05/08 (browser): live admission revocation prevents the next tool and no navigation is sent
    • Passed: trust-08: revocation and denied hosts are checked on the next request and audited
    • Passed: V09-separate-grants: Calendar cannot reach Gmail or reuse its revoked credential
    • Passed: trust-08 (Gmail boundary): proxy revocation is consulted afresh on the next call
    • Passed: trust-08 (Calendar boundary): revoked proxy access fails on the next call
    Test status: passed

  9. A share that actually stops.

    Each teammate pauses at its share. Usage cannot go over by more than one model call. There is no silent shared pool to drain.

    System checks: passed (7/7). Boundary checks: passed (1/1).

    View the checks

    System checks

    • Passed: billing: forged, replay-window and live webhooks are rejected before a plan or gateway share can change
    • Passed: billing: referral grants both accounts one month, rejects self and duplicate rewards, and protects expiring shares
    • Passed: billing: only 1,000 founding reservations, stable Checkout retries, expiry and lifetime pricing
    • Passed: app: authenticated transport, account-scoped ledger, CSRF decisions and durable Undo through real Control routes
    • Passed: V12-errors: unbilled provider errors cost zero; reported usage is charged exactly
    • Passed: billing: a downgrade preserves every share and usage until the calendar reset, then syncs the gateway
    • Passed: trust-09: concurrent calls cannot spend the same share; in-flight estimates and settled usage both count

    Boundary checks

    • Passed: routines: proactive cron, restart deduplication and last-five audit/ledger estimates in share terms
    Test status: passed

  10. Take the wheel whenever you like.

    When you take over a computer, the teammate stops acting. You hand control back when you are ready.

    System checks: failed (6/7). Boundary checks: passed (10/10).

    View the checks

    System checks

    • Passed: core-09: undo uses live runTool gates and executes outside transactions
    • Passed: routines: takeover, revocation and in-app approval gates apply to scheduled tool calls
    • Failed: core-02: provider execution holds no transaction and control changes never wait
    • Passed: core-02-lease: hung provider times out, aborts and cannot replay an uncertain action
    • Passed: core-08: ending takeover restores paused and suspended states
    • Passed: take-over completes during an in-flight tool and prevents the next call
    • Passed: routines: uncertain runs are not replayed and paused cron backlogs keep only the latest slot

    Boundary checks

    • Passed: 1Password: revocation/takeover while app approval is open prevents resolution and fill
    • Passed: 1Password: resolving is single-use, live-gated and invalid after the fill callback returns
    • Passed: routines: parallel workers and messages share one durable teammate execution lease
    • Passed: Outlook: queued send rechecks original arguments and blocks revoke/takeover without retry
    • Passed: Outlook calendar: gate denial prevents irreversible cancellation I/O
    • Passed: trust-05 / trust-10 (Gmail boundary): the trusted gate sees exact arguments at call and dispatch
    • Passed: trust-05 / trust-10 (Calendar boundary): delete is irreversible and cannot bypass the gate
    • Passed: trust-10 (browser): all model tools refuse while human input owns the browser
    • Passed: trust-10: takeover stops a previously built context
    • Passed: core-01: step stops before models, memory and speech on takeover, pause or suspension
    Test status: failed

  11. Delete means gone.

    Deleting a teammate destroys its computer, disk, memory, credentials and service identities. It leaves no working files on shared infrastructure. Actions already completed in connected services, such as sent emails, remain there.

    System checks: pending (0/1). Boundary checks: passed (7/7).

    Still pending: complete removal of a real computer, disk, network and service identities.

    View the checks

    System checks

    • Not run: trust-03 + trust-11 + no-direct-internet: real DockerRunner, vault, live heap, Chromium proxy-only and profile deletion on Docker host

    Boundary checks

    • Passed: trust-01/11 (browser): teammate profiles cannot be borrowed and destruction removes the entire disk
    • Passed: core-05: create ignores supplied IDs including deleted IDs
    • Passed: core-10: deletion anonymises audits and preserves account decision history
    • Passed: trust-11 (runner boundary): destruction removes container, scoped proxy, volume and network
    • Passed: failed destruction remains queued for an idempotent retry
    • Passed: trust-11: delete cascades teammate records and destroys its runner
    • Passed: routines: deleting a teammate cascades run jobs, event keys and routine audit data
    Test status: pending

  12. Only you can say yes.

    Approvals happen in the signed-in app or on your phone. Never through email, or any channel the teammate can read. Opening a notification link does not approve anything.

    System checks: passed (10/10). Boundary checks: passed (12/12).

    View the checks

    System checks

    • Passed: app: authenticated transport, account-scoped ledger, CSRF decisions and durable Undo through real Control routes
    • Passed: core-06: approved actions expire and bind to the exact live connection
    • Passed: core-09-approval: an Ask undo resumes once after a human decision and denial releases its claim
    • Passed: routines: takeover, revocation and in-app approval gates apply to scheduled tool calls
    • Passed: phone push: real browser service worker opens authenticated Control, never decides until the human taps, and exposes no approval token
    • Passed: Google callback establishes a revocable signed session and rejects CSRF
    • Passed: expired approval is a readable receipt and cannot resume
    • Passed: trust-12: mail and model content cannot decide or bypass an approval
    • Passed: authenticated approval resumes its saved call once
    • Passed: integrated conversation suspends and resumes after the member decision

    Boundary checks

    • Passed: 1Password: mail/model approval arguments cannot authorise credential use or select a field
    • Passed: 1Password: each use needs a fresh app approval and returns no sink or SDK secret
    • Passed: trust-03/05/12 (browser): credential, code, card and challenge pages request human input, never model-readable approvals or values
    • Passed: Outlook security regression: atomic reply MIME has exactly the original sender and no editable intermediate draft
    • Passed: 1Password security regression: malformed truthy approvals and biometric results fail closed
    • Passed: trust-06/trust-12: imported text cannot confirm itself or become policy
    • Passed: core-10: deletion anonymises audits and preserves account decision history
    • Passed: 1Password: device biometric success cannot replace an authenticated app approval
    • Passed: core-07: approval events never reach the model
    • Passed: Chief accepts only addressed structured status, rejecting context, instructions and approvals
    • Passed: new template defaults keep Bills sends/payments Off and purchases/bookings Ask
    • Passed: every new template ships injection goldens with forbidden action assertions
    Test status: passed

Open source, with clear limits

The teammate runtime, permissions and their shared contracts are licensed under MIT. A clean source export is prepared. A public repository has not been published yet. Source availability does not replace the checks above.

Found something we should know?

Tell us at [email protected]. Please keep sensitive details out of your first email so we can agree a safe way to share them.

Meet your future team