# Security and trust

Choose trust deliberately:

- `native` is self-contained ESM running in the application realm. It is
  full-trust code. Manifest permissions are review metadata, not an in-process
  security sandbox.
- `sandboxed-page` runs in an opaque-origin iframe behind capability RPC and a
  deny-by-default CSP. It cannot use supported direct network, parent storage,
  application modules, or native bridges. Arbitrary page code can still attempt
  to navigate its own browsing context before the host terminates it, so it is
  not described as perfectly non-exfiltrating.
- `live-sandboxed` runs as bounded guest JavaScript without DOM, location,
  direct network, storage, imports, dynamic code loading, or native bridges.
  UI is a validated declarative tree rendered by the host.

Secrets are entered through host-rendered settings and are presence-only to
plugins. Approved network calls resolve credentials inside the host. Diagnostic
output must not include credentials, note content, paths, queries, request
bodies, or provider responses.

Executable plugin content is personal-vault behavior and remains inert in
shared or unavailable workspaces. Synchronizing live source does not grant
device-local execution or origin approval.

V1 has no remote catalog or system-plugin exception. A matching package ID,
digest, received byte sequence, or valid publisher signature does not grant
shared-workspace execution. Only a future application release could compose a
reviewed app-installed registry and managed-workspace runtime; the public
Plugin API cannot do so.

Markdown plugin fences are generic IDs and `.blocks.json` contains only
versioned configuration. Neither can install, select, or approve executable
bytes. The host resolves only an already-active namespaced contribution in a
personal workspace. Missing, private, malformed, shared, and unavailable
blocks render escaped source/config. Sandboxed pages cannot contribute
Markdown blocks in API v1, so the host never creates an iframe per block.

Trusted CodeMirror contributions require the native-only
`ui.editor.extension` permission. Their factory receives a frozen host module
cohort and bounded context, not Yjs, live-doc/persistence handles, policy
compartments, or an editor singleton. The required digest-bound build proof
prevents duplicate CodeMirror/Yjs dependency cohorts, but native code remains
full trust.

Native note actions receive immutable metadata-only snapshots and require a
fresh host-verified user gesture. File viewers receive only centrally admitted,
copied content within their exact declared extension, MIME, and byte bounds.
Built-in viewers stay the default unless the user explicitly chooses a plugin
viewer or configures an exact-type default. Isolated viewer frames may publish
bounded pane state and titles, but that role does not grant workspace
navigation.

External installation, runtime trust, permission/origin approval, and
activation are independent. Changed package bytes require fresh device-local
approval. Uninstall and plugin-data deletion remain separate app-owned
confirmations; see
[development-lifecycle.md](development-lifecycle.md).
