Security

The model

Self-hosted. Your data and keys live on machines you control. There is no Mandala operator who could read, lock or take over your account.
Signed everything. Every record change is signed by the key of whoever made it (a person, an agent, a device) and checked by the contract that governs it. A mistake or a forgery is refused, not recorded.
Rules in the engine, not in prompts. Your accomplice cannot do what its delegation, its autonomy settings and the contracts do not allow, however it is asked.
Approval for effects. Messages, payments and other outward actions wait for you, and are recorded with the exact action approved.
Your passkey is your root. Devices are certified by it; a stolen server cannot add a device to your identity. Sensitive acts ask for a fresh Face ID.

A home set up before accounts has no sign-in until you add a passkey and turn on Require sign-in (Users and permissions). Homes created with the first-run assistant require Face ID.
Whoever controls the machine can read its data, including a VPS provider. Keep the most private things on hardware you hold.
Model providers see what your accomplice reads to answer. Choose providers accordingly, or a local model.
WhatsApp's unofficial protocol can get a number banned.

☐ Mandala listens on 127.0.0.1; published only with tailscale serve; no funnel, no port forwarding.
☐ Tailscale ACLs allow only your own devices to reach the machine.
☐ The host firewall denies incoming traffic except on tailscale0; SSH by key only.
☐ Mandala runs as a dedicated, unprivileged user, with NoNewPrivileges=yes and PrivateTmp=yes.
☐ The data directory is mode 700, mandala.env and master.key mode 600.
☐ Automatic security updates for the OS.
☐ Encrypted backups, off the machine, tested by a restore.
☐ Sign-in required, and at least two ways back (Keys and recovery).
☐ Sign out sessions you don't recognise (Settings → Security).
☐ Forget lost devices at once (Settings → Devices and sync).
☐ Review Without asking and connected extensions now and then.
☐ Your Mac release key (~/.mandala-release/update.key) backed up offline and never on a server.

If you find a security issue, report it privately to the maintainers rather than in a public issue.