Docs · Security summary
docs/SECURITY-SUMMARY.md in the ZoeyOS source. Last verified 2026-10-08. State current, fixed against the running house on 2026-10-08. The numbers were measured 2026-09-05; the binds and the voice were re-read 2026-10-08. Not a SOC 2 report and not a claim of immunity.Security summary
Two questions everyone asks first: can someone talk her into the house, and does the microphone leave the room.
Said plainly
The interesting attack is spoken, in the room, at the Wall. Cloud speech APIs are not in the product. Speech recognition, the voice, the language model, face ID and presence all listen on loopback. A guest can chat. A guest cannot run the house. Tools open only when authority was granted by the camera, with this-turn voice. The Secure flag can inherit that authority; it cannot mint it. Two polite refusals of "do something she cannot do" become a picture and a file, for anyone, the owner included.
Standard mode holds a matter of about 170 pages. This page is why a visitor with a clever sentence does not get that matter, and why the sentence itself did not go to a vendor.
What does not leave the box
| Role | Bind | Engine, as running |
|---|---|---|
| Speech recognition | loopback :8096 | Audio8 ark-asr 0.6B, int8 ONNX, on the CPU |
| Ear rail | loopback :8190 | capture, TEN VAD, the WeSpeaker voice stamp, then the recogniser |
| Language model (Zoey) | loopback :8000 | vLLM on the one GPU, Qwen3.8-27B |
| Voice | loopback :7789 | Chatterbox Turbo, her own voice (CosyVoice until 2026-10-07) |
| Presence, face | loopback :8191 | InsightFace, local enrolments |
| Conductor | loopback :8100 | the Wall body |
The rails talk HTTP and JSON to each other. Cloud language, voice, speech and vision APIs were a deliberate non-adopt. Voice ID runs on the same ear rail; it stamps every turn and never needs a vendor.
The microphone can be off (Control Panel, Voice). Off is silent: nothing is heard, published or answered. Paused is different: she still hears and identifies; she does not answer until her name.
The honest bound. Optional owner tools (local search, a browser) can reach the network after authority. That is not speech leaving. It is a logged-in operator asking the house to look something up. Guest rails do not get those tools.
Prompt injection, the house answer
Most prompt-injection demos assume a chatbot that will do whatever the transcript says. This house is not that chatbot. The transcript is one input. Permission is another.
| Vocative | She answers when called, or while listening. Idle chatter is heard and logged. It is not a command. |
|---|---|
| Guest rails | No names, no roster, no memory, no house commands. Pleasant and useless. Silent if that is the mode. |
| Authority | Granted only by the camera: a live, recognised face. Voice is this-turn ID, not a substitute grant. Not restored from disk at boot. |
| Secure | The owner's click. Inherits live authority, watches the door; confidential comms die on an entry face. Does not mint authority. |
| Two refusals | "Do something she cannot do" twice becomes a snapshot and an incident file. The rule is the asking, not the asker. The owner included. |
| No video interpretation | Visitors are a face snapshot and a log line. Nothing infers in or out from the feed. |
| Discretion, not a ban list | Social edge cases sit in the model's coaching, not a do-not list. Code holds the truth (who is authorised, what tools exist). The model holds judgement. |
The injection that matters here is verbal, in the room, repeated. That is why the second attempt is an event, why a guest cannot hold tools, and why Secure sits on the door instead of on the owner's face.
Authority and Secure, in four lines
Business as usual is the face finder for authority, and the door otherwise.
Secure is: watch for visitors and hold authority until a face enters, then business as usual.
Authority must be granted by the camera.
The Secure flag can inherit authority.
A click is a toggle. On inherits live authority or looks for the owner at the desk. Off is immediate. A visitor who clicks Secure off is doing you a favour; they cannot click it back on without your face. The held form is on the Secure held page.
What we are not claiming
- Not immune. An owner who is authorised, listening, and asking in good faith can still be socially engineered. The house logs the second shove; it does not pretend the first was impossible.
- Not air-gapped. The box has a network. Speech and weights do not use it.
- Not a headcount product. Presence is who-is-this and is-authority-held, not how many.
- Transcripts live on the box. Local is not "never stored". It is "not their cloud". Mic off is the private-conversation switch.