GLASSCASTLE SECURITY // OPERATIONS TOWER // SEC-TP

SECRET TUNNEL / SEC-TP

Owner-controlled secure connectivity built around pinned identity, explicit capability grants, bounded sessions, observable consequences, and auditable receipts.

SURFACEPUBLIC DOCUMENTATION

AUTHORITYDEFAULT DENY

TRUST ROOTIDENTITY + GRANTS

PRIVATE OPERATOR BUILDNOT DISTRIBUTED HERE

Documentation surface. This tower describes the public Sec-TP trust and protocol model. It intentionally does not distribute the private operator build, runtime state, credentials, device identities, or internal capability modules.

01 // TRUST MODEL

REACHABILITY IS NOT AUTHORITY.

IDENTITY

PAIRING

Pairing binds a client identity to a pinned gateway. It establishes who is present, not what that identity may do.

AUTHORITY

CAPABILITY GRANTS

Application operations are evaluated against explicit grants and current policy. A connection never silently expands into universal authority.

REACHABILITY

AUTHORIZED UNDERLAY

LAN, VPN, Tailscale, DNS, TCP, and QUIC may provide paths. None of them replace the Sec-TP trust boundary.

02 // OPERATOR FABRIC

ONE OPERATION. VISIBLE BOUNDARIES.

01OWNER CLIENTpaired identity

02PINNED GATEWAYpeer verification

03SEC-TP SESSIONbounded channel

04CAPABILITY GATEpolicy decision

05BOUNDED OPERATIONexplicit scope

06RECEIPTobserve + verify

Conceptual flow. This diagram explains the trust grammar. It is not live topology, current node state, or an invocation interface.

03 // PROTOCOL STACK

TRUST ABOVE TRANSPORT.

APPLICATIONRPC / CAPABILITY

CHANNELBOUNDED EXCHANGE

SESSIONMONOTONIC SEQUENCE + LIFETIME

LOGICAL FRAMINGHHT

PHYSICAL FRAMINGSEC-TP

PROTECTIONTLS 1.3

TRANSPORT / NETWORKTCP · QUIC · IPv4 · IPv6 · AUTHORIZED UNDERLAY

04 // SECURITY PROPERTIES

EXPLICIT, BOUNDED, AUDITABLE.

Transport protectionTLS 1.3 with ALPN sectp/1.
Peer verificationExact gateway certificate fingerprint pinning.
Client identityEd25519 client authentication with default-deny authorization.
Session boundsFinite lifetime, idle timeout, rate controls, and audit records.
Logical framing boundaryHHT never supplies keys, nonces, authentication, freshness, or authorization.
Path selection boundaryAddress racing and path telemetry may improve reachability timing, never trust.

05 // OPERATOR INTERACTION

AUTHORITY STAYS VISIBLE.

SELECT→FOCUS→INSPECT→QUERY→PLAN→CONFIRM→EXECUTE→OBSERVE→VERIFY→RECORD

The public tower documents the interaction doctrine. It does not expose a generic remote shell, an operator command surface, or ambient authority.

06 // PUBLICATION BOUNDARY

THE PROTOCOL CAN BE DESCRIBED WITHOUT PUBLISHING THE KEYS TO THE CASTLE.

PUBLIC

ARCHITECTURE + POLICIES

This site publishes the trust model, protocol stack, security boundaries, and policy links needed to understand Sec-TP.

PRIVATE

OPERATOR IMPLEMENTATION

Private integrations, credentials, runtime state, device identities, and internal capability modules remain outside this publication surface.

07 // POLICY

PUBLIC GOVERNANCE.

PRIVACY TERMS SUPPORT SYSTEM INSPECTOR