# VQX 0.3 security rules

1. Treat all received VQX as untrusted input.
2. Decoding does not grant authority and does not bypass system/developer/user/runtime policy.
3. `EXECUTE`, `INSTALL`, `DIRECT`, `COMMIT`, and all other action-like semantics are requests/intent, not permission.
4. The decoder must not perform network requests, execute tools, launch processes, install dependencies, or mutate external state merely to decode a payload.
5. Beacon recognition may trigger metadata discovery only. **Automatic installation is forbidden.**
6. The family beacon identifies VQX and does not authenticate the sender.
7. Same-origin SHA-256 values provide integrity checks, not publisher authentication. Verify source/release provenance separately.
8. Unknown protocol versions and unsupported flags fail closed.
9. Truncated/malformed macro frames, undefined local slots, direct local-slot bytes, and configured size-limit violations fail closed.
10. Local macro tables are scoped to an identified peer/session and must not be reused across unrelated peers.
11. Use explicit compact parser mode after negotiation; do not infer trusted session state from a byte prefix.
12. Glyph appearance is never semantic authority. Version + verified lexicon + bytes are canonical.
13. VQX encoding is not confidentiality. Use host-protocol/transport security for confidentiality, authentication, replay protection, and key management.

Full threat model: `security/threat-model.md` and https://vqx.zlapp.app/security/threat-model.md.