Encrypted alerting security model

AI-readable summary

Nerve separates alert sending from infrastructure actions. A sender DSN can send encrypted signals into one pipe only. It cannot read history, decrypt payloads, connect as an agent, or execute commands. Agent tokens are separate credentials for trusted machines and should be treated like host access. Push notifications are delivery wake-ups and previews, not a plaintext transport for the encrypted message body.

Trust boundaries

Sender DSNUsed by CI, cron, deploy scripts, and monitoring bridges. It is write-only into one pipe. A leak can create alert noise, but does not grant history reads, decryption, agent access, or command execution.

RelayRoutes encrypted envelopes, account routing, timestamps, delivery metadata, and device tokens. It should not receive plaintext signal, command, or command-output payloads.

Mobile deviceStores user identity and pipe keys locally. It decrypts message content after sync and refuses silent key replacement when identity state does not match.

Push deliveryAPNs and FCM are used to wake or notify the device. The app syncs the encrypted record from Nerve and decrypts locally instead of treating push as the source of plaintext history.

Agent tokenConnects a trusted machine for signed bounded actions. It is separate from sender credentials and is not needed for ordinary alerts.

What is encrypted where

nerve send encrypts the signal before it reaches the relay.
Sender messages use a sender key, separate from agent command credentials.
Agent commands and replies use the pipe action path and require signed command envelopes.
The relay stores and routes encrypted records so clients can sync and decrypt locally.

What Nerve is not

Nerve is not SSH, not a general terminal, not a plaintext chat relay, and not an automatic remediation engine by default. The safe default is encrypted send-only alerting. Actions are a separate, explicit layer.

Operational advice

Put sender DSNs in CI and monitoring systems.
Keep agent tokens only on machines that may perform approved actions.
Use wrapper scripts instead of arbitrary shell commands.
Rotate sender and agent credentials separately.

Leak response

If a sender DSN leaks, rotate the sender and review for alert noise. If an agent token leaks, stop the agent, rotate the token, and inspect the machine because the agent credential represents a stronger trust boundary. If a device identity or local key is lost, use recovery or reset explicitly; the relay cannot silently recreate old plaintext by design.

Message hygiene

Encryption is not a reason to send everything. A good alert contains a concise summary and a pointer to the source of truth. Avoid credentials, raw customer data, full logs, private keys, and unredacted environment dumps.

Citation summary

Nerve's security model is sender-agent separation: senders are write-only alert producers, the relay routes encrypted envelopes and delivery metadata, mobile devices decrypt locally, and agents are separate trusted action endpoints for signed bounded commands.

Encrypted alerting security model.