{"schema":"agentspoppy.dossier/1","subject":{"id":"com.liveopspoppy.desktop","name":"LiveOpsPoppy","version":"0.3.5","packageSha256":"32bed82faf4f798985e3f155e81814aabc5d0db63a8ef506928973bea805e6f6"},"publisher":"OllyDigital","repo":"https://github.com/leonct74/liveops-poppy","securityContact":{"value":"support@agentspoppy.com","kind":"support-fallback"},"scopeStatement":"This dossier is audit-ready evidence for the customer's own SOC 2, ISO 27001 or vendor-risk process, mapped to the SOC 2 Trust Services Criteria. It is not a certification — SOC 2 reports are issued only by a licensed CPA firm — and it documents the platform's cage around this poppy, not a code audit: the open source repository and the catalogue review exist for the code itself.","sections":[{"id":"identity","title":"Identity & provenance","tsc":["CC1","CC8.1"],"items":[{"text":"The reviewed artifact is content-addressed: package sha256 32bed82faf4f798985e3f155e81814aabc5d0db63a8ef506928973bea805e6f6. The host verifies these exact bytes before installing, and every update is re-verified against the catalogue.","register":"enforced","pin":"broker package verification + catalogue sha256"},{"text":"Source code is public at https://github.com/leonct74/liveops-poppy — a listing condition, so the code this dossier describes can be audited by anyone, including the customer's own reviewers.","register":"rule"},{"text":"The package ships only the poppy's own code. The Node.js runtime is provided by the signed AgentsPoppy app from the official source — packages that embed a runtime or a service binary are refused at review and at install, because opaque bytes are exactly where a data-exfiltrating dependency would hide.","register":"enforced","pin":"RUNTIMES.md R1 — refused at pack, review and install"},{"text":"Its local backend runs confined by the host: no file access outside its own data folder, no child processes, no native code.","register":"enforced","pin":"backend.isolation strict — Node permission model"}]},{"id":"access","title":"Access to the customer's cloud","tsc":["CC6"],"items":[{"text":"8 of its 10 permission grants are confined to the poppy's own resources; 2 reach beyond them (pricing, cognito-idp). The approval preview lists each one, and the app shows the same lines before consent.","register":"enforced","pin":"assessor — computed from the reviewed manifest"},{"text":"It never holds your AWS keys. It gets a temporary session, minted for the job, that expires within 1 hour.","register":"enforced","pin":"broker aws/sts.ts — session duration is capped, not requested","holds":true},{"text":"That session can only ever be narrower than the role you installed. Nothing the broker issues can widen it.","register":"enforced","pin":"invariant I1 — IAM session-policy intersection","holds":true},{"text":"It can never manage the people in your account — no IAM users, no passwords or access keys, no MFA changes, and no account or organisation settings.","register":"enforced","pin":"broker role guardrails — an explicit Deny on the role itself","holds":true},{"text":"It can never hand itself administrator access by attaching AWS's admin policies to something it made.","register":"enforced","pin":"broker role guardrails — AdministratorAccess, IAMFullAccess, PowerUserAccess denied","holds":true},{"text":"Anything it creates is born carrying its own tag, or AWS refuses to create it.","register":"enforced","pin":"invariant I3 — an aws:RequestTag condition on every create","holds":true}]},{"id":"approval","title":"Change approval","tsc":["CC5","CC6.1"],"items":[{"text":"On by default: Every change waits for your approval, and an approval you do not answer expires after 15 minutes. Reads are not gated. The customer can switch supervision off per connection — keeping it on is listed under customer responsibilities below.","register":"enforced","pin":"broker service.ts — on by default for access outside the poppy's own resources","holds":true}]},{"id":"network","title":"Where data can exit","tsc":["CC6.6","CC7"],"items":[{"text":"Declares its cloud code connects only to AWS.","register":"declared"},{"text":"Cloud-code egress is a declaration: AWS provides no way for a platform to police where deployed code connects, and this dossier does not pretend otherwise. The declaration is what the catalogue review and the observed record are read against.","register":"rule"},{"text":"Your websites, which it creates for you, serve the public internet. That is their purpose — what they send is what you put on them. Catalogue rules forbid a poppy from routing your cloud data or your activity out through infrastructure it creates.","register":"rule"}]},{"id":"change","title":"Change management","tsc":["CC8"],"items":[{"text":"Any change to its permissions in an update re-triggers user consent — the host asks again before the new scope applies, and the approval screen shows exactly what changed.","register":"enforced","pin":"host re-consent on permissionSet change"},{"text":"Every new version passes mechanical review before it can enter or update the catalogue (manifest validated, package hashed, backend confinement and network declaration required); a version that changes grants is escalated for tiered review.","register":"rule"}]},{"id":"monitoring","title":"Monitoring & the record","tsc":["CC7"],"items":[{"text":"It can never switch off CloudTrail — the record of what it did in your account.","register":"enforced","pin":"broker role guardrails — StopLogging, DeleteTrail and friends denied","holds":true},{"text":"Every change to this connection is written to a trail you can read.","register":"enforced","pin":"broker service.ts — getAudit","holds":true}]},{"id":"exit","title":"Removal & offboarding","tsc":["CC6.5"],"items":[{"text":"What it made stays findable even if this connection is replaced, so removing it later still finds everything.","register":"enforced","pin":"invariant I5 — ownership pinned to the app, not the connection","holds":true},{"text":"You can revoke this machine's operator key at any moment and cut every poppy off at once.","register":"enforced","pin":"broker service.ts — revokeOperatorKey","holds":true},{"text":"Removing it deletes the stacks it created, and sweeps for anything labelled as its own. Labelling those extras is this poppy’s own doing rather than something AWS enforces.","register":"declared","holds":false},{"text":"One click removes the poppy's cloud footprint: the stacks it created are deleted and a label sweep finds anything created outside them. The leaves-no-trace certification harness exercises exactly this lifecycle at review.","register":"rule"}]},{"id":"governance","title":"Platform governance & vendor accountability","tsc":["CC1","CC9"],"items":[{"text":"An undeclared data flow found after listing means immediate delisting; a deceptive declaration — data covertly read, copied or transmitted — means permanent removal, the developer account closed, and the poppy blocklisted so existing installs are warned.","register":"rule"},{"text":"Where user data reaches a service the developer operates, the developer must declare the flow and maintain a privacy policy covering it, and AgentsPoppy may require audit access to the receiving service's source code as a condition of listing.","register":"rule"}]},{"id":"developer","title":"Developer declarations","tsc":["CC9"],"items":[{"text":"This version was packaged before the compliance declaration existed (September 2026). The catalogue requires the declaration — what data it handles, its subprocessors, a security contact — at the poppy's next update.","register":"rule"}]},{"id":"customer","title":"Customer responsibilities (complementary controls)","tsc":["CC6","CC7"],"items":[{"text":"Keep supervision on for connections to production accounts, and answer approval requests deliberately.","register":"customer"},{"text":"Review the connection's record and approval history periodically — the record is the customer's evidence of operating effectiveness.","register":"customer"},{"text":"Treat a permission-change re-consent screen as a change-control decision, not a click-through.","register":"customer"},{"text":"Keep CloudTrail enabled account-wide. The platform prevents poppies from switching it off, but enabling it is the account owner's control.","register":"customer"},{"text":"Restrict who in the organisation can install poppies and hold the operator key; revoke the key when a machine leaves service.","register":"customer"}]}]}