Security and Trust
The v3 sandbox and Java bindings have not been promoted to the guarantees on this page. Treat the target controls as requirements, not claims about current scripts.
AI-generated Lua is untrusted input. Downloaded packs are untrusted input. Server messages and world state are adversarial input. Hexis must remain safe when any one of them is malformed or intentionally hostile.
Trust boundaries
Required controls
Allowlist-only Lua environment
Scripts receive safe Lua libraries and registered Hexis capabilities. They do not receive arbitrary Java class lookup, reflection, filesystem, process, network, classloader, native loading, or unrestricted packet construction.
Capability manifests
Each script declares capabilities before execution. Examples include:
- world observation;
- movement and camera control;
- attack/use input;
- inventory transactions;
- HUD rendering;
- server chat;
- approved local storage.
The UI shows the requested capabilities and their origin. Runtime checks enforce the manifest at every call; documentation is not a security boundary.
Budgets
The runtime enforces instruction, wall-time, allocation, event-rate, log-rate, action-count, and queue budgets. Limits must terminate or throttle work with a structured error without freezing the game client.
Provenance and integrity
Scripts, packs, and generated artifacts carry a content hash, author/source, contract version, requested permissions, and validation status. Release artifacts fail closed when authenticity or integrity cannot be established.
Redaction
Logs and AI repair payloads exclude license secrets, authentication material, private chat, server addresses, user identifiers, and unrelated world data by default. Telemetry is structured and minimal.
hexis.raw is not an escape from security
Raw capabilities use the same registry, permission checks, scheduler, budgets, resource leases, cancellation, and audit trail as high-level actions. Raw means lower abstraction—not unrestricted engine access.
Failure behavior
Security failures return stable codes such as CAPABILITY_DENIED,
BUDGET_EXCEEDED, or UNTRUSTED_PACK. They do not silently downgrade into an
unsafe path. A failed cleanup or sandbox invariant stops the affected script and
releases its engine-owned resources.
Promotion gate
No generated script execution should be enabled by default until focused tests cover:
- Java bridge escape attempts;
- reflection and classloader access;
- filesystem, process, network, and native access;
- CPU and allocation exhaustion;
- event and action flooding;
- resource cleanup after forced termination;
- pack tampering and capability escalation;
- log and AI-context redaction.
High-risk raw capabilities may remain developer-only even after the general runtime ships.