Skip to main content

Security and Trust

Current-runtime warning

The v3 sandbox and Java bindings have not been promoted to the guarantees on this page. Treat the target controls as requirements, not claims about current scripts.

AI-generated Lua is untrusted input. Downloaded packs are untrusted input. Server messages and world state are adversarial input. Hexis must remain safe when any one of them is malformed or intentionally hostile.

Trust boundaries

Required controls

Allowlist-only Lua environment

Scripts receive safe Lua libraries and registered Hexis capabilities. They do not receive arbitrary Java class lookup, reflection, filesystem, process, network, classloader, native loading, or unrestricted packet construction.

Capability manifests

Each script declares capabilities before execution. Examples include:

  • world observation;
  • movement and camera control;
  • attack/use input;
  • inventory transactions;
  • HUD rendering;
  • server chat;
  • approved local storage.

The UI shows the requested capabilities and their origin. Runtime checks enforce the manifest at every call; documentation is not a security boundary.

Budgets

The runtime enforces instruction, wall-time, allocation, event-rate, log-rate, action-count, and queue budgets. Limits must terminate or throttle work with a structured error without freezing the game client.

Provenance and integrity

Scripts, packs, and generated artifacts carry a content hash, author/source, contract version, requested permissions, and validation status. Release artifacts fail closed when authenticity or integrity cannot be established.

Redaction

Logs and AI repair payloads exclude license secrets, authentication material, private chat, server addresses, user identifiers, and unrelated world data by default. Telemetry is structured and minimal.

hexis.raw is not an escape from security

Raw capabilities use the same registry, permission checks, scheduler, budgets, resource leases, cancellation, and audit trail as high-level actions. Raw means lower abstraction—not unrestricted engine access.

Failure behavior

Security failures return stable codes such as CAPABILITY_DENIED, BUDGET_EXCEEDED, or UNTRUSTED_PACK. They do not silently downgrade into an unsafe path. A failed cleanup or sandbox invariant stops the affected script and releases its engine-owned resources.

Promotion gate

No generated script execution should be enabled by default until focused tests cover:

  • Java bridge escape attempts;
  • reflection and classloader access;
  • filesystem, process, network, and native access;
  • CPU and allocation exhaustion;
  • event and action flooding;
  • resource cleanup after forced termination;
  • pack tampering and capability escalation;
  • log and AI-context redaction.

High-risk raw capabilities may remain developer-only even after the general runtime ships.