Summary

• Run Fishnet as a dedicated _fishnet system user (macOS) / fishnet user (Linux) via LaunchDaemon/systemd system service instead of user-level LaunchAgent/systemd user service
• Drop kSecAccessControlUserPresence from Secure Enclave key — OS user separation now protects the key, enabling fully autonomous signing without Touch ID prompts
• Two-phase fishnet init with --system-only flag for clean system user setup before vault initialization
• LaunchDaemon-aware fishnet stop using launchctl instead of PID-based SIGTERM

Why

A rogue AI agent running as the same OS user can read Fishnet's process memory via task_for_pid()/ptrace and extract signing keys. No userspace defense (mlock, zeroize, Secure Enclave UserPresence) prevents this. OS-level user separation is the only reliable isolation boundary.

Threat model

root          — human only, never an agent
_fishnet      — runs Fishnet daemon, owns keys + vault
agent_user    — AI agent, firewalled to localhost only

Setup flow

# 1. Create system user
sudo fishnet init --apply-system --system-only

# 2. Init vault as _fishnet
sudo -u _fishnet fishnet init \
  --master-password <pw> \
  --store-derived-key-in-keychain \
  --first-service openai --first-key sk-...

# 3. Install daemon
sudo fishnet service install --apply

Test plan

• cargo check — compiles clean
• cargo test — 245 tests pass, 0 failures
• Manual: verify fishnet service install dry-run prints correct LaunchDaemon plist with UserName=_fishnet
• Manual: verify fishnet init --system-only --apply-system creates _fishnet user and data dir
• Manual: verify fishnet stop detects daemon plist and uses sudo launchctl unload
• Manual: verify Secure Enclave key creation without UserPresence on macOS

🤖 Generated with Claude Code