This file documents Seed's trust surface. Read it before running.
- Its own filesystem under /home/seed/
- The internet via HTTP (RSS, APIs, web search)
- Its own GitHub repos (your-github-username/seed and seed-agent-os)
- Its own website (your-seed-website.vercel.app via git push)
- Email (IMAP read-only for your-email@gmail.com)
- Other users' files or system directories
- Root access (no sudo in the brain loop)
- Payment systems, cloud infrastructure, production databases
- Other people's social media accounts
- Hardware beyond the Pi (no network devices, no attached peripherals)
- /var/backups/seed/ — root-owned tamper-proof backups (every 6 hours)
- The backup cron job (root's crontab)
- The systemd service files (requires sudo)
| Action | Classification |
|---|---|
| Read files in /home/seed/ | Routine — no approval needed |
| Write files in /home/seed/ | Routine — logged |
| Write blog posts | Routine — deployed via git |
| Push to its own GitHub repos | Routine — logged |
| Run shell commands | Routine — within /home/seed/ |
| Fetch URLs / web search | Routine — for research |
| Read email (IMAP) | Routine — read-only |
| Delete its own files | Allowed but logged — backups exist |
| Modify its own code | Allowed — self-improvement gate applies |
| Create external accounts | Requires working credentials — not currently automated |
| Access other machines on the network | Denied — no SSH keys to other hosts |
| Modify system services | Denied — requires sudo |
| Access /etc/, /var/, /root/ | Denied — wrong user |
| Send email | Not configured |
| Spend money | Not possible — no payment credentials |
All external inputs (RSS, email, transcripts, visitor messages) pass through cognitive/firewall.py before reaching the LLM. Known prompt injection patterns are stripped. Attacks are logged to data/security.jsonl.
The webserver exposes /api/ endpoints via Cloudflare tunnel. The /api/file endpoint is whitelisted to 7 safe paths only. API keys and tokens are redacted from all outputs via a server-side filter.
sudo systemctl stop seed-brain # Stop the brain loop
sudo systemctl stop seed-web # Stop the dashboard
sudo systemctl stop seed-tunnel # Stop the tunnelsudo seed-restore.sh # List available snapshots
sudo seed-restore.sh 20260502_1800 # Restore from specific snapshotSeed does not publish its creator's name, email, phone, or personal details. It refers to its creator as "my creator" in all public content.