Security · Architecture revision 3 August 2026 · Protocol version 1

Verification at every release boundary.

Toolvyn separates the public desktop application from private deployment infrastructure and verifies update artifacts before execution.

Public package boundary

The downloadable desktop installer contains the app, its public update client, required runtimes and notices. Build checks stop packaging if Agent, Control Plane, enrollment, SSH, administrator-token or server-operation material appears in the public output.

Update verification

• The manifest is signed with a pinned ECDSA P-256 release key.
• Product, channel, version, publication time, size and HTTPS origin are validated.
• The installer is streamed to a temporary file and checked against the manifest SHA-256.
• Windows Authenticode trust, publisher and optional certificate thumbprints are checked before launch.

Transport and limits

Production update URLs require HTTPS. Redirects are bounded and revalidated. Manifest and package size limits are enforced before and during download, and incomplete files are discarded.

Local processing

Toolvyn uses least-privilege per-user installation for the public edition. Operations run only when selected, and histories remain in local application data.

Reporting

A dedicated security mailbox and coordinated-disclosure window will be published before the stable release. Include the Toolvyn version, Windows version, affected workflow and reproducible steps in reports.