The latest commit in undergroundrap/hatchling added a new security document. The November 7, 2026 commit 7d90ea4 created docs/your-security.md, adding 489 lines across 20 files and deleting 30 lines. The core point revealed by the commit title is 'who is protecting you, and what can they not do'. The source is that commit page (https://github.com/undergroundrap/hatchling/commit/7d90ea41296d884c8a050e615a11ca2ee0cd34e6).
This document takes a setup in which an agent owned directly by a person keeps running on their own computer, and lays out in plain language what the user, Keeper, Broker, kernel-isolated cell, and wall are each responsible for, and what they still cannot solve even when working together. The same sentences go straight into the app's Settings 'Your security' screen, and that screen shows from the start how the vault in this installation environment is actually opened. Code changes are mixed in alongside the document. For vault protection, old key files used to be merely deleted, but now they are overwritten and then synchronized, and plain-text key files are removed so that no state is left in which they cannot be opened when the keyring stage is a hardware key. On the browser side, the names a page attaches to elements are passed along only from a fixed word list. Vault save failures are recorded, and the 'Keep me signed in' dialog makes clear what the agent does.
That said, most of this commit is documentation and screen tidying. The entry added to the CHANGELOG is in the Unreleased section, so it is not a list of released versions, and the commit information contains no version number or performance measurement. The browser's value masking also only engages when the value is identical, so it cannot catch pages that change the value first — that limitation is written out as-is in the CHANGELOG. The README still divides the detailed documentation into a separate path, so there is no statement that the new document replaces the threat model. What can be confirmed here is only how this document declares the roles and the limitations; whether those boundaries are actually upheld is a separate area that requires verification.