# Safety Review — Nexus Laptop POC Package

**Reviewer:** Agent (automated POC review)  
**Date:** 2026-06-04  
**Scope:** Safe overlay installer only — no platform lockdown

## Threat model (POC 1)

| Risk | Mitigation | Status |
|------|------------|--------|
| Accidental Winlogon replacement | Not implemented; documented as POC 3 | OK |
| Registry/GPO on dev/laptop | No scripts touch registry | OK |
| Lockdown without safe flag | `SafePocRuntime` disables lockdown unless `--safe-poc` or `--overlay` | OK |
| Secrets in download artifact | Package contains only POC seed creds in Identity DB (documented test users) | OK |
| Coolify token exposure | Token read from local file only; never printed or stored in evidence | OK |
| Permanent laptop changes | UNINSTALL removes AppData; no shell changes | OK |
| False sense of security | README + install guide state Windows is NOT locked | OK |

## Shell safety guard

```
Without --safe-poc or --overlay:
  → Lockdown disabled
  → Developer Console disabled
  → Message shown to user
```

## Windows escape (Developer Console)

All escape actions remain **disabled in POC** with audit logging only.

## Install scripts review

| Script | Admin required | Registry | Shell |
|--------|----------------|----------|-------|
| START-NEXUS-SAFE-MODE.ps1 | No | No | No |
| STOP-NEXUS.ps1 | No | No | No |
| UNINSTALL-NEXUS-POC.ps1 | No | No | No |

## Hosting

- Static nginx container on Coolify (`nexus-downloads`)
- Public HTTPS at `nexus.ninjakernen.info/downloads/`
- Artifacts uploaded via ephemeral catbox URL → container wget (no secrets in URLs beyond public file host)

## Verdict

**APPROVED for Jacob test laptop** as safe overlay POC.  
Not approved for production lockdown or unattended mass deployment.
