malpern · Nov 6, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026
diff --git a/Sources/KeyPathAppKit/Services/Networking/KanataTCPClient.swift b/Sources/KeyPathAppKit/Services/Networking/KanataTCPClient.swift
@@ -56,25 +56,19 @@
 /// - Simple timeout mechanism
 /// - Connection pooling for efficiency
 ///
-/// **SECURITY NOTE (ADR-013):**
-/// Kanata v1.9.0 TCP server does NOT support authentication.
-/// The tcp_server.rs code explicitly ignores Authenticate messages:
-/// ```rust
-/// ClientMessage::Authenticate { .. } => {
-///     log::debug!("TCP server ignoring authentication message (not needed for TCP)");
-///     continue;
-/// }
-/// ```
-///
-/// This means:
-/// - No client identity verification
-/// - Any local process can send commands to localhost:37001
-/// - Limited attack surface: only config reloads, not arbitrary code execution
-///
-/// **Future Work:**
-/// Consider contributing authentication support to upstream Kanata.
-/// Design would mirror the UDP authentication (token-based, session expiry).
-/// Until then, rely on localhost-only binding and OS-level process isolation.
+/// **SECURITY NOTE (ADR-013, under review in ADR-046 / #1354):**
+/// The engine's TCP server has no authentication, and loopback TCP is not
+/// scoped to a user or to the App Sandbox. From reading the source (not yet
+/// confirmed on a live install), any local process, including other
+/// users' processes and sandboxed apps with the network-client entitlement,
+/// can connect to the engine port (default 37001) and:
+/// - receive every `KeyInput` event (a keystroke stream) and the config text
+/// - press virtual keys (`ActOnFakeKey`), change layers, move the mouse
+/// - load any readable file as the config (`ReloadFile`)
+/// Virtual keys bound to `push-msg` reach `ActionDispatcher` through
+/// `KanataEventListener`. ADR-046 proposes moving this channel to an
+/// owner-checked Unix socket.
+/// TODO(#1354): revise this note after the lab-VM check and again when ADR-046 lands.
 actor KanataTCPClient {
     let host: String
     let port: Int

diff --git a/docs/adr/README.md b/docs/adr/README.md
@@ -10,7 +10,7 @@ This directory contains Architecture Decision Records (ADRs) documenting signifi
 | [ADR-006](adr-006-apple-api-priority.md) | Apple API Priority in Permission Checks | Partly superseded by ADR-044 |
 | [ADR-008](adr-008-validation-refactor.md) | Stateless Validation via SystemValidator | Accepted |
 | [ADR-009](adr-009-service-extraction-mvvm.md) | Service Extraction & MVVM Pattern | Accepted |
-| [ADR-013](adr-013-tcp-without-auth.md) | TCP Communication Without Authentication | Accepted (under review) |
+| [ADR-013](adr-013-tcp-without-auth.md) | TCP Communication Without Authentication | Under review; proposed to be superseded by ADR-046 |
 | [ADR-014](adr-014-xpc-signature-mismatch.md) | XPC Signature Mismatch Prevention | Accepted (see ADR-045 note) |
 | [ADR-015](adr-015-installer-engine.md) | InstallerEngine Façade | Accepted (see ADR-045 note) |
 | [ADR-016](adr-016-tcc-database-reading.md) | TCC Database Reading for Sequential Permission Flow | Superseded by ADR-044 |
@@ -43,6 +43,7 @@ This directory contains Architecture Decision Records (ADRs) documenting signifi
 | [ADR-043](adr-043-opportunistic-manager-consolidation.md) | Opportunistic Manager Consolidation | Accepted |
 | [ADR-044](adr-044-remove-full-disk-access.md) | Remove Full Disk Access and browser-history suggestions | Accepted |
 | [ADR-045](adr-045-retire-privileged-runtime-stack.md) | Retire the Privileged Runtime Stack | Accepted |
+| [ADR-046](adr-046-session-engine-control-channel.md) | Session Engine Control Channel | Proposed |
 
 ## Key Decisions Summary
 

diff --git a/docs/adr/adr-013-tcp-without-auth.md b/docs/adr/adr-013-tcp-without-auth.md
@@ -2,10 +2,14 @@
 
 > **Note (2026-10-31):** This was written for the root daemon. The runtime now runs
 > in a user session that holds the user's input permissions, so this risk needs
-> review. See ADR-045; tracked in
+> review. See ADR-045.
+>
+> **Note (2026-11-04):** From a source review, the port exposes a keystroke stream and input injection to
+> every local process. The review and the proposed replacement are in
+> [ADR-046](adr-046-session-engine-control-channel.md); tracked in
 > [#1354](https://github.com/malpern/KeyPath/issues/1354).
 
-**Status:** Accepted (under review, see ADR-045)
+**Status:** Under review; proposed to be superseded by [ADR-046](adr-046-session-engine-control-channel.md)
 **Date:** 2024
 
 ## Context
@@ -20,12 +24,12 @@ Use TCP without authentication for localhost IPC.
 
 - Kanata 1.9.0 TCP server does not support authentication
 - Connection is localhost-only (127.0.0.1)
-- Same security model as other local IPC (Unix sockets, etc.)
+- Same security model as other local IPC (Unix sockets, etc.) *(Wrong: loopback TCP has no peer-uid check and is reachable from other users and sandboxed apps, per a source review not yet confirmed live. See ADR-046.)*
 
 ## Security Considerations
 
 - Any local process can send commands to Kanata
-- This is acceptable for keyboard remapping (low security impact)
+- This is acceptable for keyboard remapping (low security impact) *(No longer true for the session runtime: per a source review, the port exposes a keystroke stream and input injection. See ADR-046.)*
 - If Kanata adds auth in future versions, we should adopt it
 
 ## Implementation