Threat model and deployment guidance for lerobot-device-connect. This document covers this package and how it sits in the Device Connect + LeRobot stack. Broker ACLs, portal credential issuance, MCP client policy, and LeRobot core safety live in upstream components unless noted here.

This driver is not a safety-certified robot controller. It forwards observation and motor commands to LeRobot robot implementations (LeKiwi first) and mirrors state for agents over Device Connect.

Do not open a public issue for exploitable security bugs.

1. Prefer GitHub private vulnerability reporting once a remote is configured.
2. For issues in dependencies, also report to the upstream project when appropriate:
   • device-connect / device-connect-edge
   • lerobot
   • Hugging Face security for LeRobot-specific concerns

Include: description, reproduction steps, affected version/commit, impact, and suggested mitigation if you have one.

  [Human supervisor]          [LLM agent host]
         |                              |
         | supervises                   | MCP / IDE (device-connect-agent-tools)
         v                              v
                    Device Connect broker (NATS / Zenoh)
                    portal.deviceconnect.dev  OR  local lab broker
                              |
                              | invoke_device / RPC
                              v
                 lerobot-device-connect (this package)
                              |
            +-----------------+------------------+
            |                                    |
     local: Feetech /dev/tty*              client: ZMQ tcp://robot:5555/5556
     + USB cameras                         (requires lekiwi_host on robot)
            |                                    |
            v                                    v
              LeKiwi hardware (arm + omni base)

Optional teleop path (client mode typical):

  [Leader arm USB]     [Keyboard on teleop PC]
         |                      |
         v                      v
    SO100Leader            KeyboardTeleop
         \                    /
          `--> TeleopComposer.compose_action() --> send_action --> ZMQ --> robot

1. Compromised or mis-prompted agent — repeated send_action, teleop_step, or camera RPCs (motion spam, exfiltration).
2. Mesh participant with valid NATS credentials — same RPC surface as MCP without IDE supervision.
3. LAN attacker on robot Wi‑Fi — connects to ZMQ ports, scans for open broker, reaches Pi services.
4. LAN attacker on teleop LAN — targets operator laptop running client mode + teleop.
5. Credential thief — reads portal .json / .creds from disk, backups, or shared Downloads folder.
6. Malicious teleop operator — legitimate USB/keyboard access; social/physical access model.

Unlike reachy-mini-driver, this package does not implement numeric clamps on send_action keys. LeRobot / LeKiwi apply max_relative_target and host watchdog behavior upstream.

Rely on these outside this repository:

• Driver holds Feetech bus and camera devices (/dev/ttyACM0, /dev/video*).
• No ZMQ exposure from this package, but robot may still run lekiwi_host separately.
• Run driver as a dedicated user; restrict access to serial and video nodes.

• Requires lekiwi_host on robot binding ZMQ on all interfaces by default (tcp://*:5555).
• Treat robot IP network as trusted or tunnel ZMQ over VPN/SSH.
• Leader arm and keyboard are local to the driver process; teleop_step from the mesh triggers local input sampling — understand who can call that RPC.

• Safe for hardware, but use a distinct device_id (e.g. lekiwi-sim) on shared brokers.

1. Agent-first RPC surface — Full send_action dict for flexibility; no driver-side workspace fences. Narrow broker ACLs and MCP tool lists in production.
2. Unauthenticated ZMQ (LeKiwi stack) — Matches upstream lekiwi_host design for low-latency teleop. Security is network-position dependent.
3. Optional teleop over mesh — teleop_step lets remote agents drive cycles that read local USB/keyboard; useful for demos, risky without physical supervision.
4. DEVICE_CONNECT_ALLOW_INSECURE — Documented for local smoke tests. Disable for portal or any shared broker.
5. Portal credential auto-discovery — Same pattern as reachy-mini-driver lab workflows; prefer explicit --portal-credentials on shared machines.

• Authentication or TLS for LeKiwi ZMQ
• Driver-side clamping or validation of send_action beyond LeRobot
• Motion leases / command ownership (not implemented)
• Encrypted storage for portal credentials
• Safety-rated emergency stop wiring through Device Connect
• Automated credential rotation

Keep dependencies pinned in production images and monitor advisories for this package and LeRobot.

• tests/smoke_sim_runtime.py — validates RPC/event schema registration (no fuzzing).
• tests/test_observation_codec.py — ensures camera arrays are stripped from scalar path.

Run before release:

python tests/smoke_sim_runtime.py
pytest tests/

For upstream mesh hardening, see device-connect and device-connect-agent-tools. For robot operation, follow Hugging Face LeRobot and LeKiwi hardware documentation for your specific build.