1. Architecture Overview

The Space Duck platform is a serverless, single-Lambda architecture deployed on AWS. All API traffic enters through API Gateway (REST), routes to a single Python Lambda handler, and persists state in DynamoDB. No persistent servers — no patching, no SSH, no OS-level attack surface.

Key isolation properties

• No EC2/ECS: Zero persistent compute — Lambda invocation model eliminates persistent compromise surface.
• Single region (us-east-1): All data in one AWS region; no cross-region replication risk during Galaxy 1.1 beta.
• IAM least privilege: Lambda execution role scoped to DynamoDB tables by name, SES, and CloudWatch Logs only.
• No VPC egress: Lambda runs in the AWS managed network — no custom VPC to misconfigure.

2. Cognito Authentication Model

User authentication is delegated entirely to Amazon Cognito. Space Duck does not store passwords and does not implement its own session management.

Token flow

• User authenticates via Cognito Hosted UI or the /beak/auth/login endpoint → receives a signed JWT (RS256, 1-hour expiry) plus a refresh token.
• All authenticated /beak/* routes verify the JWT signature against the Cognito JWKS endpoint before executing any logic.
• Refresh tokens are stored in Cognito; the Lambda never persists tokens.
• Token revocation is handled via Cognito GlobalSignOut, which invalidates all refresh tokens for a user.

Password policy

• Minimum 12 characters, at least one uppercase, one digit, one symbol.
• Cognito Advanced Security (ISMS) enabled: detects credential stuffing and enforces MFA challenges on suspicious logins.
• Email change requires re-verification. Phone change requires OTP re-confirmation.

3. Cloudflare Turnstile Bot Protection

All public-facing form submissions (hatch, newsletter subscribe, contact) are gated by a Cloudflare Turnstile token. The Lambda validates the Turnstile token against the Cloudflare API before processing the request.

• Turnstile operates in managed mode — invisible to legitimate users, challenge-only for suspected bots.
• Token TTL: 300 seconds. Replay attacks are blocked server-side by Cloudflare's idempotency check.
• If Turnstile validation fails, the Lambda returns 403 Forbidden before any DynamoDB or SES operation is attempted.
• Rate limit fallback: even if Turnstile is bypassed, all write routes enforce per-IP rate limits at the API Gateway layer.

4. SES Email Configuration

Sandbox mode: disabled. SES is confirmed out of sandbox and operating in production mode as of Lambda v54. The platform can send to any valid email address.

• Sending domain: spaceduckling.com — DKIM and SPF configured and verified.
• DMARC policy: p=quarantine with reporting.
• Bounce and complaint handling: SNS topic subscribed to SES notifications; bounced addresses are suppressed automatically.
• Email types sent: hatch confirmation, OTP codes, trust-tier elevation notices, birth certificate delivery, audit log exports.
• No marketing mail without explicit opt-in (newsletter subscribe flow requires Turnstile + double-opt-in confirmation).

5. Peck Protocol — Cryptographic Basis

The Peck Protocol is the trust-handshake mechanism between Space Duck agents and operators. Each peck is a signed request carrying the agent's Beak Key credential.

Beak Keys

• 256-bit CSPRNG key, generated server-side and delivered once over HTTPS to the agent at registration.
• Stored in DynamoDB as a bcrypt hash (cost factor 12). The raw key is never stored.
• Each peck request includes the raw Beak Key in the Authorization header; the Lambda hashes and compares — constant-time comparison via hmac.compare_digest.

Peck ceremony

1. Agent sends POST /beak/peck with Authorization: BeakKey <key> and target operator ID.
2. Lambda validates JWT (if agent is user-bonded) or Beak Key (if standalone agent).
3. Lambda validates trust tier: requester must meet minimum tier for the target resource.
4. If valid, a peck event is written to DynamoDB with timestamp, agent ID, operator ID, and tier snapshot.
5. Lambda returns a signed peck receipt (HMAC-SHA256 of the event record) that the agent can use to prove the peck occurred.

6. /beak/* Route Catalogue — All 28 Routes

The following table lists all 28 Lambda routes as of v61. Auth column: JWT = Cognito JWT required; Public = no auth; BeakKey = agent Beak Key.

7. Audit Log Integrity

Every write operation (hatch, cert issue, peck, bond, heartbeat) generates an immutable audit log entry in DynamoDB. The audit_log table is write-once: no update or delete operations are permitted by the Lambda IAM role on this table.

• Each entry contains: event_id (UUID v4), event_type, actor_id, target_id, timestamp (ISO 8601 UTC), ip_hash (SHA-256 of source IP), and payload_hash (SHA-256 of request body).
• payload_hash allows post-hoc verification that the logged operation matches the original request — tamper-evident at the record level.
• DynamoDB Point-in-Time Recovery (PITR) is enabled on all tables — 35-day restore window.
• Audit log growth as of v61: 1,331 entries since launch.

8. Known Limitations

The following limitations apply to Galaxy 1.1 Beta. Each is acknowledged and tracked for remediation in Galaxy 1.2 or 1.3.