Security model

This release supports one trusted operator and trusted worker infrastructure. It is a development platform, not a public multi-tenant code executor.

• Operator Bearer token: conversations, tasks, artifacts, approvals and model selection.
• Separate worker Bearer token: claims and fenced reports only. Empty tokens fail closed, and identical operator/worker tokens prevent startup.
• Credentials never enter model prompts. UI tokens stay in tab memory; there is no browser local/session storage. Provider credentials are sent only as authorization headers in explicit online mode. API access logging is disabled in the deployment command. No credentials belong in reports, screenshots, source control or URLs.
• Only calculator, read_file and list_directory exist. No shell, subprocess, package installation or file-writing tool is exposed to a model.
• Workspace reads require an operator decision for each exact call. Schema validation precedes approval; decisions are single-use and expire on cancellation/reassignment. Approval does not override filesystem boundaries.
• On supported POSIX platforms file access opens every path component relative to an existing directory descriptor with O_NOFOLLOW. Absolute paths, parent traversal, symlinks, special files and files larger than 64 KiB are rejected. Unsupported platforms fail closed for file tools.
• Uploaded text artifacts have bounded sizes, safe logical names and immutable IDs. Worker staging uses per-task directories, not user-supplied absolute paths. Artifact contents and tool outputs remain untrusted model inputs. Model instructions cannot authorize tools.
• Model responses, context, iterations, task duration and tool call counts have limits. Streaming connections close on cancellation. Database fencing rejects writes from expired workers; cancellation revokes the lease immediately.
• The API never executes agent tools. Worker containers run as UID 10001 with read-only roots, no Linux capabilities, no privileged mode, no Docker socket, bounded memory/CPU/PIDs and only approved mounts. Worker/model networks have no internet route in Compose. Model download uses a separate provisioning service.

Docker resource controls and filesystem restrictions reduce exposure for the implemented read-only tools. Ordinary containers are not a sufficient security boundary for hostile arbitrary code or multiple mutually untrusted tenants. Any future shell/code tool needs an independent evaluated sandbox, strict egress policy, tested cancellation and explicit human approval before public deployment.

Before public deployment: validate complete container startup, TLS and renewal, operator/worker auth, cross-role rejection, proxy body limits, backup restoration, volume permissions, resource use, and a live cancellation/approval flow on the target environment. Add account-based access, authorization, quotas and rate limiting before multi-user exposure. Authentication tests alone do not establish public release readiness.

V4/V5 additions and public boundary

The initial launch stack contains only static website/docs and a reverse proxy. There are no application upstreams or shared execution networks. Requests to execution-like routes return 403. Studio/API subdomains remain reserved and unlaunched.

The private API supports revocable one-hour HTTPS sessions using random HTTP-only __Host- cookies with Secure, Path=/ and SameSite=Strict; only hashes are retained in process memory. Cookie-authenticated mutations require an exact same-origin Origin header. Local HTTP development continues using the original tab-memory Bearer token. Worker tokens cannot create operator sessions. HTTPS session issuance requires a correctly configured trusted TLS proxy; application deployment remains gated until that is verified on the target.

Per-process rate controls bound anonymous requests, login attempts, authenticated operator traffic and worker reports separately. Logs record method, status and timing without credentials, paths, queries, prompts or document bodies. Session revocation/rate limits are single-instance state and must use shared storage before API replication. Static Nginx rate limiting is intentionally aggregate behind the public proxy; it is not advertised as a per-user distributed protection system.

Remote model execution needs explicit task-level cloud_allowed consent as well as online worker configuration. An offline control plane rejects cloud consent. New task payloads use contract v2; older workers cannot claim these tasks. Local-only privacy is the default. Verification failure is distinct from completed execution, and model-authored claims cannot manufacture tool evidence.

The public Caddy image retains only NET_BIND_SERVICE after dropping all other capabilities; the official binary has that file capability and failed to execute when it was excluded from the bounding set. Static Nginx containers run as the image's unprivileged user on port 8080 and retain no capabilities. Local TLS routing validation uses an internal test CA and ordinary certificate verification; it neither installs a host trust root nor requests real-domain certificates.