Security depends on the deployed controller, runtime, node configuration, network policy,
and credential mapping. A source feature, successful test, or RuntimeClass object does not
establish containment or compliance for a production workload.
Authentication and verification
API keys use Authorization: ApiKey <key>; JWTs use Authorization: Bearer <JWT>.
Registration returns api_key: null and requires email verification before issuing usable
keys. Verification applies to API-key, event-stream, and WebSocket paths as well as sessions.
Migration 068 revokes legacy unverified or unbound keys; preserve verified operator access
when qualifying an upgrade.
Organization and sandbox identity come from authenticated server records. Supplying an org
header cannot grant access. Bootstrap token exchange, delegated pod tokens, ordinary API
keys, inference credentials, and terminal profiles have different roles and lifetimes.
Never put model/provider keys in a prompt merely to configure the Sandbox client.
Scopes
For the documented code-writing flow, the source agent setup recommends sandbox:create,
sandbox:read, and sandbox:write. Each route additionally enforces its concrete permissions,
sandbox ownership/roles, billing, and lifecycle state. Use narrower permissions where the
actual operation permits them; a read-only prompt does not reduce a powerful credential.
The server task registry has owner/operator/viewer family grants. Registry discovery does
not grant process, file, or sandbox access. Process observation separately checks the
expected process identity, workspace, and command hash. A metadata-only team root is not a
running worker.
Runtime and pod boundary
The Node create path resolves an admitted isolation tier and effective RuntimeClass.
ALLOWED_ISOLATION_LEVELS and startup preflight control what is admitted; actual node/runtime
execution must also be tested. Wasm is not wired into the reviewed runtime. Local Docker
is a developer backend, not equivalent to the hosted gVisor/Kata boundary.
Use the shipped restricted pod settings and verify the rendered/runtime pod: non-root,
no privilege escalation, dropped capabilities, constrained volumes, no service-account token,
resource limits, and appropriate filesystem permissions. Controller RBAC must stay separate
from the workload service account. A writable host Docker socket would defeat this boundary.
Network and provider credentials
NetworkPolicy requires an enforcing CNI. Egress monitor mode records decisions without
establishing broad deny enforcement. The gateway’s effective organization/sandbox policy,
DNS/address validation, destinations, and connection paths need actual negative tests.
The source supports per-sandbox egress overrides that narrow organization policy and
server-side credential/inference gateways. Configuring these keeps supported credentials
out of the sandbox environment, but does not authorize arbitrary upstream destinations.
Gateway policy and provider quotas/billing remain separate from sandbox lifetime.
Execution ownership and output
Agent-owned execution/cancellation handles and pod identity fences prevent a stale control
request from being interpreted as authority over another worker. Retain original receipts
through pod replacement, timeout, or lost stream status. Cancellation acceptance is not
termination proof; an unknown exit cannot become success or automatic retry permission.
Sensitive workspace paths and registered task controls have additional access checks.
File content, task journals, collected artifacts, and private model outputs can contain
secrets. New metadata-only audit events omit command arguments, environment, source, file
contents, and stdout/stderr; explicitly reading logs still exposes the underlying output.
Sharing and deletion
Artifact/tunnel mutations first resolve the source sandbox and its permissions. Unavailable,
incomplete, or mismatched source lookups fail closed rather than falling back to broad
organization access. Expired artifacts cannot be newly downloaded/signed/written into a
sandbox. Integrity failures are reported before a sandbox write.
Private tunnel tokens remain credentials. Candidate DB storage persists token hashes and
revalidates current source ownership; idempotent replay requires matching principal,
path/body, and an active receipt. Revocation/expiry does not erase copies already downloaded
or close an external system’s transaction.
Release-security evidence
At source 67bc2370, published candidate RC2 rebuilds the Kubernetes execution client and
controller base with pinned inputs. Its published image review reports zero fixable
HIGH/CRITICAL, zero CRITICAL, and 43 unfixed HIGH package findings across eight CVEs.
The earlier failed RC1 review remains retained.
Later uncommitted RC3 work reports a zero-HIGH/CRITICAL local image scan without exceptions
and 14 offline bootstrap checks. That fixture disables Kubernetes/isolation preflight, so
it does not prove hosted containment. Source/image publication, fresh hosted CI, independent
security/integration review, and deployment acceptance remain distinct gates for that work.
Source basis: Node auth/scopes/sandbox access, isolation policy, execution handlers,
docs/SECURITY_BOUNDARY_VERIFICATION.md, and release records, checked October 20, 2026.
Continue with runtime selection,
operations, or
execution recovery. Last modified on October 20, 2026
