Security
Design principles
Product invariants.
Product invariants. These hold for every release.
| Principle | In practice |
|---|---|
| Transport, not judgment | The engine automates routing and mechanics, never a gate decision. No feature may auto-accept, auto-merge, or skip a gate. |
| Capture, not invent | The engine proposes rules for your standards; a human approves every promotion, and provenance is preserved on each rule. |
| Secrets never propagate | Names, paths and references only — enforced in the type system where ordinary logging could otherwise leak a value. The one exception: a vendor API key you assign to a local seat is kept in an owner-only file in that seat's profile and given to that seat's agent at run time; it is not hidden from other seats' agents on the same machine. |
| Git is the system of record for code | The engine never decides to push or merge. It performs three named remote actions — post a commit status, submit an approval, call the forge's merge API (Gitea; writes to GitHub are refused) — and only to deliver a signed human decision pinned to that commit. It does not push branches to your forge. It never force-pushes or rewrites history. It keeps its own mirrors on your machines up to date over SSH. |
| Advisor advises, human decides, record shows both | Suggestion and decision are distinct recorded events, and an override is itself recorded. |
| Sanction binds change classes, never time | Delegated acceptance runs only under a named, pinned, human-owned policy scoped to explicit change classes. No timeout anywhere grants an approval: silence is never consent. |
| Deterministic first | No model call where ordinary code suffices — a cost principle and a security one, since code that never calls a model cannot be talked into anything. |