From 721c4b0997c394946823ebf8053004223dc31865 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Mon, 5 Oct 2026 16:26:19 +0200 Subject: [PATCH] spec(search-with-proof): separate trust domains (brain with key, executor with repo code) Replaces the accepted key-exposure exception: the key never shares a sandbox with repository code; executor AX tasks exchange commands and results via presigned objects. Firecracker executors only if the pilot build-failure rate requires it. Co-Authored-By: Claude Opus 5.5 --- .kiro/specs/search-with-proof/requirements.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.kiro/specs/search-with-proof/requirements.md b/.kiro/specs/search-with-proof/requirements.md index 0df2fcd..d592e5c 100644 --- a/.kiro/specs/search-with-proof/requirements.md +++ b/.kiro/specs/search-with-proof/requirements.md @@ -101,10 +101,12 @@ known instead of restarting. operator). Store credentials stay out of the cluster (presigned links, as today). For this arm, model calls inside the cluster supersede `unseen-repo-evaluation` Req 4.4 (model calls on the VM); that boundary is unchanged for all other arms. *(maintainer decision 2026-10-05: scoped key in the cluster)* -2. The key never appears in a manifest, a log, a board entry or a record. *(Amended 2026-10-05, maintainer decision.)* - In the cluster, repository code run by an explore step shares the task with the key and could read it; this risk is - accepted and bounded: the key is scoped to search, has a low spend cap, and is rotated after every run. On the host - and VM the inner sandbox keeps the key out of executed code. +2. The key never appears in a manifest, a log, a board entry or a record, and never shares a sandbox with repository + code. *(Amended 2026-10-05, maintainer decision: trust domains are separated instead of isolated inside one task.)* + The agent loop (the "brain", holding the key) runs on the VM or in its own AX task and executes no repository code; + every tool call that touches the repository runs in a separate executor AX task without the key, exchanging + commands and results through presigned store objects. A Firecracker executor runtime is considered only if the + pilot's `could_not_build` rate shows gVisor cannot build the projects. ### Requirement 6: Feasibility pilot, false-proof qualification, then the unseen pool