SECURITY.md

Rama main · réplica de lectura del repositorio original.

# Security model

This is a developer preview. Run it on a dedicated development machine/VM, not a host containing production credentials. Public fork PRs are skipped. Containers reduce exposure but share the worker kernel and do not provide a complete hostile-code boundary.

- Trusted: controller configuration and explicitly approved base-branch policy.
- Untrusted: PR descriptions, head files, model output, test output.
- Test containers: no network by default, no forwarded host credentials, read-only source bind, disposable tmpfs workspace, non-root user, dropped capabilities, resource limits. Configured dependency services enable a disposable internal Docker network with no published host ports. Internal networks are not a complete host boundary; restrict access to host gateway services using worker VM/firewall policy. See [test environments](docs/TEST-ENVIRONMENTS.md).
- Agent container: model network access is necessary; it receives an OpenAI key and repository text, but no GitHub token or host checkout. Prompt instructions and SDK sandbox settings are defense in depth, not a guarantee against prompt injection. Restrict worker egress at the VM/firewall layer when handling sensitive sources.
- Publisher: only accepts verified reports, targets an independent branch, rechecks source revisions, never merges or force-pushes.
- Optional service ingress: verifies signed raw GitHub payloads, repository identity and size/time bounds before persisting sanitized event hints. Expose the local listener through a trusted HTTPS endpoint. Webhooks cannot approve a candidate; the worker rechecks live API authorization and pinned evidence. Webhook secrets stay in the controller environment.
- Optional progress feedback: updates comments only for the authenticated user and exact RepoPilot marker, with a durable outbox and bounded retries. Progress prose is excluded from repair acceptance feedback. Daily service allowances include crash reservations and do not claim a currency hard cap.
- Optional Jev decisions: sends only current trusted Issue intake state to the fixed TypeSafe HTTPS endpoint using a separate controller-held key. Typed suggestions cannot authorize execution or publication. Pinned-input decisions, uncertain usage and bounded retries persist separately from Codex budgets; redirects, oversized replies and inconsistent distributions are rejected. Gate uncertainty defers to human review; shadow advice does not waive any verification gate. See [Jev decisions](docs/JEV-DECISIONS.md).
- Decision governance: human labels remain separate from runner results; immutable fixed suites and evaluation records bind input, answer and label digests. Promotion rechecks evidence and policy revision, rollback preserves the previous settings, and queued requests never grant code-execution authority or reset budgets. Local reviewer names are operator assertions, not authenticated identities.
- Local console: binds loopback only, authenticates JSON reads using a separate random session token, checks Host/Origin, and exposes GET metadata routes only. It returns no provider credentials, source/Issue/review text, raw logs or filesystem paths. Content security policy, text-only rendering and no-cache responses apply; the printed local URL is private. It is not a multi-user remote administration surface.
- Snapshots: fail closed for symlinks, submodules, unsupported binaries, case collisions and path traversal. Git executable modes are retained in snapshots, exports and published trees; Windows host filesystem semantics may differ from Linux modes.
- Evidence: structured reporters check discovery, per-case identities and repeated failure fingerprints. Test code still runs in the same container as its runtime/reporter; this is not tamper-proof attestation against actively malicious code.
- Local task reports and input snapshots may contain proprietary code and logs. Keep the data directory private and out of Git. Logs are not comprehensively secret-redacted in this preview.
- Agent timeouts remove the named container. Controller crashes may leave resources; version 1.1.0 provides explicit [recovery](docs/RECOVERY.md) with data-directory ownership labels, lock checks and preview validation. Names alone never authorize deletion; legacy resources require manual inspection. Do not delete unrelated containers or the entire data directory blindly.

Report vulnerabilities privately to the repository maintainer through an available private contact channel. Do not include secrets in public issues.