Sandboxed Lua
Environment access is denied unless the operator allowlists each name.
Inspect the control01 / SECURITY POSTURE
FAIL CLOSED.SHOW THE EVIDENCE.
The project takes the same stance as the runtime: denied by default, bounded where enabled, and inspectable after execution.
02 / RUNTIME SECURITY
PERMISSION IS EXPLICIT.
Controls are applied at the runtime boundary instead of delegated to prompt wording.
Consequential tools
Shell is opt-in. Approval gates redact arguments and fail closed on timeout.
Inspect the controlNetwork boundary
SSRF controls, CORS, rate limits, and request and response size limits protect serve mode.
Inspect the controlDurable HITL
Cross-replica human answers use an encrypted PostgreSQL mailbox and stay attributed.
Inspect the control03 / SUPPLY CHAIN
VERIFY WHAT YOU DEPLOY.
The release is a chain of source, artifacts, identities, and checks—not a binary attached to a tag.
Checksums
Release archives are bound to published SHA-256 checksums.
Keyless signatures
Release assets carry identity-bound signing evidence.
CycloneDX SBOM
Each release exposes the dependency inventory used for review.
Signed OCI path
Container promotion is tied to a signed release receipt and immutable source inputs.
04 / DEPLOYMENT GUIDANCE
THE PLATFORM STILL OWNS THE OUTER BOUNDARY.
Run as a non-root user, set resource limits, preserve graceful shutdown, and size storage and routing around the chosen persistence mode.
05 / RESPONSIBLE DISCLOSURE
REPORT SECURITY ISSUES PRIVATELY.
Use GitHub private vulnerability reporting. Do not put an undisclosed vulnerability in a public issue.
A maintainer will acknowledge a valid private report, preserve a direct technical channel, and coordinate disclosure around a verified fix. Response timing is best effort unless a support contract defines an SLA.
Open private reportingLICENSE + PROVENANCE
MIT SOURCE. PUBLIC HISTORY. INSPECTABLE RELEASES.
BRING THE REVIEW QUESTIONS