Documentation

Threat model

What the system assumes an attacker can and cannot do.

Assumptions

We assume an attacker can get arbitrary text printed during a CI run, and that the agent can write to the branch it proposed — it must be able to. We do not assume the attacker can modify tracked source, the project’s intent document, or incident metadata, and we do not assume control of the hosting provider’s API responses. That last independence is what the reconciliation check rests on.

We do assume that anyone able to set environment variables on the deployment can reach any secret it holds. That is stated as an assumption rather than a residual risk, because it is currently true.

The injection surface

CI job log output is third-party-influenced: package postinstall scripts, test reporters, and anything else that prints during a run. It is the one place genuinely attacker-influenced text already enters a live incident, and it is handled by the quarantined reader rather than by filtering.

The substitution surface

Between a human reading a diff and a merge happening, the branch can move. The motivating case is not a malicious operator but a model that alters its work product instead of refusing or escalating. See Reconciliation.