Security
An agent that follows injected instructions cannot weaken verification — a rewritten verification config is ignored because configuration is read from the base commit and the path is protected — and a host secret behind a planted symlink never reaches a context pack.
Curated source: paths, test names and the CI conclusion were checked against this commit by the evidence sync.
Asserted by TestPromptInjectedAgentIsContained
Asserted by TestAgentCannotWeakenVerification
Asserted by TestReadConfinedRejectsPlantedLinks
Asserted by TestIsProtectedPath, TestCheckCommandBypasses
success
The container runner always builds engine arguments with no network, all capabilities dropped, no-new-privileges, a non-root user, read-only mounts where requested and tmpfs masks over secret paths, and refuses sensitive host mounts such as the home directory, ~/.ssh and the Docker socket.
The full verification gate errors when no secret scanner is available instead of passing silently, secret-looking paths (.env files, keys, Terraform state) are classified as secrets while ordinary source files are not, and API keys are redacted from escalation packets.