Security

Task-branch isolation and git integrity checks

Tested in CILabPersonal labboundedcode-task-isolation

Claim

Agent work is checkpointed as commits on a task branch without modifying main, and a worktree whose git admin directory has been redirected to a planted repository blocks the task with an integrity decision before host git can run the planted filter.

Status

tested: An automated test in CI asserts the claimed behaviour, including a failure case where relevant, and passes at the verified commit.
lab: Local machine, local clusters or CI runners.
personal lab: My own public repositories.

Verified commit

repository: akynte/boundedcode
release: v0.1.0-alpha.3
commit: be1aa9f87ec5ea92567d29c48bf1982ce018c227
committed: 8 October 2026
CI: ci.yml #37773301609 success at be1aa9f

Curated source: paths, test names and the CI conclusion were checked against this commit by the evidence sync.

Implementation

Evidence

Testinternal/orchestrator/runner_test.go (GitHub, pinned to commit)
Asserted by TestRunFailEscalateCrashResumeAndComplete
Testinternal/orchestrator/adversarial_test.go (GitHub, pinned to commit)
Asserted by TestAdminDirTamperingBlocksTask
CI runci.yml run 37773301609 (GitHub, pinned to commit)
success

Environment

ci runner: GitHub-hosted ubuntu
go: 1.27.1

Limitations

Exercised against local temporary repositories with a scripted agent.
Covers the specific git admin-directory redirection tested; other git configuration attacks are not enumerated here.

Appears in

BoundedCode

Related claims

Tested in CILab

Containment of a prompt-injected agent

An agent that follows injected instructions cannot weaken verification — a rewritten verification config is ignored because configuration is read from the base commit and the path is protected — and a host secret behind a planted symlink never reaches a context pack.

Securityboundedcode v0.1.0-alpha.34 test files, 8 artifactsEvidence