Phase 1: isolate autonomous execution from the control plane #1

Merged

jon merged 4 commits from phase/01-execution-isolation into main 2026-08-18 14:50:39 +00:00

Conversation 0 Commits 4 Files changed 13 +951 -32

jon commented 2026-08-18 14:30:34 +00:00

Owner

Copy link

Purpose

Establish the first security boundary for governed autonomous development.

Changes

• Separates autonomous execution from the orchestrator control plane.
• Prevents worker execution from inheriting orchestrator secrets.
• Introduces explicit environment allowlisting.
• Removes direct control-plane execution of untrusted agent workloads.
• Establishes isolated validation behavior.
• Adds tests for execution and credential boundaries.
• Aligns the reconstructed baseline health test with runtime version 0.2.1.

Validation

• Full test suite passes.
• Python compile check passes.
• git diff --check passes.
• No production deployment behavior is added or changed.

Deployment

None.

This PR changes source only. The currently running orchestrator remains unchanged.

Production deployment remains an explicit human gate.

## Purpose Establish the first security boundary for governed autonomous development. ## Changes - Separates autonomous execution from the orchestrator control plane. - Prevents worker execution from inheriting orchestrator secrets. - Introduces explicit environment allowlisting. - Removes direct control-plane execution of untrusted agent workloads. - Establishes isolated validation behavior. - Adds tests for execution and credential boundaries. - Aligns the reconstructed baseline health test with runtime version 0.2.1. ## Validation - Full test suite passes. - Python compile check passes. - git diff --check passes. - No production deployment behavior is added or changed. ## Deployment None. This PR changes source only. The currently running orchestrator remains unchanged. Production deployment remains an explicit human gate.

jon added 2 commits 2026-08-18 14:30:34 +00:00

Align health test with reconstructed runtime version 678e5b8405

Isolate autonomous execution from the control plane cc21880118

jon added 1 commit 2026-08-18 14:41:52 +00:00

Harden sandbox network and model credential boundary 4d28bf4b1b

jon added 1 commit 2026-08-18 14:47:45 +00:00

Protect Git metadata from sandbox link traversal 254de67c60

jon changed title from WIP: Phase 1: isolate autonomous execution from the control plane to Phase 1: isolate autonomous execution from the control plane 2026-08-18 14:50:20 +00:00

jon merged commit 416f5017c4 into main 2026-08-18 14:50:39 +00:00

jon referenced this pull request from a commit 2026-08-18 14:50:40 +00:00

Merge pull request 'Phase 1: isolate autonomous execution from the control plane' (#1) from phase/01-execution-isolation into main

jon deleted branch phase/01-execution-isolation 2026-08-18 14:51:23 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jon/steve-os-orchestrator!1

No description provided.