From 0cfaca94e7e87e2c228c7a6e31c863fd660cd0f6 Mon Sep 17 00:00:00 2001 From: Omar Sobh Date: Wed, 23 Sep 2026 14:56:07 -0500 Subject: [PATCH] docs(readme): microVM guests no longer hold provider keys Proven on tank: claude backend (01a0cfc1, MET, pushed) and kimi backend (01a0cfd5: 0 direct connections to api.kimi.com, down from 4; work delivered; judge unavailable only because GLM is out of quota and Kimi cannot judge Kimi). Co-Authored-By: Claude Opus 5.5 (1M context) --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 30b7da0..aed4a6e 100644 --- a/README.md +++ b/README.md @@ -229,7 +229,6 @@ source file. It is **not currently run in CI**, and 12 files exceed the hard lim **Next** - Enforce task permission and argument provenance (both still in shadow, gathering evidence). -- Route microVM missions' model calls through the LLM proxy too, so no guest holds a provider key. - Evidence the remaining team templates (4 of 12 still need a target stack: mobile, gpu, threejs, and `insight_research`). - A dedicated judge key, so no other consumer of a shared provider plan can starve the judge. @@ -260,9 +259,10 @@ structures, never gives an agent more reach than its sandbox. What that means to container holds a per-mission token, Claude Code's base URL points at the server's proxy on an unpublished port, and the proxy adds the real credential — honouring the token only while its mission is running. Behind that, delivery refuses to push any change containing a server key, and every - recorded event, judge verdict and judge input is redacted. MicroVM missions still receive their - backend's key in the guest, behind the egress allow-list. The server reaches Docker through an - allow-listed socket proxy. + recorded event, judge verdict and judge input is redacted. **MicroVM guests hold no provider key + either** (node daemon 0.5.0+): the guest's CLI talks to its own loopback, fcagent pipes that to the + node, and the node relays it to the proxy on the server's tailnet-only port — no key on the node or in + the guest. The server reaches Docker through an allow-listed socket proxy. - The gate is a guardrail against accidents and obvious exfiltration, not a boundary against a determined agent (indirection defeats string matching). The boundaries are the VM, the network policy and the broker.