docs(readme): say what now limits a leaked provider key, and what does not

Proven live with a canary (missions 01a0cf3d, 01a0cf4c): push refused, patch redacted, 0 of 19 events and 0 judge fields carrying the value. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
2026-09-23 12:27:46 -05:00
parent 4602e9b896
commit 60a1fef5e5
1 changed files with 4 additions and 2 deletions
@@ -257,8 +257,10 @@ structures, never gives an agent more reach than its sandbox. What that means to
  gets only a narrowly scoped skills token, never a ClawMates session. **Model-provider keys are the
  exception:** Claude Code inside a mission needs its own credential, so container-tier missions carry
  the provider keys (`CLAUDE_CODE_OAUTH_TOKEN`, and `ZAI_API_KEY` / `KIMI_API_KEY` for the fallback
-  chain) in their environment, readable by the agent. The server reaches Docker through an allow-listed
-  socket proxy.
+  chain) in their environment, readable by the agent. What limits the damage: delivery refuses to push
+  any change containing one of those keys (exact values, verbatim or base64), and every recorded event,
+  judge verdict and judge input is redacted before it is stored or sent. A key sent straight to a host
+  over the network is not covered yet. The server reaches Docker through an allow-listed socket proxy.
 - The gate is a guardrail against accidents and obvious exfiltration, not a boundary against a
  determined agent (indirection defeats string matching). The boundaries are the VM, the network policy
  and the broker.