From a428d7cf112b50c1d661bc5dfcf8f1ffa62537e4 Mon Sep 17 00:00:00 2001 From: Omar Sobh Date: Wed, 23 Sep 2026 13:22:12 -0500 Subject: [PATCH] docs(readme): container-tier missions no longer hold provider keys LLM proxy enabled on prod and proven on mission 01a0cf7e: container env and config hold only cmlp tokens (no real key value anywhere in either), both fallback hops rewritten, the mission completed, judged MET and pushed. Controls: no token 401, forged 401, finished mission 403, port unreachable from outside. Co-Authored-By: Claude Opus 5.5 (1M context) --- README.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 4672db6..30b7da0 100644 --- a/README.md +++ b/README.md @@ -229,6 +229,7 @@ source file. It is **not currently run in CI**, and 12 files exceed the hard lim **Next** - Enforce task permission and argument provenance (both still in shadow, gathering evidence). +- Route microVM missions' model calls through the LLM proxy too, so no guest holds a provider key. - Evidence the remaining team templates (4 of 12 still need a target stack: mobile, gpu, threejs, and `insight_research`). - A dedicated judge key, so no other consumer of a shared provider plan can starve the judge. @@ -254,13 +255,14 @@ structures, never gives an agent more reach than its sandbox. What that means to [`docs/TASK-PERMISSION-AND-TAINT.md`](docs/TASK-PERMISSION-AND-TAINT.md) for the measurements and the controls being built on top. - Platform credentials are held by the secret broker behind a private socket, and a mission container - gets only a narrowly scoped skills token, never a ClawMates session. **Model-provider keys are the - exception:** Claude Code inside a mission needs its own credential, so container-tier missions carry - the provider keys (`CLAUDE_CODE_OAUTH_TOKEN`, and `ZAI_API_KEY` / `KIMI_API_KEY` for the fallback - chain) in their environment, readable by the agent. What limits the damage: delivery refuses to push - any change containing one of those keys (exact values, verbatim or base64), and every recorded event, - judge verdict and judge input is redacted before it is stored or sent. A key sent straight to a host - over the network is not covered yet. The server reaches Docker through an allow-listed socket proxy. + gets only a narrowly scoped skills token, never a ClawMates session. **Model-provider keys never enter + a container-tier mission** when the LLM proxy is on (`CLAWMATES_LLM_PROXY=1`, as on prod): the + container holds a per-mission token, Claude Code's base URL points at the server's proxy on an + unpublished port, and the proxy adds the real credential — honouring the token only while its mission + is running. Behind that, delivery refuses to push any change containing a server key, and every + recorded event, judge verdict and judge input is redacted. MicroVM missions still receive their + backend's key in the guest, behind the egress allow-list. The server reaches Docker through an + allow-listed socket proxy. - The gate is a guardrail against accidents and obvious exfiltration, not a boundary against a determined agent (indirection defeats string matching). The boundaries are the VM, the network policy and the broker.