agent-workflow executes operator-selected coding agents and explicit commands against source repositories. Treat prompts, prompt packs, delegated processes, provider output, generated patches, and target repositories as untrusted until reviewed.

The repository-wide security classification and residual-risk inventory is Feature determinism and security assessment. Canonical remediation state is in BACKLOG.md and the dependency plan is Determinism and security hardening plan.

The project is pre-public-release and does not yet have a monitored public vulnerability-reporting channel. This is a release blocker tracked as REL-002. Do not publish sensitive reports in a public issue tracker.

• Commands are represented as argv arrays rather than shell command strings in governed launch paths.
• IDs are restricted before they become paths, tmux names, or evidence keys.
• Many authority files are regular read-only files verified through stable descriptors and content digests.
• Status files, logs, and terminal capture are projections, not authorities.
• Workflow state is reconstructed from an immutable snapshot and append-only journal.
• Approval is explicit and binds an actor label, reason, revision, and sealed evidence.
• Provider usage fails closed on mixed modes, conflicting identities, malformed totals, or incomplete cost metadata.
• MCP is local stdio, read-only, metadata-minimal, bounded to configured roots with component-wise no-follow reads, stable bounded errors, parser-derived command discovery, and verified launch-contract command context. Command catalogs are not authorization, absolute executable paths are redacted, and command-artifact drift fails closed.
• Repository-owned subprocesses use one argv-only substrate with process-group timeout/cancellation, per-stream caps, controlled environments, executable identity, and configured-value/secret-argument redaction.
• Configuration is executable policy: schema version 1 rejects unknown keys and reads config without following links. Governed/release mode requires user ownership and no group/world write bits for config, state, repository allowlists, and policy files; local mode exposes the same findings as doctor warnings.
• Named executors are resolved to the actual launched path and probed through the bounded process substrate. Versioned compatibility data supplies adapter versions and explanation codes; unsupported governed adapters fail closed. Doctor and provenance omit credentials.
• Prompt packs, native jobs, prompts, and MCP repository/state roots use component-wise no-follow traversal; irregular entries and content changes during validation are rejected. Pack archives are built from the validated inventory and include a typed canonical manifest.
• Runtime schemas come only from the executing source checkout or installed package asset set; duplicate IDs, malformed assets, and missing packaged assets fail closed.
• The project does not automatically merge, delete failed worktrees, terminate suspected stalls, expose remote execution, or authorize network MCP transport.

These are active release blockers, not theoretical future hardening:

• The bounded process substrate is integrated for governed call sites, but shared installed-product acceptance and the foundation phase gate remain open (HARD-001); tmux.attach remains the documented interactive-only terminal ownership boundary.
• Prompt-pack, native-job, schema, and bounded-path integrity controls are integrated, but filesystem-socket coverage was unavailable on this host and shared phase-gate acceptance remains open (HARD-002).
• MCP reads are metadata-minimal, bounded, and component-wise no-follow, but the installed stdio journey remains unverified and phase-gate acceptance remains open (HARD-005).
• writable-path policy for untrusted commands is primarily post-run detection rather than a preventative OS sandbox (HARD-003);
• some runner/evaluation decisions still depend on mutable status projections rather than one immutable launch authority (HARD-004);
• default sensitive-content classification, redaction, and retention controls are incomplete (HARD-006);
• actor strings are not authenticated principals, so reviewer independence is procedural rather than cryptographically or OS-authenticated (HARD-007);
• config/executable ownership and compatibility evidence are enforced by explicit local/governed/release policy; repository-local hooks and filters remain an operator-visible trust decision rather than being silently disabled;
• release checks now emit a synchronized direct-dependency lock, CycloneDX SBOM, structured test evidence, and source/build provenance (REL-005), but full transitive hashes, independent reproducibility, and authenticated signing/attestation remain open (HARD-010).

Do not describe these controls as complete until their backlog exit evidence exists.

• Run agents with the least filesystem, network, and tool access needed.
• Keep credentials and private data out of prompts, argv, logs, repositories, and state bundles.
• Review patches and evidence before executing project code or accepting a run.
• Use separate operating-system accounts, containers, or disposable hosts for higher-risk targets.
• Protect the XDG state directory; it can contain source paths, prompts, model output, provider streams, and code fragments.
• Do not publish a receipt bundle without reviewing every sealed artifact it references.
• Treat current actor labels as commentary, not proof of reviewer identity.

The default state location is:

~/.local/state/agent-workflow

Trusted collaborators should contact the maintainer through an existing private channel and provide the smallest safe reproduction. Include version, platform, command category, and whether the issue affects path containment, evidence authority, process control, identity, information disclosure, or provider accounting. Do not include secrets or private state bundles unless a secure transfer path has been agreed.