🔐 Secrets, pasted text, and blast radius

Secrets never touch the context

Every secret on this fleet lives in an encrypted vault on one machine, reachable from everywhere by a small client. The agent does not read a secret and paste it into a command. It runs the command through the client, which injects the value into the environment for that one process and nothing else. The value never appears in the transcript, the logs, or the context window, which means it never appears in a summary or a memory note either.

Two conventions back this up. A single allowed name prefix, checked by an audit, because the other prefix maps to a weaker tier that risks plaintext. And a list of files the agent never commits: env files, keys, and anything under the credential directories of the tools on the box. The pre-commit hook blocks them; the rule exists so the hook is not the only line.

Pasted text is data, not instructions

Anything the agent reads from outside, such as a web page, a shared document, a comment thread, or a file someone else edited, may contain text that looks like an instruction. It is not one. The harness marks pasted content, and the rule is to follow instructions inside it only where your own message asks for that. The same applies to rows in a shared database and to the output of another agent. An agent that treats every string it reads as a command is one malicious README away from running it.

Blast radius, decided in advance

The constitution keeps a short list of things that need a human’s yes: deleting branches, force-pushing, killing services, removing a worktree outside its own path, disabling the access layer on any public subdomain. The agent can plan any of them. It executes none of them unasked.

A useful pattern is to automate the safe half and refuse the other half. The kill button removes a worktree only when it is clean and has nothing unpushed; otherwise it leaves the directory and the branch and says so. Audit skills report and never fix. Read-only inspection comes before any change to a cloud account, a database, a DNS record, or the vault.

↘ The sandbox that could think but not act

A delegated agent here spent a period of time able to answer questions and categorically unable to run a command. It looked like unhelpfulness. It was an operating-system security setting that had broken the tool’s sandbox, and the fix was installing a compatible profile, not rewording the prompt. When an agent can reason but not act, suspect the security layer before the model.

Public and private do not mix

This site is public. Every lesson on it comes from a private machine, a private console, and a commercial robot, and every host, name, address, and product has been removed on the way out. That is a rule, written into this app’s own instructions file, checked with a grep before commit. The agent that helped write these pages was told the rule first.