# AWP I0 / I1 Threat Model

**Date:** 2026-08-20  
**Status:** **CANONICAL PRE-I1 SECURITY BASELINE — live mitigation proofs remain environment-gated**  
**Scope:** I0 substrate and I1 Project -> Goal -> Plan -> Task -> FactoryRun -> AgentRun -> ChangeSet -> Review -> trusted Merge.

## Security Objective

AWP must be able to run untrusted/agent-authored code without giving that code the authority to publish, merge, broaden credentials, control the cluster, or destroy recoverable work.

Core boundary:

```text
untrusted execution plane
  may modify bounded Workspace
  may run explicitly granted tools/network
  may produce ChangeSet/evidence
  may request protected actions

trusted control plane
  owns policy/authorization
  owns provider credentials by reference
  owns trusted publication/merge
  owns lifecycle/audit
```

## Assets

Protect at minimum:

- Project/Goal/Plan/Task/Run authoritative state;
- provider/model credentials;
- GitHub publication/merge authority;
- Kubernetes cluster credentials and control plane;
- Workspace/WIP/checkpoints;
- source repositories and protected branches;
- audit/event integrity;
- Connection/CredentialReference mappings;
- user/Principal authorization context;
- CI/review evidence;
- Subrouter/account pool credentials and admin endpoints.

## Trust Zones

```text
Browser / user client
      |
      v
Gateway / edge transport
      |
      v
AWP control plane + PostgreSQL
      |          |          |
      |          |          +--> trusted GitHub publication/merge adapter
      |          +-------------> SecretStore / provider adapters
      |
      +--> K3s execution plane
             |
             +--> AgentRun / Attempt / Workspace
             +--> ARC runner workloads
```

Provider APIs, webhooks and model/account routers are external trust domains.

## Threats and Required Mitigations

### T1 — Forged gateway identity / header trust

**Threat:** external caller injects forwarded Principal/role/project headers and reaches control-plane commands with excess authority.

**Mitigations:**

- gateway claims are authenticated transport input, not final authority;
- control plane resolves Principal and permissions independently;
- signed/session-bound identity where applicable;
- authorization enforced at application command boundary;
- provider/Project aggregation cannot broaden scope;
- security-relevant request/Decision/audit correlation recorded.

**Gate:** protected command tests prove forged/missing/expired claims cannot elevate.

### T2 — Agent steals provider or publication credentials

**Threat:** prompt injection/untrusted repo code reads reusable GitHub/provider secrets and publishes/merges directly.

**Mitigations:**

- AgentRun receives only narrow short-lived capabilities required for its task;
- no reusable forge publication credential in Workspace/runner;
- SecretStore returns references/material only to trusted adapters when possible;
- environment/filesystem secret mounting is allowlisted and scoped;
- logs/events redact credentials/tokens;
- trusted publisher performs ref-fidelity/expected-head checks.

**Gate:** runtime inspection proves AgentRun/runner environment/filesystem lacks reusable publication credentials.

### T3 — Workspace escape / host compromise

**Threat:** agent-authored process reaches host/workstation or broader cluster resources.

**Mitigations:**

- normal execution occurs in K3s, never user workstation;
- namespace/service-account/RBAC/network policy/resource limits;
- default-deny network policy plus explicit egress where required;
- gVisor RuntimeClass for untrusted workloads where compatible;
- no hostPath/privileged/hostNetwork/hostPID/hostIPC baseline;
- explicit separate trust profile for workloads that truly need privilege;
- pod security context drops capabilities and prevents privilege escalation.

**Gate:** adversarial pod tests verify denied host/cluster access and intended RuntimeClass.

### T4 — Cross-Project / cross-Workspace data access

**Threat:** one Task/Project reads another Project's WIP, credentials or artifacts.

**Mitigations:**

- Project/Run-scoped Workspace identity;
- namespace/PVC/object prefixes and ACLs scoped by canonical IDs;
- no shared mutable checkout assumption;
- Connection bindings only narrow global resources;
- read APIs re-authorize requested resource rather than trusting URL/foreign ID.

**Gate:** cross-scope access tests fail deterministically and are audited.

### T5 — WIP loss through disposable compute

**Threat:** pod/process/node/control-plane failure destroys expensive accepted work.

**Mitigations:**

- compute may be disposable; accepted WIP is durable;
- PVC/checkpoint/collected ChangeSet strategy selected by WorkspaceProvider;
- lifecycle state in PostgreSQL separate from Workspace files;
- cleanup only after terminal handling and durable collection/explicit abandonment;
- orphan detection/reconciliation on control-plane restart.

**Gate:** process kill, pod delete, replacement, control restart and node-interruption recovery preserve/collect WIP.

### T6 — Malicious/compromised review bypasses merge protection

**Threat:** AgentRun self-reviews/self-merges or review state is forged/stale.

**Mitigations:**

- Review/Approval/merge capabilities separated;
- independent review identity/policy;
- trusted merge command rechecks candidate ChangeSet/ref/required evidence/current policy;
- expected-head / TOCTOU protection;
- merge operation idempotent and audited;
- AgentRun cannot invoke trusted merge adapter directly.

**Gate:** stale head, rejected review, missing evidence and unauthorized merge attempts all fail.

### T7 — Webhook/provider event forgery or replay

**Threat:** forged/replayed GitHub/provider event advances lifecycle or duplicates side effects.

**Mitigations:**

- webhook signature/token verification;
- provider event ID/idempotency dedup;
- canonical resource relationship verification before state mutation;
- at-least-once processing with idempotent transitions;
- replay/audit evidence retained.

**Gate:** bad signature, wrong Project/resource and duplicate event fixtures do not mutate state incorrectly.

### T8 — Durable workflow duplicate side effects

**Threat:** DBOS retry/recovery repeats publish/merge/provider mutations.

**Mitigations:**

- idempotency key per logical operation;
- external side-effect adapter checks current provider state;
- persisted attempt/lease/correlation;
- side effects wrapped in replay-safe step semantics;
- duplicate delivery returns prior result where appropriate.

**Gate:** kill/restart/duplicate delivery proof produces one logical side effect.

### T9 — Account router leaks or misroutes credentials

**Threat:** Subrouter/account layer sends traffic under wrong account/tenant, logs secrets, or lets user metadata choose privileged account.

**Mitigations:**

- AWP uses explicit Account IDs/selection policy and records Attempt provenance;
- user attribution metadata is never authorization;
- explicit account pin is authorized by AWP policy before provider request;
- credential material remains in provider-owned store/SecretStore;
- admin/account-import endpoints protected separately;
- token/request-body logging prohibited/redacted;
- tenant/project/account mapping validated at adapter boundary.

**Gate:** wrong account ID, unauthorized force-account, revoked account and cross-tenant tests fail and remain attributable.

### T10 — Queue/dependency manipulation causes unsafe execution order

**Threat:** UI/client reorders a Task before an unmet prerequisite or creates a dependency cycle.

**Mitigations:**

- dependency DAG validation server-side/transactional;
- legal placement range supplied to UI;
- invalid drag target blocked before drop and revalidated on command;
- cycles rejected with readable path;
- priority is advisory only among legal candidates.

**Gate:** malicious direct API reorder/cycle attempt cannot bypass domain validation.

### T11 — CI runner privilege/secret leakage

**Threat:** untrusted job receives cluster/admin/publication secret or leaves persistence for the next job.

**Mitigations:**

- ARC ephemeral runner pods;
- operator and runner namespaces separated;
- runner groups/labels/trust profiles explicit;
- no protected secrets for untrusted/fork work;
- no reusable publication credential;
- default runner unprivileged;
- privileged build profile isolated and explicit;
- pod removed after job and ephemeral storage cleaned.

**Gate:** real workflow proves ephemeral lifecycle and secret/trust separation.

### T12 — Audit/log tampering or secret leakage

**Threat:** security-significant mutation has no attributable record or logs expose credentials.

**Mitigations:**

- business event + audit written transactionally with authoritative mutation where required;
- Principal/correlation/causation/resource IDs included;
- structured redaction rules;
- provider request/response bodies excluded or scrubbed by default;
- audit access separately authorized.

**Gate:** mutation rollback cannot leave authoritative state without required audit; redaction tests cover common token shapes.

## Security Invariants

```text
Agent authority < control-plane authority
child scope may narrow, never silently broaden parent capability ceiling
provider credential != domain identity
user metadata != authorization
review != merge authority
queue priority != dependency authority
compute disposability != WIP disposability
replay != duplicate logical side effect
```

## Required Pre-I1 Proof Matrix

| Proof | Status in current conversation |
|---|---|
| control-plane authorization/forged claims | SPECIFIED; executable proof requires I0 code |
| no reusable publication credential in AgentRun | SPECIFIED; live K3s proof blocked by missing execution connector |
| gVisor/K8s isolation | SPECIFIED; live proof blocked by missing cluster connector |
| cross-Project isolation | SPECIFIED; executable proof requires I0 code/cluster |
| WIP recovery | SPECIFIED; live proof blocked by missing cluster connector |
| trusted review/merge TOCTOU | SPECIFIED; executable proof requires I1 VCS flow |
| webhook replay/forgery | SPECIFIED; executable proof requires provider adapter |
| DBOS duplicate-side-effect recovery | SPECIFIED; runtime proof blocked by missing executable environment |
| Subrouter force-account/tenant semantics | SOURCE-CONTRACT REVIEWED; AWP adapter proof requires I0 code |
| dependency reorder/cycle rejection | DOMAIN SPECIFIED; executable proof requires I1 command implementation |
| ARC ephemeral runner isolation | SPECIFIED; live proof blocked by missing cluster connector |
| audit/redaction | Platform/source fit reviewed; executable proof requires I0 integration |

## Implementation Rule

No privileged I1 dogfood is called security-ready until every mitigation required by the actual I1 deployment has executable evidence. This document closes the **threat-modeling/design** requirement; it does not falsify live proof status.

## Review Triggers

Update/supersede this threat model when:

- a new provider receives credentials;
- a new RuntimeClass/trust profile is introduced;
- public/tenant access is added;
- publication/merge authority changes;
- Workspace persistence mechanism changes;
- new external webhook/event source is accepted;
- later I3 autonomy/Advisor mutation surface activates;
- later I6 production deployment authority activates.