Security & isolation

This is a self-hosted platform whose security posture is enforced by gates in the pipeline rather than promised in a document. The claims below each correspond to something that fails a build, a push or a request when it is violated.

• Routes are gated explicitly. Anything exposing workspace paths, file content, persona detail, model execution or ticket creation must carry authentication — and an inventory test fails the build when a new route quietly does not.
• Data is scoped to its owner at the database level, so a bug in application code is not automatically a data leak.
• Connector tokens are encrypted per user and brokered, never handed to a bot environment.
• A publish gate stands between the repo and the world and is fail-closed on every push. The rule when it fires is to fix the identifier, never to narrow the pattern to the file that tripped it.
• Every fix ships a regression guard in the same change — and a guard that would pass against a mocked version of the thing that broke does not count as one.

OIDC providers in production, plus an invited-login mode with a second factor for deployments that should not depend on an external identity provider. Local development runs on a mock identity, because a system a human cannot exercise in a browser at handover is a system nobody has actually checked.