Allow-list
Resolve tenant, destination, repository, base ref, and agent profile before any child starts.
Fail closed by default
Generation is a capability.
Trust is a process.
Praxonne assumes prompts, upstream traffic, model output, generated source, and child-process output can all be hostile. The architecture contains each one and preserves evidence for review.
HTTP 200–302runtime signal
+policy + testsdeterministic gates
+human reviewpromotion authority
=merge eligiblenever automatic
Six promotion gates
No single signal is enough.
Isolation
Use an external sandbox with no host mounts, a read-only root, non-root identity, process/memory/CPU caps, and default-deny egress.
Integrity
Bind the request, candidate tree, tests, result, model profile, and dependency locks into one evidence digest.
Conformance
Require schema validation, unit/integration tests, secret scanning, dependency review, and policy checks.
Git boundary
Use a short-lived, repository-scoped GitHub App token. Push only a namespaced feature branch; create a draft PR; never merge.
Review
Protected branches, required checks, CODEOWNERS, and a human reviewer control promotion and deployment.
Explicit threat boundaries
What never crosses by default.
ThreatBoundary
SSRF / open proxyPolicy-owned destinations; deny private and link-local ranges unless explicitly bound.
Prompt injectionTraffic is data, never agent instructions; tool calls are allow-listed and schema checked.
Sandbox escapeThe child-process API is not the security boundary; production execution requires an external isolated workload.
Secret exfiltrationNo inherited environment, no broad PAT, redacted structured logs, default-deny egress.
Malicious proposalNamespaced branch, signed provenance, draft PR, required checks, protected base branch.
Duplicate mutationIdempotency key binds request, route revision, source digest, and candidate digest.
Found something?
Report it privately.
Use the private security advisory flow on the relevant GitHub repository. Never include live credentials, customer traffic, or source bundles in a public issue.