2026-07-18_Lovable Sovereign Runtime

🔐 Announcing: Lovable Sovereign Runtime — AI SAFE2 v3.0

The First Enforcement Boundary for Lovable That Closes the Subagent Exfil Gap

Cyber Strategy Institute | June 2026

---

We just shipped examples/lovable-sovereign-runtime — and it surfaces a threat
the prior design missed: subagents read ALL your project files, including .env.

▶ View the package →

---

What Lovable Actually Does (Confirmed From Live Docs)

Before defending it, you need to understand what you're defending:

query_database "runs SQL with your full database permissions. Read, write, and schema changes." — Lovable MCP docs

Workspace knowledge is "always included in context" for every future message, across every project in your workspace. 10,000 characters of persistent context — shared workspace-wide.

Lovable MCP tokens are "full account scoped, not one project. Whatever client you connect can list, read, and edit every project you have access to."

Subagents "can search your project, inspect files" and "report their findings back to the main Lovable agent."

These are features. They're also the attack surface.

---

The New Surface: LV-SUBAGENT

The prior design (5 surfaces) missed this. Live docs confirmed it.

Lovable subagents read project files — all of them — and report findings to the main agent. A subagent briefed to "explore the project structure" will read .env.production if it exists. Those contents appear in subagent findings. Those findings go to the main agent. The main agent includes them in responses.

This is a credential exfiltration path that bypasses the normal agent access patterns and doesn't require any malicious instruction — just a file that shouldn't be in the repo root.

scan_subagent_file_access() is the gate. It intercepts file path lists before subagents read them and blocks access to credential files by path pattern.

---

21/21 Passing

cd examples/lovable-sovereign-runtime
PYTHONPATH=enforcement python3 smoke_test.py

# === TIER 1: Lovable Attack Surfaces (LV surfaces) ===
#   ✓  T1-01 LV-KNOW instruction override in workspace knowledge blocked
#   ✓  T1-02 LV-KNOW API key in project knowledge blocked
#   ✓  T1-03 LV-PLAN destructive database step in plan blocked
#   ✓  T1-04 LV-SQL DROP TABLE in query_database blocked
#   ✓  T1-05 LV-SQL TRUNCATE TABLE in query_database blocked
#   ✓  T1-06 LV-MCP high-privilege database:write scope blocked
#   ✓  T1-07 LV-BUILD eval() in generated code blocked
#
# ... T2 + T3 ...
#
# TOTAL: 21/21 -- SOVEREIGN BASELINE VERIFIED

Note: initial run was 18/21. Three real gaps caught and fixed before shipping:

• sk-live-* key format (hyphen in key body) not matched by prior engine pattern
• Natural-language "delete all existing user records" not caught by SQL-only plan scanner
• Response.json(process.env) (Web API) not matched by res.json() pattern

That's the 100X methodology working. Gaps caught in testing, not production.

---

Highest-Impact Action (No Code Required)

Drop workspace-knowledge/ai-safe2-workspace-knowledge.md into:
Lovable → Settings → Knowledge → Workspace knowledge

Done. Every future agent session in your workspace now operates under
AI SAFE2 trust boundary rules — no integration required.

---

AI SAFE2 Controls Enforced

P1.T1.2 P1.T1.10 P1.T1.4_ADV P1.T1.1 P1.T2.5 P1.T2.6
S1.3 S1.5 S1.6 P2.T3.1 A2.5 P3.T5.5 P4.T7.1
M4.5 E5.1 CP.4 CP.10

All verified against live AI SAFE2 v3.0 framework. Zero fabricated controls.

---

Series Status

Runtime	Status
make-sovereign-runtime	✅ Released
xai-grok-sovereign-runtime	✅ Released
lovable-sovereign-runtime	✅ This release
manus-sovereign-runtime	🔜 Next (highest CVSS — 3 documented 9.8 exploits)
cursor-sovereign-runtime	🔜 Upcoming

---

Built by The Architect — Cyber Strategy Institute
"Engineered Certainty for the Agentic Age."