-
Notifications
You must be signed in to change notification settings - Fork 0
Execution and Legacy Compatibility
CPCF v0.6 separates evidence analysis from executable effects. The CPCF API and analysis worker never execute adapter code. A customer-controlled runner obtains short-lived, signed jobs through a separate mTLS boundary and returns receipts bound to the attempt and lease.
The receipt may record an exact argument vector, a bounded working directory, an environment allowlist, timeouts, byte-limited concurrent captures, stream hashes, UTF-8 validity flags, executable path and digest where practical, timestamps, duration, exit status, and timeout or truncation state. These controls make the evidence more specific; they do not fully sandbox the upstream executable's filesystem or network access. An operating-system sandbox is required for that threat model.
Only a receipt-backed action with an admitted capability may supply an exact argument vector. The capability must bind the operation, executable digest, effect class, receipt schema, and every source-pointer/target-schema mapping. Command-like text found in logs, source output, a task description, or a legacy record is never execution authority.
An asserted runner isolation property is not a containment proof. A successful exit status is not by itself a proof of authorization, success, acceptance, truth, or physical effect.
Earlier adapter targets are read-only compatibility material. CPCF performs a version handshake before inspection; editable package metadata is provenance context rather than the source interface authority. Legacy import can copy raw bytes by copy-on-write, but authority-bearing legacy material remains quarantined.
Promotion into v0.6 requires a newly typed v0.6 capability, independent approval, digest-scoped runner materials, a closed output model, exact pointer reconstruction, a new v0.6 attestation, and the required quorum decision. Shape changes fail closed.
Reconnaissance is not authority to execute upstream systems. Returned upstream “safe commands” are
data. The legacy storage_doctor operation is deliberately unregistered because it can create a
database file and is therefore not a normal read-only compatibility action.
For state-changing control-plane work, continue with Remote Workspaces.