Trust boundaries

The browser, retrieved content, model output, connector data, notebook content, runtime files, and attempt process are untrusted. The app role enforces user and attempt policy. The worker role owns provider administration and artifact verification. Runtime code has neither authority.

Boundary flow

1. The authenticated browser sends a typed command to app.
2. app authorizes workspace membership and commits state plus an event.
3. worker durably coordinates external work through Temporal.
4. An isolated attempt receives a verified local context/skill tree, a fixed local sandbox harness, and short-lived generation-scoped inference and trusted-tool capabilities.
5. Local files, shell, scratch Python, and ephemeral subagents remain disposable; web, connectors, remote MCP, canonical research records, messages, task controls, and workspace publication cross the trusted tool boundary.
6. The attempt may upload only to a staging target.
7. A trusted finalizer verifies bytes before create-only promotion and manifest commit.

The accessible alternative to a network diagram is the ordered flow above: authority narrows as work moves toward hostile compute, and only verified state and bytes move back into canonical storage.

See Security for controls and activation gates.