Trust boundaries

The browser, retrieved content, model output, connector data, notebook content, runtime files, and attempt process are untrusted. The app role enforces user and attempt policy. The worker role owns provider administration and artifact verification. Runtime code has neither authority.

Boundary flow

1. The authenticated browser sends a typed command to app.
2. app authorizes workspace membership and commits state plus an event.
3. worker durably coordinates external work through Temporal.
4. An isolated attempt receives short-lived, generation-scoped inference and tool capabilities.
5. The attempt may upload only to a staging target.
6. A trusted finalizer verifies bytes before create-only promotion and manifest commit.

The accessible alternative to a network diagram is the ordered flow above: authority narrows as work moves toward hostile compute, and only verified state and bytes move back into canonical storage.

See Security for controls and activation gates.