docs: sweep README + security docs current through 1.9.0 - #235
Open
rappdw wants to merge 1 commit into
Open
Conversation
The docs had fallen behind three releases (1.8.0/1.8.1/1.9.0). This brings the
user-facing and security docs current; SPECIFICATION.md / SPEC_INTROSPECTION.md
stay current via their own regen gates and are untouched.
README:
- env-var table: added 10 missing keys — SANDY_CLAUDE_CONNECTORS, SANDY_SUSPICIOUS
(1.9.0 credential work), the Grok trio (XAI_API_KEY / GROK_MODEL / SANDY_GROK_AUTH),
SANDY_TEAMMATE_MODE, SANDY_EGRESS_LOG, SANDY_TOOL_AUDIT, SANDY_HANDOFF_DIRS,
SANDY_VERBOSE, SANDY_HOST_ID, GOOGLE_API_KEY, SANDY_AGENT_ARGS.
- Flags table: added --remove-sandbox / --provision / --doctor / --gc / the
introspection trio, and the --start 6/7/8 exit-code contract.
- prose: Grok threaded through the intro, the config-dir bullet, and the
multi-agent image line (which wrongly said "four CLIs" and dropped sandy-grok);
"Claude commands" -> "Claude settings/hooks" (commands are a WRITABLE overlay);
the --attach "5 = attach failed" note corrected (5 is a --stop code, unreachable
on --attach); channel pane routing 0|1|2 -> 0|1|2|3; the handoff section
reworked to say the dirs are created every launch (1.7.0) and the flag/marker
gate the MOUNT, naming the .handoff-enabled operator marker.
Security docs — the credential-design trio still read as if #129/#130 never
shipped (found by a focused audit against CLAUDE.md + the shipped code):
- CREDENTIAL_BROKER_EVALUATION.md: a "Since this was written (1.9.0)" note —
SANDY_SUSPICIOUS shipped the strip slice of A1, cred_mode is the marker the
section anticipated — and the default-mount claim qualified to "by default"
(the stale sandy:8003 line-ref dropped). The A1/A2/A3 analysis is left intact;
#121 (full host-side broker) is genuinely still open.
- nono-roadmap.md: Phase 1 A1 marked partially-shipped; the "provably via the
session marker" success criterion is now met by cred_mode.
- nono-comparison.md: "only evaluated" softened, the credentials table row
qualified, the A1 issue pointer refreshed to #130/#121.
- THREAT_MODEL.md (from the prior commit on this branch): the R2c closed
residual for connector ambient-authority, the R3 refresh-token lever, the
layer table, and the roadmap.
Left deliberately untouched as correctly-frozen point-in-time records:
ISOLATION_STRESS.md (2026-04, the "before" snapshot that motivated the fixes),
SECURITY_REVIEW_2026-07.md (scoped to 1.3->1.4), and the rc1 Linux stress
prompt (never run; its iptables-era framing predates the egress-proxy default,
flagged for refresh only if Linux stress-testing is revived).
Prose only; no code or test change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
rappdw
force-pushed
the
docs/credential-blast-radius
branch
from
August 31, 2026 20:04
a8f3576 to
1ac79e1
Compare
rappdw
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The docs had fallen three releases behind (1.8.0/1.8.1/1.9.0). This brings the user-facing and security docs current.
SPECIFICATION.md/SPEC_INTROSPECTION.mdstay current via their own regen gates and are untouched.README
env-var table — added 10 missing keys:
SANDY_CLAUDE_CONNECTORS,SANDY_SUSPICIOUS(1.9.0 credential work), the Grok trio (XAI_API_KEY/GROK_MODEL/SANDY_GROK_AUTH),SANDY_TEAMMATE_MODE,SANDY_EGRESS_LOG,SANDY_TOOL_AUDIT,SANDY_HANDOFF_DIRS,SANDY_VERBOSE,SANDY_HOST_ID,GOOGLE_API_KEY,SANDY_AGENT_ARGS.Flags table — added
--remove-sandbox,--provision,--doctor,--gc, the introspection trio, and the--start6/7/8 exit-code contract.prose fixes (from a scoped audit):
sandy-grok..claude/commands/is a writable overlay, not read-only).--attach"5 = attach failed" corrected —5is a--stopcode, unreachable on--attach.0|1|2→0|1|2|3..handoff-enabledoperator marker is named.Security docs
The credential-design trio still read as if #129/#130 never shipped:
SANDY_SUSPICIOUSshipped the strip slice of A1;cred_modeis the marker the section anticipated) + default-mount claim qualified. A1/A2/A3 analysis left intact — Adopt nono's phantom-token credential-proxy pattern for Phase-1 broker-not-mount #121 is genuinely still open.Left frozen (correctly point-in-time)
ISOLATION_STRESS.md(2026-04 "before" snapshot),SECURITY_REVIEW_2026-07.md(scoped 1.3→1.4), and the rc1 Linux stress prompt (never run) — a dated record shouldn't be rewritten to look current.Prose only; no code or test change.