Egress Is a Fence. Child Env Is a Constructor.

One HTTP Factory

Core has one HTTP client factory. Hosts not in the operator's egress fence and not a declared leg endpoint are refused. Children's egress is observed, not wished. A factory that 'trusts localhost' while a sibling listens there would consult the family by accident. The fence is the same idea as the cleanroom: independence is an allowlist, not an essay.

A declared credential is its owner's capability, never ambient authority. Boot declares surviving names to the secret layer. The one way a model-visible child gets an environment is the child-env constructor — bash, background jobs, MCP servers, gateway session children. An MCP server receives its own keys and no other server's, and no leg's. Undeclared variables are left alone. This is credential isolation, not a blanket strip.

A canary key that appears in a child is a defect. Resolve every value through the scrubber. A reader that bypasses it is how a key whose shape no pattern matched lands in the record verbatim.

Auth Headers Never Enter a Body

Request wire is content-addressed without headers. Tool output passes a secret scanner; a hit stores a typed marker, never the bytes. The record is meant to be read. A readable token is a published token.

core HTTP fence ∪ declared leg endpoints child env constructor only; declared names the child owns MCP its own env keys, never a sibling's, never a leg's record names of sources, never contents; canary must be absent

Exercise

List three children that might inherit an environment: a shell, a job, an MCP server. For each, write the keys it should see if the operator declared one key for the server and one for a cloud leg.

Hint

The server sees its key. The shell sees none of the declared names unless it owns them. The leg's key never rides a child.

One HTTP Factory

Auth Headers Never Enter a Body

Code

External links

Exercise

Progress

Comments 0