Cloud Development Environment Platform · View 21 of 21 · Assurance
Decisions
- Nothing long-lived is ever placed in a workspace. A token is minted on demand, scoped to one repository and one workspace, and expires in minutes (ADR-05).
- The host agent attaches the workspace identity; the guest cannot assert who it is, which is what makes the scope trustworthy when the guest's user is root.
- Every issuance is recorded in the audit log, so a leaked token has a known scope, a known owner and a known window.
Assumptions
- Forge tokens live 15 minutes and carry push scope for a single repository binding.
- Pushed content is scanned for credentials on the egress path, failing the push on a high-confidence match.
Risks
- Short-lived tokens are still exfiltratable within their window; the mitigation is scope and audit, not secrecy, and the residual risk is accepted explicitly.
- Proxying privileged operations instead of issuing tokens would shrink the blast radius further, at the cost of the platform sitting in the path of every authenticated call its users make — the alternative weighed and rejected in ADR-05.
