Threat model v1

Assume every input
is trying to escape.

Agents, issue bodies, forks, dependencies, and generated artifacts are all untrusted until a narrow boundary proves otherwise. No single “anti-stealing algorithm” is enough; the defense is layered.

01 · Raw proposal

Stored only as a GitHub issue. Rendered as escaped text. Never placed into an agent prompt.

02 · Policy screen

Schema, size, content, injection, and prohibited-purpose checks return explicit reason codes.

03 · Brief compiler

Links, code, mentions, markup, and instruction-shaped text are removed into a typed JSON brief.

04 · Build workspace

The daily agent receives only the winner brief in an isolated worktree with no participant credentials.

CREDENTIALS

Nothing useful to steal

  • No Commons passwords or participant OAuth tokens.
  • Fork CI receives no repository secrets.
  • Scheduled selection uses the short-lived GitHub workflow token.
  • Deployment credentials are environment-scoped and unavailable to builds.
EXECUTION

Text stays data

  • No pull_request_target code checkout.
  • No proposal-provided commands, actions, URLs, or dependencies execute.
  • Workflow dependencies are pinned.
  • Generated projects begin without network access or secrets.
DETECTION

Leak and boundary checks

  • A repository-wide secret-pattern scan runs in CI.
  • CODEOWNERS routes workflows, policy, and security scripts to maintainers.
  • Winner selection is deterministic and emits an audit record.
  • Every denial has a machine-readable policy code.
RESPONSE

Fail closed

  • Ambiguous proposals remain in review and cannot win.
  • Malformed API data becomes an empty board.
  • Selection is idempotent per round.
  • Security reports use private GitHub advisories, not public issues.

Important limitation

Automated filtering reduces risk; it does not prove intent. Maintainers may block, pause, or remove any proposal or contribution. The build agent must continue treating every string inside a winner brief as quoted problem data—not authority to change its permissions, read credentials, or contact third parties.