Enforce cloud computer identity, secret, egress, and residue isolation #10

Project

Cloud computer platform

Source: Cloud computer scale architecture audit

Outcome

Define and enforce one cross-provider security contract for cloud computers. A runtime must receive only the capabilities for one owner, workspace, lease, command, and generation, and it must produce verifiable zero-residue evidence before capacity returns to service.

Threats

• Guest-to-host or sandbox-to-node escape.
• Cross-tenant filesystem, process, network, checkpoint, event, or credential access.
• Google metadata or service-account credential theft.
• Confused-deputy provider routing and stale-generation mutation.
• Unauthorized package, source control, model, or arbitrary network egress.
• Secret capture in checkpoints, logs, command output, crash data, or warm runtimes.
• Cleanup failure followed by unsafe capacity reuse.
• Control-plane credentials or topology entering agent-visible payloads.

Scope

• Mint short-lived, capability-scoped, generation-bound runtime credentials and remove bootstrap secrets after reverse-dial connection.
• Give guests no ambient Google service account, token scope, project SSH key, or provider administration handle.
• Block the metadata service and default-deny ingress and egress.
• Route admitted source control, package, model, artifact, and control traffic through an observable policy broker.
• Encrypt checkpoints with workspace-scoped keys and exclude runtime credentials and transient state.
• Separate runtime hosts and clusters from Phoenix, PostgreSQL, control credentials, and customer-connected-computer controllers.
• Enforce owner, tenant, workspace, path, symlink, process, artifact, output, and byte boundaries below every adapter.
• Produce cleanup evidence for processes, mounts, overlays, devices, network rules, cgroups, credentials, scratch data, and checkpoints.
• Quarantine a lease, sandbox, or host when cleanup cannot prove zero residue.
• Redact raw provider payloads, private paths, addresses, tokens, and topology from logs, events, issues, and receipts.

Deliverables

• Cross-provider threat model and security profile.
• Runtime credential broker and rotation or revocation path.
• Network and metadata policy broker.
• Checkpoint key and redaction policy.
• Cleanup proof and quarantine state machine.
• Cross-tenant, escape, exhaustion, revocation, egress, secret-leak, and residue tests.

Acceptance criteria

• A compromised runtime cannot obtain host or Google credentials or affect another tenant.
• Revocation blocks new effects immediately and limits an in-flight command to its safest bounded checkpoint.
• Unauthorized egress fails with a typed policy result and an operator-visible receipt.
• No secret appears in a checkpoint, retained event, artifact metadata, public error, or warm runtime.
• Failed cleanup prevents capacity reuse and opens an incident with bounded public-safe evidence.
• Every accepted provider passes the same security corpus before production routing can select it.

Dependencies

Builds on #3 and supplies a required gate for every provider issue.