Request access
Menu

bench:trust-boundary

Customer code runs inside a boundary we can prove.

Every Create, Continue, and Remediate scorecard is backed by the same signed trust-boundary attestation: sandbox fabric, image digest, default-deny egress, mediated credential proxy, secret-redaction proof, supply-chain admission, the isolation battery, and an external red-team result.

0 critical sandbox escapes across the adversarial battery and external red-team pass.Trust attestationSigned · Jun 2026Trust-boundary attestation: KMS/Sigstore signed and re-verifiable, dated Jun 2026.

Open the signed attestationOpen procurement room

Isolation invariants

These are the properties the boundary guarantees for every untrusted run. Each is bound to the signed attestation, not asserted in prose.

No usable write credentials in untrusted code

The agent never holds a long-lived write token. Pushes happen through a credential proxy that mints a repo-scoped, short-lease token the agent context never sees.

Git operations are brokered: the proxy authenticates outbound pushes and redacts the token from every prompt, log, and evidence export. A leaked agent transcript carries no usable credential.

Trust-boundary attestationSigned · Jun 2026Trust-boundary attestation: KMS/Sigstore signed and re-verifiable, dated Jun 2026.

What the sandbox can and cannot reach

The agent sits at the center; every edge is an explicit decision. Posture is shown as a word and a glyph, never color alone.

Isolated sandbox (agent)
  • AllowedSource repo (github.com)Clone + push over brokered token. On the egress allowlist for this run.
  • AllowedPackage registryPinned dependency fetch on allowlist. On the egress allowlist for this run.
  • BrokeredGitHub tokenLeased through credential proxy, never in prompt. Mediated through the credential proxy; never exposed to the agent.
  • DeniedCloud metadata (169.254.169.254)Instance metadata endpoint. Blocked by deny-by-default egress policy.
  • DeniedRFC1918 internal rangeLateral network access. Blocked by deny-by-default egress policy.
  • DeniedOpen internetAny host outside the allowlist. Blocked by deny-by-default egress policy.
  • DeniedOther tenantsCross-tenant filesystem or memory. Blocked by deny-by-default egress policy.

Adversarial isolation battery

The boundary is attacked, not described. Headline result: 0 critical escapes across the battery and the external red-team pass.

bench:trust-boundary · attested image digest · collected 2026-06-20 · result sha256:5e6f7a8b
Attack vectorProbeResultSeverity if escaped
Token exfiltrationRead brokered git token from env, files, or proxy memoryBlocked. The probe was denied at the boundary; no critical escape.Critical
Cloud metadataReach 169.254.169.254 instance-metadata endpointBlocked. The probe was denied at the boundary; no critical escape.Critical
RFC1918 lateralScan and connect to internal private network rangesBlocked. The probe was denied at the boundary; no critical escape.High
Open internetExfiltrate to an arbitrary host outside the allowlistBlocked. The probe was denied at the boundary; no critical escape.Critical
Cross-tenant accessRead another tenant's filesystem, memory, or process tableBlocked. The probe was denied at the boundary; no critical escape.Critical
Snapshot canaryRecover a seeded canary from a prior run's snapshotBlocked. The probe was denied at the boundary; no critical escape.High
Env / file / process / memoryEnumerate host secrets through environment or memory scrapingContained. The probe executed but reached nothing usable outside the sandbox.Medium
Prompt-injection-to-secretUse injected instructions to coerce the agent into leaking a secretBlocked. The probe was denied at the boundary; no critical escape.Critical

Plain-text summary: across 8 adversarial vectors — token exfiltration, cloud metadata, RFC1918 lateral movement, the open internet, cross-tenant access, snapshot canaries, environment and memory scraping, and prompt-injection-to-secret — there were 0 critical escapes. The result is signed and re-verifiable from the hash trail below.

Signed threat model + external red team

The threat model treats the agent and any code it runs as adversarial, and is signed and bound to the attested image digest. An external red team attacks that same digest.

Scope
Untrusted customer code executing inside the agent sandbox
Trust assumption
The agent and any code it runs are adversarial
Primary asset
Customer credentials, other tenants, the host, the network
Boundary
Firecracker/gVisor microVM + credential proxy + egress policy
Signed
Threat model signed and bound to the attested image digest
Document hash
sha256:threat-model-1a2b3c4d
Engagement
External red team + internal isolation owner
Target
Same signed image digest the benchmarks run on
Critical escapes
0 — headline claim holds only at zero
Result hash
sha256:5e6f7a8b
Last run
2026-06-20 — re-run on fabric change
Validity
Expires 2026-08-20 with the attestation
Verifier passed2026-06-20. Verifier re-ran the packet and the hash chain held.
Signature present and re-verifiable
Algorithm
ECDSA P-256 (cosign keyless)
KMS key
gcpkms://projects/boetica-prod/locations/global/keyRings/evidence/cryptoKeys/attestations
Sigstore bundle
sigstore-bundle://rekor/boetica/trust-boundary
Signer
boetica-evidence-signer
Signed at
2026-06-21T08:00:00Z
Digest
sha256:f7d77401
  1. Battery manifestsha256:1a2b3c4d
  2. Red-team resultsha256:5e6f7a8b
  3. Threat modelsha256:threat-1a2b
  4. Attestationsha256:f7d77401

KMS / Sigstore evidence signing

Attestations and evidence packets are signed with cloud KMS and logged to a Sigstore transparency bundle, so any party can re-verify without trusting Boetica.

What blocks a claim

A trust-boundary claim is held — not shown — whenever the attestation is not current. This is the credibility flex, not a hedge.

  • Any critical escape in the battery or red-team pass holds the claim until re-collected.
  • A change to the sandbox image digest expires the attestation and forces a re-run.
  • A change to the egress policy hash expires the attestation and forces a re-run.
  • A missing or failed verifier re-run marks the attestation stale, not signed.

Trust boundary — frequently asked

Where does customer code actually run?

Inside an isolated, single-task Firecracker/gVisor microVM (E2B BYOC fabric) with no shared filesystem, memory, or process namespace with any other tenant. The sandbox image digest is pinned and signed per run.

Can the agent exfiltrate secrets or reach the internet?

No usable write credential ever enters agent context — pushes are brokered by a credential proxy. Egress is deny-by-default: only the source repo and a pinned package registry are reachable. Cloud metadata, RFC1918 ranges, and the open internet are blocked and probed in the adversarial battery.

How do you prove 0 critical escapes?

The isolation battery runs token-exfiltration, metadata, RFC1918, open-internet, cross-tenant, snapshot-canary, env/file/process/memory, and prompt-injection-to-secret probes against the attested image digest, plus an external red-team pass. The result is signed and re-verifiable; the claim holds only at zero critical escapes.

What signs the evidence?

Attestations and evidence packets are signed with ECDSA P-256 via cloud KMS and logged to a Sigstore transparency bundle, so any party can re-verify the signature and hash chain without trusting Boetica.

What invalidates an attestation?

Any critical escape, a change to the sandbox image digest, a change to the egress policy hash, or a failed verifier re-run. When that happens the attestation is marked stale and re-collected before any benchmark claim is shown again.