Security model

Greenroom walks pre-production builds with an autonomous agent, so the security model is conservative by construction. These are the boundaries, each enforced by mechanism rather than promise.

Your repository is read-only

The GitHub App requests read access and the ability to post checks and comments. It cannot push, cannot open branches, and cannot modify anything in your repository. There is no configuration that grants Greenroom write access to code.

Your build runs without our credentials

The CI split keeps your project's toolchain (which executes arbitrary project code) in a job that holds no secrets, and Greenroom's identity in a job that never runs your build system. The only credential in the greenroom job is a short-lived OIDC token bound to the exact workflow revision that requested it.

PRs cannot rewrite their own policy

The environment manifest and state contract are read from the PR's base revision. A pull request that edits the allowlist, the oracles, or the isolation attestation still runs under the policy that was reviewed and merged before it existed. Policy changes take effect only after they merge through your normal review.

The walk is contained

• Web: the browser enforces the host allowlist in-line. A request to an unlisted host is contained and ends the walk with the violation recorded.
• iOS: the build is attested to reach only a sandboxed backend (or an external proxy enforces the allowlist), and the walk's evidence records every network event for audit.
• The manifest attests the environment is isolated (isolated: true is the only accepted value) and rejects any host appearing as both allowed and production.
• Purchases and account creation are refused by the driver unless a goal explicitly grants them, and sandboxPurchases declares whether purchase flows hit a sandbox.

Runs fail closed

Anything the run cannot verify, reach, or complete becomes an explicit blocked or inconclusive outcome with the cause recorded. Infrastructure failure is never reported as app health, and a goal is never silently dropped from a handoff.

Evidence over trust

Every claim in a handoff links to captured evidence, and run provenance records the exact SHAs, policy hashes, and model routes involved. You never have to take a verdict on faith; the proof ships with the report.