security & trust

The runner may propose.Only a human may authorize.

Aegis separates execution, review, and repository write-back into distinct boundaries. That separation is what keeps an AI-produced patch from becoming an autonomous repository change.

Approval is an authority boundary

A fix runner may claim work and submit proposed files. It cannot write them to a repository. Every repository change requires human approval before Aegis creates a write-back job.

Evidence keeps its label

Aegis derives evidence completeness but does not upgrade a runner claim into a platform guarantee. Current evidence is displayed as self-attested, with its submitted reproduction and regression summaries.

Source stays outside the control plane

Client source is checked out on an isolated, Truemark-operated per-client runner. The Aegis application and database hold findings and proposed diffs, not the source repository.

Credentials stay scoped to their job

CI uploads use a per-repository token. The runner uses client-provided git and model credentials. Aegis does not turn an upload token into read or write access.

three explicit boundaries

A plain answer to “where can code change?”

Source custody, patch review, and repository authority are deliberately separate. No single runner claim crosses all three.

boundary 1

Aegis control plane

shared application boundary

  • Repository and pull-request metadata
  • Coverage, duplication, dependency, and analysis results
  • Proposed patch files and submitted evidence
  • Run cost, approval, PR/MR, merge, and revert records

boundary 2

Per-client runner

isolated execution boundary

  • A real source checkout for the assigned repository
  • Client-provided git and model credentials
  • The local worktree used to produce a proposed patch
  • No authority to write the proposed patch back

boundary 3

Human write-back gate

repository authority boundary

  • Reviewer sees the proposed files before approval
  • Evidence origin and completeness remain visible
  • Approval creates a separate write-back job
  • Aegis opens or updates a branch or PR/MR; it does not merge it

Control stays reversible

Rotate a repository upload token without changing account access. Disconnect a repository to stop new processing. Revoke the OAuth grant from GitHub or GitLab to remove provider access at its source. Aegis also keeps later reverts attached to the original fix record instead of erasing an inconvenient outcome.

Security questions? security@aegis.dev