Boomship can act. So control matters.

Every run has a scope.

A scope is a permission, set for one run from the composer’s scope chip. Shipping, which means branch, commit, push and opening a pull request, is off unless you allow it for that run. The budget is a hard stop: tokens, cost and minutes are charged on every model turn, and when a limit is reached the run stops and the receipt says which limit stopped it.

Before a run starts, the capability gate reads the goal. If it asks for something this release cannot do (images, video, sending email or messages, calls) the composer says so in one sentence, with what Enter will do instead. It never pretends.

Your keys stay yours.

A provider key you paste is encrypted with AES-256-GCM before it is stored, and only its last four characters are shown again, in Settings → Intelligence. Your provider bills you directly; Boomship’s subscription is flat and separate.

Managed keys, where a deployment has them, never reach the app server. They are Edge Function secrets, and the model relay adds them to the call. The app only learns whether a provider is available.

No key, no secrets.

ENCRYPTION_KEY is required everywhere except NODE_ENV=development. Without it, the routes that would store a key answer 503 “encryption not configured” and store nothing. The web app and the worker share the same key, so a value saved through one decrypts on the other.

Tools declare what they may do.

Every connector declares its capabilities in the registry, and this table is read from it. A capability is absent when no code does it; nothing claims trigger yet. Airtable is the one connector that writes, and only to the tables you allow on the Connections page; each update is a step on the run.

GitHub: runs commit only to boomship/<name> branches and open pull requests only into the base branch. On a host with no shell, the GitHub runner edits through the API and refuses exec, so tests stay “not run” on the receipt rather than being guessed.

It waits for a person.

A chain runs in order. When a run does not meet its condition, everything behind it is blocked and says why, until a person looks. One switch pauses everything automatic: the dispatcher holds ready runs, and webhook triggers answer 423 until it is turned back on.

A steer sent while a run works is a step on its own ledger: received at the next turn, with that turn written on the step. A steer the run never read is closed as skipped, never dropped silently. A webhook delivery is accepted only with a valid signature over the timestamp and body, inside a five-minute window, and its text reaches the builder labelled as untrusted input.

Every check is named.

A Work Receipt ends every run: files changed, what was inspected, each check’s state, the reviewers’ findings, cost and duration. A check that did not run is written as not run, never left out, and confidence is rated from what ran. The receipt is written by the verification stage, which collects the diff itself and does not trust the builder’s summary.

Every tool call leaves a hash.

Each step on a run’s ledger records which tool ran, a hash of what went in and what came out, and whether the result was observed (a real command, file or model result) or only asserted by the model.

After a run ends, outcomes are appended by the action that caused them, never inferred: you undid it, a later Prove it confirmed or contradicted it, a later graph run resumed it.

Rows belong to the project.

What the Brain indexes, remembers and runs is stored as rows that belong to a project. Row-level security reads membership through functions in an unexposed schema (private.user_project_ids() and its organization twins), so no policy selects from its own table and no member sees another project’s rows.

What reaches a model is the compiled context for that run. The Context card shows every item in it with the reason it was included, which memories the compiler doubted, and what the goal named that the index does not know.

Commands run in a container.

With the Docker runner, each project gets its own long-lived container on a bind mount of its workspace. The network is off unless RUNNER_NETWORK=1; every capability is dropped and no new privileges can be gained; every path is resolved inside the workspace; binaries are allowlisted and nothing runs through a shell.

The repository is fetched with host-side git into a private bare mirror, so the GitHub token never enters the workspace or the container. The workspace takes commits from that mirror, and push and pull request go back through it. A .git whose configuration could run a program (hooks, fsmonitor, filters, includes and the like) is refused.

Someone tries to break it.

At high and critical risk an adversarial security review reads the diff as an attacker would: authorisation bypass, row-level-security gaps, injection, SSRF, secrets logged or committed, webhooks without signature checks. Its verdict is fail when any critical or high finding exists. The reviewer is a model that did not build the change, whenever another is eligible.

Before any commit, the staged diff is scanned for credentials: known token formats, private keys, connection strings with passwords, and secret-named values with high entropy. A finding unstages everything and refuses the commit, with the value masked; a push scans each commit the same way.