Template & Library — security
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
| Service |
Auth |
Scopes |
Tenant isolation |
Max side-effect class |
| BlueprintService |
client-credentials |
factory.blueprints.read factory.blueprints.write factory.blueprints.publish |
row-filter |
publication |
| TemplateCatalogHost |
client-credentials |
factory.health.read factory.meta.read |
row-filter |
publication |
| GenerationRecipeService |
client-credentials |
factory.recipes.read factory.recipes.write factory.recipes.approve |
row-filter |
shared-write |
| TemplateRegistryService |
client-credentials |
factory.catalog.read factory.catalog.admin |
row-filter |
publication |
Principles
- Templates are supply chain. A manifest is pinned by hash at a commit read through a connector; publication is an asset release with evidence (ADR-0021); a recipe can only pin Published versions.
- Blueprints are validated input. Schema and rule validation precede anything; agent-authored blueprints carry run provenance; derived models are never hand-edited.
- Nothing here writes code. Generation is a Factory run under Run Control's gates with sandbox-class scaffolding and shared-write change proposals; this platform records what happened.
- Compatibility is evidence, not opinion. Cells without evidence are Unknown and block recipe validation unless policy allows.
- Preserved paths are sacred. The manifest's preserved paths are never overwritten by a re-scaffold; generated files carry hashes so hand edits are detectable.
Scopes and roles
| Scope |
Grants |
Roles |
factory.blueprints.read / .write / .publish |
read; create and validate; submit |
Requester, Asset maintainer (publish), agents under a run (write) |
factory.catalog.read / .admin |
read; discover and publish |
everyone; Asset maintainer, Platform admin |
factory.recipes.read / .write / .approve |
read; draft and validate; approve |
Requester, Asset maintainer; Reviewer per policy |
Threats and controls
| Threat |
Control |
| Malicious template version |
only Published versions with evidence are pinnable; discovery through connectors with receipts; manifest hash pinned; adversarial suites later |
| Poisoned blueprint document |
schema and rule validation; artifact validators; publication gate; agent-authored documents reviewed through the change proposal |
| Recipe tampering after approval |
immutable Approved recipes; a change is a new version; the run reads the approved version by id |
| Generated code overwriting hand edits |
preserved paths from the manifest; hashes per generated file; re-scaffold reports differences before proposing |
| Dependency confusion on feeds |
feeds configured per installation; package versions pinned in the recipe; matrix evidence from builds on those versions |