Skip to content

Separate Protected Runtime Inputs from Retained Workload Evidence

Status

Accepted: A declared protected runtime destination cannot overlap a retained workload evidence path.

Context

An immutable workload can require controller-supplied runtime files such as an encrypted variable file or a credential reference. Those files are staged inside the checkout for execution. The same workload declares result paths that HybridOps archives and retains outside disposable compute.

Independent declarations can otherwise select the same path or an enclosing directory. The retention step could then include a protected runtime file in the evidence bundle even though the file was excluded from the execution manifest and task output.

Decision

Runtime-file destinations and evidence paths must be canonical paths relative to the workload checkout. Before the checkout is materialised, HybridOps compares every pinned_workload_runtime_files[].dest with every pinned_workload_evidence_paths[] entry.

Validation rejects an exact match and either parent-child relationship. The materialised checkout is also checked for symbolic-link indirection before runtime files are staged and before evidence is retained. A valid declaration therefore cannot direct the HybridOps retention mechanism to archive a declared protected runtime destination.

The pinned revision remains responsible for the data it writes to result files or standard output. This decision governs the declared staging and retention paths rather than attempting content-flow analysis inside the workload.

Consequences

Positive

  • Protected runtime destinations cannot be selected directly or through an enclosing or symbolic-link evidence path.
  • Invalid declarations fail before the managed checkout is changed.
  • Evidence archives retain workload results without retaining declared runtime inputs through path overlap.

Negative

  • A workload must use separate paths for runtime inputs and retained results.
  • Existing declarations with overlapping paths must be corrected before the workload can run.
  • Workload output still requires the normal secret-handling discipline.

Alternatives considered

  • Rely on operator review: rejected because the unsafe relationship is deterministic and can be validated before execution.
  • Remove protected files after execution: rejected because an ongoing workload can still require them after its entry point returns.
  • Scan retained files for secret content: rejected because transformed or derived content cannot be identified reliably by generic byte matching.

References