Know what jobs can see

Local control

The daemon listens on Unix-domain sockets only. The sockets use owner-only permissions, and contd does not open a TCP listener by default.

Cancellation is durable and idempotent, but it is local to the submitted workspace. It is not a distributed control plane.

Git credentials

Git sources can use the local SSH agent or standard private key files in ~/.ssh. Host keys are checked against known-hosts data. The current Git adapter accepts a changed host key, so verify the remote identity before using a source.

contd uses local Git authentication only while resolving a source. It does not copy credentials into containers or AI workspaces. Credential-bearing URL parts are redacted in saved metadata.

Container jobs

Container jobs run the configured image and scripts with the requested user, environment, working directory, and repository snapshot. The current runtime requests privileged containers. Treat images, scripts, and cloned code as trusted inputs.

Containers are removed after execution. Logs, artifacts, events, and metadata are retained separately.

AI jobs

An AI job receives only configured source snapshots, dependency artifacts, logs, metadata, and directories for declared outputs.

The provider can read through read_file, list_paths, and search_text. It can write only through write_output to a declared path. Shell, filesystem, Git, deployment, and agent tools are disabled.

The current source omits common credential files, SSH keys, dependency directories, virtual environments, .env files other than .env.example, and private-key file extensions. See AI jobs for the exact path rules.

Redaction

Before durable storage, contd redacts values associated with password, secret, token, API key, private key, credential, and authorization names. It also redacts passwords in URLs and sensitive key-value output.

Redaction applies to environments, logs, failure messages, source metadata, reproducibility records, and AI responses. Do not print secrets in scripts or command output.

Retained data

Run records retain configuration digests, source and image identifiers, effective environment after redaction, lifecycle events, logs, artifact references, and reproducibility policy values. AI executions also retain an input manifest and structured analysis report.

The AI input manifest records names, paths, checksums, sizes, revisions, unavailable inputs, output declarations, and cleanup status. It does not retain source contents or credentials.