feat(runtime): harden project file and capability boundaries

Make uploaded files visible and reusable through slash commands.
Replace shared internal secrets with scoped service bindings and opaque
run capabilities. Remove replay and audit-archive machinery, and derive
preview configuration from deployment identity.

Author: iamjr15

.env.example

@@ -14,12 +14,11 @@ CLERK_SECRET_KEY=sk_test_replace_me
 # Optional only when receiving Clerk webhooks in local development.
 CLERK_WEBHOOK_SIGNING_SECRET=
 
-# Local web routing. The real preview-proxy Worker is service-bound behind the
+# Browser-visible local routing configuration; these values are not secrets.
+# The real preview-proxy Worker is service-bound behind the
 # gateway and serves each sandbox on *.localhost:8787. No second preview domain
 # or cloud development deployment is required.
 NEXT_PUBLIC_GATEWAY_URL=http://127.0.0.1:8787
-NEXT_PUBLIC_PREVIEW_HOSTNAME=localhost
-NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA=development
 
 # Daytona development access.
 DAYTONA_API_KEY=
@@ -55,9 +54,4 @@ POLAR_PRODUCT_ID_MAX=
 DATABASE_CONTEXT_SIGNING_SECRET_AGENT=replace_with_a_distinct_32_byte_secret
 DATABASE_CONTEXT_SIGNING_SECRET_GATEWAY=replace_with_a_distinct_32_byte_secret
 DATABASE_CONTEXT_SIGNING_SECRET_WEBHOOKS=replace_with_a_distinct_32_byte_secret
-GATEWAY_TO_WEBHOOKS_RESOURCE_DELETION_SECRET=replace_with_a_distinct_32_byte_secret
-WEBHOOKS_TO_AGENT_LIFECYCLE_SECRET=replace_with_a_distinct_32_byte_secret
-INTERNAL_WEBHOOK_REPLAY_SECRET=replace_with_a_distinct_32_byte_secret
 OUTPUT_DOWNLOAD_SIGNING_SECRET=replace_with_a_distinct_32_byte_secret
-SKILL_RUNTIME_BASE_URL=https://gateway.trycheatcode.com/skill-runtime
-SKILL_RUNTIME_TOKEN_SECRET=replace_with_a_distinct_32_byte_secret

.github/workflows/audit-archive.yml

@@ -226,10 +226,7 @@ jobs:
           CLERK_SECRET_KEY: sk_test_static_checks_do_not_authenticate
           NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: pk_test_c3RhdGljLWNoZWNrcy0wMC5jbGVyay5hY2NvdW50cy5kZXYk
           NEXT_PUBLIC_GATEWAY_URL: ${{ vars.NEXT_PUBLIC_GATEWAY_URL }}
-          NEXT_PUBLIC_PREVIEW_HOSTNAME: trycheatcode.com
-          NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA: ${{ github.sha }}
-          TURBO_TEAM: cheatcode
-          TURBO_TOKEN: ${{ github.event_name == 'push' && secrets.TURBO_TOKEN || '' }}
+          VERCEL_GIT_COMMIT_SHA: ${{ github.sha }}
         run: |
           set -Eeuo pipefail
           filters=()

.github/workflows/static-checks.yml

@@ -51,7 +51,7 @@ packages/                Shared libraries
 
 skills/                  8 curated Anthropic SKILL.md skills
 infra/                   Wrangler configs, Supabase migrations, Daytona sandbox Dockerfile
-scripts/                 Operational helpers only: build skills, local startup, deploy orchestration, migrations, audit archive
+scripts/                 Operational helpers only: build skills, local startup, deploy orchestration, migrations
 ```
 
 ## Build
@@ -82,7 +82,7 @@ part of the V2 command surface, and source-level `*.test.ts` files are
 intentionally absent. Do not generate temporary validation scripts either;
 operate the UI directly and check logs, and remove any throwaway product QA
 script that appears in the V2 tree. Operational scripts may exist only for
-build, migration, audit retention, and local-stack configuration; they are not
+build, migration, and local-stack configuration; they are not
 product tests and must not simulate UI/user flows. Do not create temporary
 testing scripts in `scripts/`, package folders, `/tmp`, or any out-of-tree
 location.
@@ -156,15 +156,10 @@ COMPOSIO_API_KEY=
 COMPOSIO_AUTH_CONFIGS={"github":"ac_...","gmail":"ac_...","slack":"ac_...","notion":"ac_...","linear":"ac_..."}
 COMPOSIO_WEBHOOK_SECRET=
 
-# Internal ops alerts
-INTERNAL_ALERT_WEBHOOK_SECRET=
+# Signed output capability
+OUTPUT_DOWNLOAD_SIGNING_SECRET=
 
-# Capability-scoped ccm2 contracts (three distinct secrets, each at least 32 bytes)
-GATEWAY_TO_WEBHOOKS_RESOURCE_DELETION_SECRET=
-WEBHOOKS_TO_AGENT_LIFECYCLE_SECRET=
-INTERNAL_WEBHOOK_REPLAY_SECRET=
-
-# Gateway
+# Browser-visible local routing configuration (not secrets)
 NEXT_PUBLIC_GATEWAY_URL=http://127.0.0.1:8787
 ```
 

AGENTS.md

@@ -85,7 +85,6 @@ pnpm turbo db:generate                # Generate Drizzle types from schema
 pnpm turbo lint                       # Biome check (fails on warnings in CI)
 pnpm turbo typecheck                  # tsc --noEmit across all packages
 pnpm turbo build                      # Production build
-pnpm audit:archive -- --dry-run       # Admin-only audit partition archive plan
 pnpm --filter @cheatcode/db db:generate  # Create new migration
 ```
 

CLAUDE.md

@@ -79,18 +79,17 @@ Fill every required value in `.env.local`. Keep the following boundaries:
 - Each signing secret group in `.env.example` must contain non-placeholder
   values of at least 32 UTF-8 bytes. Secrets within a group must be distinct.
   The startup runner checks these requirements before launching a Worker.
-- Keep `NEXT_PUBLIC_GATEWAY_URL=http://127.0.0.1:8787`,
-  `NEXT_PUBLIC_PREVIEW_HOSTNAME=localhost`, and
-  `NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA=development` for the standard local
-  topology.
+- Keep `NEXT_PUBLIC_GATEWAY_URL=http://127.0.0.1:8787` for the standard local
+  topology. The web app derives `localhost` previews locally and the owned
+  `trycheatcode.com` preview apex in Vercel. Release identity is derived
+  automatically from Git in deployments and uses `development` locally.
 - `COMPOSIO_API_KEY`, `COMPOSIO_AUTH_CONFIGS`, and
   `COMPOSIO_WEBHOOK_SECRET` are required for connected-tool flows.
   `COMPOSIO_AUTH_CONFIGS` is the JSON object that maps each supported toolkit
   name to its Composio auth-config ID.
 - `DEEPSEEK_PLATFORM_API_KEY` is optional because users may rely entirely on
-  BYOK. `DAYTONA_ORG_ID`, Clerk webhook verification, and internal alert
-  delivery are optional only when the corresponding account or callback flow
-  is not being exercised.
+  BYOK. `DAYTONA_ORG_ID` and Clerk webhook verification are optional only when
+  the corresponding account or callback flow is not being exercised.
 
 Do not copy `.env.production` into `.env.local`. Do not put database migration
 credentials in this file; authorized operators keep those only in the ignored
@@ -261,11 +260,5 @@ Review the emitted immutable snapshot name and commit it in the agent Worker
 configuration. Production Daytona credentials and snapshot publication remain
 inside that workflow.
 
-Audit retention uses the separate protected `Audit Archive` workflow because it
-performs destructive database and R2 maintenance. It accepts exact plan/apply
-confirmation, verifies the pinned production database identity, and uses a
-dedicated bucket-scoped Cloudflare token. Production audit archival must not run
-from a laptop.
-
 The repository contains only the active V2 implementation. The legacy V1 source
 tree was permanently removed on July 13, 2026 after explicit user authorization.

README.md

@@ -215,12 +215,14 @@ run before sandbox deletion, while the sandbox fence drains RPCs admitted by the
 After eviction, a deleted or missing Postgres user cannot register the empty object again, so a
 late request cannot resurrect Daytona or durable state. Per-project workspace tombstones remain
 durable for active accounts in one `STRICT` table whose checks bind each canonical slug to its
-project UUID and enforce ordered millisecond timestamps. Every destructive maintenance request uses
-the isolated `ccm2` agent-lifecycle capability and the exact `agent.internal` host. Before any
-Durable Object or Daytona mutation, the Worker validates the account deletion fence or exact
-project/thread soft-delete generation and verifies that every requested run belongs to that
-scope. The 30-second signature window is therefore safe to retry and cannot authorize stale or
-cross-tenant destruction; no shared key or legacy signature fallback exists.
+project UUID and enforce ordered millisecond timestamps. Before any Durable
+Object or Daytona mutation, the Worker validates the account deletion fence or
+exact project/thread soft-delete generation and verifies that every requested
+run belongs to that scope. The operation is not an HTTP route: webhooks holds the
+named `AgentLifecycleEntrypoint` Service Binding, and Cloudflare-authenticated
+binding properties pin the `webhooks` caller and `agent-lifecycle` capability.
+The gateway's default agent binding cannot invoke this entrypoint, and no shared
+application secret is required.
 
 Every ProjectSandbox uses the one configured immutable Daytona snapshot and the
 one configured shared workspace volume. Existing sandbox identity is accepted
@@ -243,6 +245,7 @@ the same bound while streaming.
 ## Public exports
 
 - `agentApp`
+- `AgentLifecycleEntrypoint`
 - `AgentRun`
 - `AgentRunWorkflow`
 - `ProjectSandbox`
@@ -274,11 +277,18 @@ pnpm --filter @cheatcode/agent-worker typecheck
 - `DEEPSEEK_PLATFORM_API_KEY`
 - `OUTPUT_DOWNLOAD_SIGNING_SECRET` (Secrets Store binding)
 - `OUTPUT_DOWNLOAD_BASE_URL`
-- `WEBHOOKS_TO_AGENT_LIFECYCLE_SECRET` (ccm2 `agent-lifecycle` capability shared
-  only with the webhooks caller)
 - `PREVIEW_HOSTNAME`
 - `QUOTA_TRACKER`
 - `R2_AUDIT`
 - `R2_OUTPUTS`
 - `SANDBOX_STATE`
 - `USER_EVENTS`, `AGENT_METRICS`, `ERROR_EVENTS`, `PERFORMANCE_METRICS`
+
+Sandbox skills call the fixed public
+`https://gateway.trycheatcode.com/skill-runtime` surface. The tenant-scoped
+`v2_agent_runs` row stores only digests for independently scoped 15-minute
+opaque capabilities, allowing local and production Workers to authorize the
+same sandbox callback safely. The agent rotates the projected sandbox
+configuration every 10 minutes and clears every capability at the terminal run
+transition. No deployment-wide skill-runtime signing secret or configurable
+backend URL exists.