Repository navigation
[feat] Enforce workflow requirements and execution limits #1082
Description
Parent: #818
Goal
Check workflow requirements against member policy and driver capability before execution while keeping secrets out of leases and state.
Scope
- Add
requires,defaults,setup, workflowbudget, stepmax_turns, and workflow/steptimeout. - Add member workflow allow and concurrency settings.
- Compare requirements, member ceiling, and driver capability before leasing.
- Support v1 network, env, isolation, human, and resume capabilities.
- Resolve required env through existing TeamAI facilities and process environment in unattended CI.
- Put only key names in leases and state.
- Fail before execution when a required key is missing.
- Scan every string carried by a report and mask every known secret value before the report reaches state or records, including the local driver’s
messageand later-added fields; keep key names visible. - Prevent command inputs from shadowing required secret keys.
- Run setup before the agent in each new workspace with separate requirements.
- Enforce timeout and token budget deterministically.
- Pass
max_turnsonly when the adapter can enforce it.
Out of scope
requires.platform, remote secret transport, named remote capabilities, minimum sandbox policy, provider approvals, and OpenTelemetry.
Dependencies
- Blocked by: [feat] Add workflow workspaces, branches, and session continuation #1080
- Unblocks: #10763
Acceptance criteria
- A lease is issued only when requirements fit policy and capability.
- Secret values never appear in lease JSON, state, errors, snapshots, or records.
- Every string in a report is scanned for known secret values, including
messageand fields added later, while key names remain visible. - CI may satisfy env requirements from process environment.
- Setup credentials do not reach the agent unless separately required.
- Unsupported enforcement fails explicitly.
- Timeout and budget exhaustion settle predictably.
Verification
Focused negotiation, every-string masking, env, setup, timeout, and budget tests; build/typecheck/lint; one real-CLI safety E2E. Update bilingual workflow and environment documentation.
Activity
SaulMoro commentedon Oct 13, 2026
For masking, maybe it could cover every string a report carries rather than a list of fields? The local driver already stores the first 400 characters of stderr in
message, and #1084 publishes snapshots from that state. If everything is masked by default, a new field is covered without anyone having to remember it.hsuchifeng commentedon Oct 14, 2026
Mask every known secret value in every string carried by a report, not a fixed field list. That includes the local driver’s
message, which contains the first 400 characters of stderr, and any field added later. Key names stay visible.SaulMoro commentedon Oct 14, 2026
local-driver.tspasses the wholeprocess.envto every step, and the tool adapter in #1120 does the same. In CI, that gives the job'sGH_TOKENto every agent step, while #818 meant it to reach only the steps that list it. The driver could withhold every key declared inenv.yamlorenv/secrets.yamlthat the step does not list inrequires.env. That reuses the declarations from #875 and leavesPATH,HOMEand the other variables alone.A driver that cannot report tokens fails every workflow with a
budget, because unsupported enforcement fails explicitly. As far as I can see, T3 Code does not expose token usage today, so a T3 Code driver would hit this.SaulMoro commentedon Oct 14, 2026
A related gap on the tool side: if #1120 lands as it is, Codex and OpenCode steps report no token counts, so a workflow with abudgetfails as soon as it runs a step on either tool. Both CLIs print structured output (codex exec --json,opencode run --format json). If that output carries usage, this issue could read the counts there, unless #1120 does it first.Update: resolved in #1120 (39a7dc1). Codex and OpenCode steps now report token counts from their JSON events.
SaulMoro commentedon Oct 14, 2026
Notes from #1078 (#1129) that affect this issue:
env:on command steps. The lease carries the rendered map and the local driver merges it over the inherited environment. Keys only have to match^[A-Za-z_][A-Za-z0-9_]*$, so today anenvkey can shadow a declared secret orPATH. Rejecting a key that collides with a declared secret, as Discussion: Workflow Runtime Integration #818 says, belongs here.start --inputs), and renderedenvvalues travel in the lease. A secret passed as an input would land in both. Masking needs to cover run state, not onlyreport.timeoutas a stopped state. Expressions compareoutcomewith any string, sosteps.x.outcome == 'timeout'already parses, but nothing produces that value and the engine'sstopped()only knowsfailed. A step timeout should become a stopped state, so recovery steps and the run outcome see it.The engine rules that span files are in
docs/dev/workflow-engine.md, added by #1129.SaulMoro commentedon Oct 15, 2026
Notes on
networkandisolation, from checking this against #818 and the drivers that will have to meet them (#1080, #1086, #1087):networkandisolationbest effort in v1. Both factory examples in Discussion: Workflow Runtime Integration #818 setdefaults: { requires: { network: false } }. Discussion: Workflow Runtime Integration #818 and this issue check requirements, the member's policy and the driver's capability before a lease, and "Unsupported enforcement fails explicitly". The local adapter passes no sandbox or network setting to its tools (local-tool-adapter.ts:68-89). A tool's own config or the host may still restrict them, but without that,docsandretroinship-issue, which keep thenetwork: falsedefault, could not run on the local driver. Any driver without these controls would be blocked from the same workflow. I'd change the capability check and that criterion for these two requirements. A driver honors what it can and still takes the step when it cannot enforce one. The report and the run record state what was asked for and what was not enforced. [feat] Add the session skill driver and invocable workflows #1086's "decline unsupported isolation" would change with it.requires.envandhumanstay strict, because the step cannot run without them. The cost is real. A step that asks for no network may still reach it. Aread-onlystep that asks forworktreemay still run in the member's checkout, and a laterread_only_dirtydoes not undo what it changed. A member who needs a guarantee picks a driver and host that enforce it. Minimum sandbox policy stays out of scope. One conformance case would hold this: an unsupportednetworkorisolationstill gets a lease and is recorded as not enforced, while a missing env key orhumanstill blocks it, through both the engine and the CLI.isolation: worktreein both the member'sallowand the driver'scan. The levels could benone,worktreeandsandbox.noneadds nothing beyond the workspace mode, so anewstep still gets its own copy.worktreeruns the step in a separate checkout on the same machine. It keeps changes out of the member's checkout, but does not stop writes elsewhere or network access.sandboxasks for containment beyond that. A container or a remote machine can provide it, though where a process runs does not prove it, since a container can mount the member's home. Container and remote can share one value, because nothing in a workflow treats them differently. A local driver that honorsworktreewould also runread-onlysteps outside the member's checkout, whichworkspace: newin [feat] Add workflow workspaces, branches, and session continuation #1080 does not cover. When a driver cannot detect the sandbox it runs in, such as in a CI job, I'd let the member's config declare it and the driver include it incan. TeamAI already trusts what a driver declares ("Choosing a driver is a trust decision").SaulMoro commentedon Oct 16, 2026
Three things from #1148 for
budgetandtimeout:rependmoves what the step reported,tokensincluded, into itspasses. When it runs a workflow orfor_eachstep again, the old children move torun.archive. A budget that sumstokensoverrun.stepsmisses every earlier pass.buildEndRecordreads both.nexthands out no more leases" (Discussion: Workflow Runtime Integration #818) leaves the open ones running and spending. Anendalready stops them throughstopUnder. It cancels each open lease, a late report getslease_cancelled, and the local driver sends the command SIGTERM, then SIGKILL after 5 s. A spent budget and a lease past itstimeoutcan take the same path. The engine runs only insidenextandreport, so a timeout takes effect on the first call after it passes.failure.codeonly for codes inRECORDED_FAILURES(records.ts). A timeout or budget code left out of it is dropped from the record without a warning.SaulMoro commentedon Oct 16, 2026
#1177 adds
modelto the workflow'sdefaults, next to therequiresthis issue adds. Nothing else here changes.model, the model its definition sets for the tool,defaults.model, the tool's default.defaults.modelfills a gap, as Warp'sagentDefaultsdoes, and never replaces a model a definition chose for its role.modelreplacesdefaults.model. The difference is that a definition's model sits between the two, sodefaults.modelis the one key that does not act as if written on every step.requireskeeps acting that way, including the merge ofrequires.env.defaults. If [feat] Let a workflow choose the model of its prompt steps #1177 does, it holds onlymodeluntil this issue addsrequires.SaulMoro commentedon Oct 20, 2026
#1086 is now blocked by this issue. Notes for the session skill driver:
leaseNext, the way feat(workflow): add workspace branches #1175 checkscan.workspace. A lease the driver'scandoes not cover should wait for another driver. A driver that releases a lease gets it back on its nextnext, so a requirement the driver has to decline after leasing loops. feat(workflow): add workspace branches #1175 also drops unknowncankeys as ignored (key !== 'hitl' && key !== 'workspace'), and this issue adds its capabilities there.worktreein the three-level proposal above. The session's own agent runs in the member's checkout, which isnone. Whethernetworkandisolationend up strict or best effort, [feat] Add the session skill driver and invocable workflows #1086 follows the same rule. It declares only what the host provides, and with best effort it reports what it did not enforce.requires.envneeds a way to run with those values without the agent handling them.teamai env execkeeps values out of output, but it applies the whole team env, not only the step'srequires.env, so it would break the withholding rule from my earlier comment. A prompt step cannot get secrets into the session agent's own process at all. Eitherenv exectakes a lease's key list, which extends an existing command, or a driver that cannot scope env leavesenvout ofcanand such steps wait.canentry for token reporting would let those leases wait for a driver that can, instead of failing the run.SaulMoro commentedon Oct 20, 2026
Notes from #1175 for this issue:
git add -Aat report (worktree.ts:287) and pushes it, so a setup that runs before the agent would have its writes committed as the step's change. Ignored files are not committed, but the agent can still read them. I'd run setup after the base overlay and team delivery and fail withsetup_dirtybefore the agent starts if setup changed any tracked or non-ignored path, followingread_only_dirty. Separately, setup removes any credential file it writes, ignored files included, and a known setup secret left in a file setup created or changed blocks the launch withsetup_secret. Both codes needRECORDED_FAILURES. Criterion: setup writes its token to a gitignored.npmrc; the agent never starts, the value appears in no state or error, and nothing is pushed.timeoutshould not count internal scorer steps ([feat] Add workflow scorers and recorded quality labels #1085), and a spent budget must not turn a pending scorer into a run failure, since "a failed scorer does not change the judged step or the run". A scorer still needs a timeout of its own: a pending step keeps the run from settling (engine.ts:717), so a judge that hangs would hold the run open. A scorer that times out settles without a label.leaseNextwould reuse the path where feat(workflow): add workspace branches #1175 holds back a workspace step, and that path stops at the first held-back step (engine.ts:925). The fix is F3 in [feat] Close the #1080 gaps that #1175 leaves open #1246, which this issue now waits for.refactor(workflow): start Tencent#1082 over from main
feat(workflow): enforce scoped requirements and execution limits (Ten…