The production-oriented profile is the Compose stack under infraestructura/. The SQLite and local-sandbox adapters exist only for tests and standalone development.

• Angular is untrusted input.
• Trusted identity headers are accepted only when AUTH_MODE=trusted_headers and the backend is reachable exclusively through an authenticated reverse proxy.
• PostgreSQL is the system of record.
• Redis contains transient coordination data and must not be exposed publicly.
• MinIO objects are private.
• Qdrant and pgvector queries are scoped by user and project.
• Workers do not execute tools in the API process.
• Shell commands run in a separate Docker daemon, never through the host Docker socket.
• Ollama runs on the host and must not be exposed to untrusted networks.

• Replace all example passwords.
• Limit published database/cache/object-store ports or remove them when not needed.
• Put TLS and OIDC authentication in front of Nginx.
• Ensure the proxy removes user identity headers supplied by clients.
• Use short-lived secret-manager credentials where possible.
• Set HOST_PROJECTS_ROOT to the smallest necessary directory.
• Use git_mode=required for repositories that the agent may modify.
• Keep REQUIRE_SANDBOX=true and ALLOW_UNSAFE_LOCAL_SANDBOX=false.
• Keep cloud models disabled until data handling, residency, pricing and quality are approved.
• Review config/policies.yaml, config/model-catalog.yaml and config/mcp.yaml through code review.
• Back up PostgreSQL and MinIO and test restores.
• Monitor the Redis dead-letter stream and worker heartbeats.

Absolute host paths are not valid tool paths. A project is registered beneath WORKSPACES_ROOT, and all tool paths are resolved relative to that project. Parent traversal, symlink traversal and sensitive files are rejected.

Git repositories are modified only inside an isolated worktree and branch. A clean source checkout is required by default. Non-Git projects use an ephemeral copy and do not receive direct writes.

Do not include secrets, customer data or private source code in a vulnerability report. Provide a minimal reproduction and affected version through the repository owner's private security channel.