RC adds read-only database transactions, rooted query_ref and OpenAPI refs, disabled remote refs, SSRF policies, bounded HTTP/database evidence, Jinja autoescaping, Excel formula neutralization, installer checksum verification, and current-run cleanup ownership. Production remains blocked.
- Production environments are blocked by default. The current CLI intentionally exposes no production override.
- For
public,strict, andenterprise_internal, list each permitted DNS name inproject.confirmed_hosts;project.production_hostsis blocked even when an ATIR environment label is incorrect. - Public/strict requests use their validated DNS answer for the actual TCP connection, preventing a later resolver answer from redirecting the socket to an internal address.
- P1 and P0 workflows require explicit matching approval; P2/P3 retain preview visibility.
- After
assertion_unknown, optional continuation is allowed only when every remaining step is a safe read. Any later P0 or P1 write, including an ordinary POST, PUT, or PATCH, blocks continuation even if that risk level was approved. - SQL is parsed and limited to one SELECT or WITH...SELECT statement. Use bound parameters; credentials remain outside ATIR.
- No
eval, dynamic Python import from ATIR, shell command, package installation or updater exists in Runner source. - Only infrastructure failures receive finite retries. Business requests are not duplicated automatically.
- Cleanup must be an explicit project action. The generic Runner never guesses deletion endpoints.
- Evidence is redacted before disk writes. Keep
.env, evidence and local caches out of Git. - Input files are untrusted. Pydantic rejects unknown protocol keys, formats are parsed deterministically, and reports escape template content by design constraints; do not open evidence HTML from untrusted shared origins without normal browser precautions.