Use Case
An approved research project should be able to run a bounded agent task against a read-only data snapshot in an isolated environment, review its quarantined outputs, and release only explicitly approved artifacts.
Problem
Heartwood can run without network access and records reviewed actions, but it is not an infrastructure security boundary.
It does not currently provision or verify read-only inputs, enforced egress denial, ephemeral execution, output quarantine, or steward-controlled release.
Solution
- Define typed platform evidence for read-only input snapshots, network policy, execution identity, ephemeral workspace, encrypted storage, quarantine, and release authority.
- Reuse OpenHands remote-workspace and agent-runtime contracts behind Heartwood platform adapters rather than adding another agent engine.
- Fail closed before execution when a required platform control cannot be established.
- Keep outputs unavailable to the main project until a steward approves an exact manifest.
- Record allocation, execution, review, and release decisions through content-minimized session, provenance, and checkpoint contracts.
- Provide a synthetic reference deployment and require separate qualification for each controlled-data platform.
Acceptance Criteria
- Tests prove that inputs cannot be changed, denied egress fails, and unapproved outputs cannot enter the main project.
- Approval releases only the files and digests in the reviewed manifest.
- Cancellation, timeout, process loss, and release retry cannot bypass quarantine or repeat an uncertain action.
- The same lifecycle and recovery state is visible in terminal and browser clients.
- Synthetic zero-egress validation is repeatable; no protected data is used in source control, CI, or public logs.
- Documentation does not claim institutional approval from implementation or synthetic validation alone.
Alternatives considered
Application-level network flags and file permissions cannot establish the required platform boundary.
A Terra-specific workflow engine would duplicate the shared gateway and make other managed environments harder to support.
Additional context
This is the main remaining implementation work for Aim 1.3 Tier B.
It depends on approved platform controls, a data-steward process, and the experiment-provenance foundation in #125.
Code of Conduct
Use Case
An approved research project should be able to run a bounded agent task against a read-only data snapshot in an isolated environment, review its quarantined outputs, and release only explicitly approved artifacts.
Problem
Heartwood can run without network access and records reviewed actions, but it is not an infrastructure security boundary.
It does not currently provision or verify read-only inputs, enforced egress denial, ephemeral execution, output quarantine, or steward-controlled release.
Solution
Acceptance Criteria
Alternatives considered
Application-level network flags and file permissions cannot establish the required platform boundary.
A Terra-specific workflow engine would duplicate the shared gateway and make other managed environments harder to support.
Additional context
This is the main remaining implementation work for Aim 1.3 Tier B.
It depends on approved platform controls, a data-steward process, and the experiment-provenance foundation in #125.
Code of Conduct