Boundary receipt #2 — historical inference-path observations
This public summary preserves an earlier scoped configuration observation and one negative behavior test. It is not a current runtime/version/date claim or a retest of the operator-reported architecture recorded 2026-10-03. No private identifiers, credentials, or command transcripts appear here. Receipt #1 found no working provider credential in that sandbox context. The additional observations here are placeholder configuration and a stopped run on one deliberately broken inference route. They do not demonstrate that a real credential was successfully resolved at a mediating boundary on a successful governed model request.
Scope
| Item | Value |
|---|---|
| Boundary considered | Historical inference configuration and one deliberate misroute |
| Mediation | Intended managed model path; successful governed request not shown here |
| Credential handling | A non-functional placeholder was observed in sandbox configuration; no working credential observed in its process environment |
| Method | Configuration/environment inspection and one negative behavior test |
| Mutating production systems | None |
| Secrets included | None |
| Claim supported | Placeholder placement and stopped run for that misroute; not successful credential resolution, non-bypassability, or current runtime behavior |
Reported observations
- Placeholder in sandbox. The examined configuration pointed at a governed inference route and contained a non-functional credential placeholder. No working provider credential was observed in the examined configuration or process environment. This does not show where or whether a real credential was resolved on a successful request.
- One fail-closed misroute. Deliberately setting an incompatible inference API mode stopped the agent run rather than producing a successful result or observed fallback. Other error modes and adversarial bypass routes were not tested by this observation.
These two observations are narrower than an end-to-end credential-mediation proof.
What this receipt does NOT claim
This remains the most important section, and the discipline is unchanged from Receipt #1: unproven boundaries are named, not implied.
- No successful credential-resolution proof. Configuration inspection plus a broken-route test cannot show an upstream credential injected at a mediating boundary on a successful request.
- No active extraction or non-bypassability proof. Absence from the examined files/environment does not establish that a determined attacker cannot retrieve a credential by other means.
- No exhaustive fail-closed guarantee. The stopped run covers one misroute only.
- No current realm or outer containment proof. The reported architecture's grouping and VM layers require their own measurements.
- No outer containment proof. A VM or host boundary needs its own measurement; realm grouping is not automatically an isolation boundary.
Why this matters — the design choice it records
The generalizable lesson, stated so others can adopt it without any of our coordinates:
Secrets live outside the sandbox, not inside it. An agent should hold a placeholder, not a key. Put the real credential behind a single mediating boundary that injects it at egress, pair it with deny-by-default egress, and prefer designs where disrupting the governed path stops the agent rather than letting it find an ungoverned one.
Evidence level
This is a historical scoped configuration and negative-behavior observation. It is not a successful end-to-end governed inference transaction, credential-resolution proof, production canary, or current architecture retest. Verification explains those distinctions.
Read alongside boundary receipt #1 — inner sandbox, the governed-agent-workload case study, and the substrate validation receipt.