From 8b530d125580b2afa6c043c700e7568b6816010d Mon Sep 17 00:00:00 2001 From: Paavo Pokkinen Date: Wed, 26 Aug 2026 09:12:10 +0300 Subject: [PATCH] docs(readme): render trust-zone diagram with mermaid MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub renders mermaid natively, so the security model diagram no longer needs hand-aligned box-drawing characters that break whenever a label changes length. The flowchart also makes the data flow explicit — exec request, secret injection, redacted output — which the ASCII version only hinted at with a single arrow. --- README.md | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index ef81df9..131ae4d 100644 --- a/README.md +++ b/README.md @@ -298,18 +298,20 @@ Profiles bundle sandbox rules for a known agent: Airlock splits your machine into three zones with different levels of trust: -``` -┌─ your session (no sandbox) ─────────────────────────────────────────┐ -│ airlock daemon — runs as you, outside any sandbox │ -│ holds secrets in memory · uses your real logins to mint tokens │ -│ │ -│ ┌─ agent sandbox ───────────┐ ┌─ tool sandbox (per exec) ───┐ │ -│ │ claude / codex / … │ │ gh · gcloud · kubectl · … │ │ -│ │ sees: project files, │───▶│ sees: project files, its │ │ -│ │ redacted tool output │ │ own config, and only the │ │ -│ │ never sees: secrets │ │ secret it was declared for │ │ -│ └───────────────────────────┘ └─────────────────────────────┘ │ -└─────────────────────────────────────────────────────────────────────┘ +```mermaid +flowchart LR + subgraph session["your session (no sandbox)"] + daemon["airlock daemon
runs as you, outside any sandbox
holds secrets in memory · uses your real logins to mint tokens"] + subgraph agent_sb["agent sandbox"] + agent["claude / codex / …
sees: project files, redacted tool output
never sees: secrets"] + end + subgraph tool_sb["tool sandbox (per exec)"] + tool["gh · gcloud · kubectl · …
sees: project files, its own config,
and only the secret it was declared for"] + end + end + agent -- "airlock exec" --> daemon + daemon -- "spawns with secret injected" --> tool + tool -. "redacted stdout/stderr" .-> agent ``` - **The daemon is trusted and runs unsandboxed, as you.** That is deliberate: it needs your real `gcloud` login or `op` session to mint scoped tokens, and it is the one place raw secrets live. The agent can reach it only over the Unix socket.