Skip to main content
Voss is local-first and repo-scoped. The security model is built around explicit boundaries.

​
Boundaries

​
Scoped writes

voss edit grants write access only to explicit targets and relevant existing tests. Other writes require approval after a diff preview.

​
Shell execution

Shell execution is mutating and potentially risky. It is denied in edit mode and remains subject to lower-level allowlist behavior in broader modes.

​
Managed execution

When Voss ADE launches its engine, voss serve runs in OAuth-only mode: managed sessions and swarms accept subscription OAuth only, never API keys, and every role is checked before anything is persisted. Child Claude and Codex processes get isolated, temporary login files that are removed when they exit, and conflicting billing variables are stripped. No credential material appears in availability data or task events.

​
Secrets

Voss sessions must not store provider credentials or API keys. The Jev key used for judgments is never exported to agent-run child processes, and judgment receipts store IDs, labels, probabilities, and digests, not your criteria, diffs, or code.
Do not paste secrets into prompts. Treat user-provided prompt text as session content.

​
Trust goal

The goal is not to make AI work risk-free. The goal is to make risk visible, bounded, and reviewable before it changes your repo.