01
Hub
Owns identities, policy, encrypted secrets, audit events, repositories, build state, and deployment intent. The hub does not mount the host Docker socket.
Security and trust
Production automation should be constrained before it is clever.
ReaperCI ties identities, policy, build evidence, approvals, deployment intent, and live runtime state into one accountable control plane. This page describes implemented boundaries and the assurance work still required before managed general availability. It is not a certification claim.
- No host Docker socket on the hub
- Scoped agent identities
- Human production approvals
- Exact-image rollback
Control boundaries
Authority is divided on purpose.
Each boundary narrows what infrastructure, people, and automation are allowed to do.
02
Builds
Managed tenants are designed for isolated rootless BuildKit stacks, volumes, networks, encryption keys, quotas, and backup sets. BYO workers remain customer-owned compute.
03
Servers
The managed connector enrolls once, connects outbound over mTLS, rotates certificates, rejects replay, and exposes typed allowlisted operations. Direct SSH remains available to self-hosters.
04
Agents
CLI, MCP, and API actions use scoped service accounts. Production requests remain subject to environment policy, and every action is attributed.
Deployment safety
A release carries its evidence with it.
ReaperCI keeps the commit, image, policy decision, health result, observed runtime, and rollback target connected instead of scattering them across unrelated tools.
- Environment-scoped secrets and tokens
- Protected production approvals
- Health checks with configurable failure thresholds
- Immutable image evidence and exact-image rollback
- Drift reporting and last-known-state timestamps
- Append-only audit events and secret masking
Managed data boundary
Backups are only useful when restoration is proven.
Managed backups stream to a tenant-scoped S3-compatible key, record size and SHA-256, and require explicit server-side encryption. Restore hydrates to a random mode-0600 file and verifies integrity before stopping the tenant hub.
Production bucket controls, KMS, object lock, and separate-host restoration drills remain launch gates for the managed service.
Current assurance status
Implemented controls and open gates stay separate.
Repository and release gates
Unit, integration, browser, secret-scan, dependency-audit, multi-architecture image, SBOM, image-scan, backup/restore, and BuildKit/registry checks are part of the repository validation path.
Independent and live evidence
Independent security review, production infrastructure review, live provider and disaster-recovery drills, legal review, trademark clearance, and closure of all critical or high findings remain required.
Coordinated disclosure
Found a security issue?
Follow the coordinated vulnerability disclosure policy and include the affected component, impact, minimal reproduction, and a safe contact method. Never include customer secrets or exploit public systems.
Read the disclosure policy