# cayce-dev Design Document

*Authorized by operator merge to main. This design governs the cayce-dev sandbox.*

## Flow
- Cayce opens a PR with SPEC.md on a product repo. Operator's merge to main = authorization.
- cayce-dev only takes specs already merged by the operator. Implements on a branch and opens a PR. Operator merges.
- If the spec is ambiguous, ask in the PR; do not improvise.

## Gitea Access
- Token limited to product repos (branches and PRs only).
- No merge access, no admin access, no access to cayce-ops or hardcap.
- Commit author: cayce-dev.
- Workflow: operator reviews SPEC.md PR → merges → cayce-dev creates feature branch → opens PR → operator merges.

## Isolation
- Own container or user. NO access to:
  - nsec (operator key or agent identity)
  - .env files (operator keys, API tokens, database credentials)
  - Production database
  - Tokens (sfeed, Facebook, Instagram, Mail, SSH)
  - Docker socket or any container orchestration API
  - Operator keys or agent identities
- Network: only local Gitea and package registries. No outbound capability beyond.
- No deploy or publish capability.

## How Each Restriction Will Be Tested
- Container isolation: verify cayce-dev user cannot read /srv/cayce-core/.env or /home/ubuntu/.sfeed/tokens.json
- Network: verify cayce-dev container has no internet access beyond Gitea
- Key access: verify no Cayce nsec or operator pubkey is exposed to the sandbox
- Auth token access: verify no operator tokens are readable

## Execution
- Model/runtime options with pros/cons (operator decides):
  - Local LLM (private, no cost per token, limited capability)
  - Remote API (cost per token, broader capability, privacy tradeoff)
  - Sandboxed execution environment
- Time/iteration/cost limits per task (operator-defined):
  - Max 3 iterations per task
  - Max 15 minutes per iteration
  - Max $0.10 USD per task (using cheapest available model)
- Mandatory tests in sandbox: every implementation must have corresponding tests within the sandbox environment
- Execution log without secrets: every execution step must be logged without exposing secrets, API keys, or private data

## Report
- Summary in the cycle DM toward the operator
- Include: what was executed, outcomes, any restrictions encountered, compliance status