These harnesses can run tools and code. Treat every deployment as sensitive.

• Do not commit raw secrets.
• Store runtime secrets in TrueFoundry SecretGroups.
• Keep runtime APIs private or behind bearer tokens.
• Use Daytona for terminal/code execution.
• Do not run untrusted code inside the control API.
• Keep model access behind TFY LLM Gateway.
• Keep tool access behind TFY MCP Gateway.
• Do not run arbitrary user-provided commands from the control API.
• Do not expose raw SecretGroup values through API responses, logs, screenshots, or generated state files.

The TrueFoundry deployment is split:

harness-control-api
  is the single shared ingress API for every harness and owns agents, sessions,
  messages, memory, runs, MCP tool listing, and rendered deployment plans

runtime gateway
  owns harness-specific behavior and delegates execution to the configured
  sandbox layer

run orchestrator
  owns run state transitions, harness routing, sandbox leases, retries,
  cancellation, artifact sync, and idle cleanup

The control API should be cheap and always on. The execution layer should be replaceable and eventually ephemeral per run/session. The default sandbox policy is a managed workspace per agent/session with an idle timeout, falling back to a managed ephemeral run sandbox when the session workspace cannot be resumed.

agents/ is ignored generated state. It can contain local agents, sessions, messages, runs, memory, sandbox leases, rendered manifests, workspace snapshot metadata, and screenshots from smoke tests.

Do not put secrets in agents/. The rendered manifests should contain tfy-secret://... references, not secret values.

The local API may store channel credentials in generated state when you choose to connect local integrations. That state is ignored by Git. Do not publish it, copy it into docs, or include it in screenshots.

If local state is no longer needed, delete agents/ and restart the local API. The folder will be recreated with fresh state.

Today credentials come from TrueFoundry SecretGroups and MCP Gateway. Add any future credential broker only with sandbox egress controls so the sandbox cannot bypass it.