Security & Post-Quantum
What the engine enforces at runtime — and, just as importantly, what it refuses to claim.
Post-quantum run signing
The Regulated tier signs run evidence with ML-DSA-65, the lattice signature scheme standardised as NIST FIPS 204 and selected at the CNSA 2.0 parameter set.
The reason is specific rather than fashionable: signed build evidence has to stay verifiable for as long as the artefact it describes is in service, and a signature made today with P-256 has to still mean something in 2036.
Credentials are per-organisation
A credential submitted through the UI is held for the submitting organisation alone. It is never written into the process environment, never written to the operator's home directory, and never echoed back in a response.
Ambient values exported before the board starts remain board-wide and read-only — a deployment that configures one key for everyone keeps working, without a tenant's submission ever being promoted into that shared namespace.
Where OS keychain custody is enabled, the durable write happens before anything is recorded in-process, so a failed custody write can never leave a credential live for this process and gone on restart.
Redaction is a boundary, not a filter
Every executor result passes through redaction before it is returned. Card-scoped secrets are masked in addition to the default rules, because an opaque vault-issued token has no recognisable prefix for a pattern to catch.
Types that hold credentials override __repr__ and __str__, so an f-string cannot slip a secret past a guard that only covered repr(). A credential value never reaches a log line, and an oversized agent response fails closed rather than escaping as a traceback carrying the payload.
Failures refuse; they do not guess
An executor that cannot establish credentials for the selected vendor refuses and names what is missing. It does not silently fall through to a different vendor — the prompt never leaves to a processor the operator did not choose.
When token usage cannot be determined, the run reports zero and is marked unmetered rather than estimated. A fabricated token count makes an overrun invisible, which is worse than an honest gap.
COODDEE is software you run, not a certified service. The compliance pages describe the controls the engine enforces and evidences; an authorisation to operate is granted to a system and its operator, never to a dependency.