0052. Commands, terminals and connections into apps go through the platform, gated by risk and recorded
Status: accepted, 2026-10-30. Applies 0025's risk levels to access inside running apps.
Context
apps' spec promised "Exec (a shell into a container) through the agent, audited", and nothing implemented it:
debugging a crash, running a migration or reading a file in a container needed SSH to its node and docker exec —
root on a server teams may share, and nothing anyone can do from a phone. The owner decided terminals in the browser
and the native apps, one-off runs and a release command, and connections to databases from a laptop or a phone. Each
of these is root inside a container: it reads every secret the app runs with and every byte of its data.
Decision
- People reach inside their apps only through apps' API: terminal sessions (an interactive process in the live
container or in a new one from the release), runs (a command, a task the app declares, its release command, its cron
job) and connections (TCP to a port of the container through the API, or through a time-boxed opening of a
published port). The platform offers no shell on a node's host.
- Who: whoever may deploy the app — its team's developers, admins in a protected environment. Terminals and
connections need a person's own sign-in (a panel, a native app, the CLI); API tokens, CI and agents may run commands
and tasks, under approvals.
- Risk: opening a terminal, running an arbitrary command or opening a connection is
medium outside protected
environments and critical inside them, where it reveals secrets and data: a passkey or the phone's approve key,
then the approvals' five-minute fresh window. A task the app declares is medium/high; running a cron job now is
low, as re-running a job is.
- Recorded: a terminal's output (not what is typed) is kept sealed for 30 days, readable by its person and the
team's admins; a run keeps its command and output for 30 days; a connection's opening, closing and bytes are
journaled. Commands are journaled in full, values and output never.
- The node enforces the scope: the agent runs commands only in containers of workloads it was given and connects
only to their addresses; ending a session ends the processes it started.
Consequences
- No SSH to nodes for app work, incident response from a phone, and agents that ask for approval to run commands in
production instead of holding credentials.
- A production terminal costs a passkey again after five minutes; that is the point.
- Recordings and run output may hold secrets: sealed or kept as runs are, never in logs or phone caches, gone after
30 days, read under the same risk as the secrets.
- A shell on a node's host, recording input and shared sessions are out; each would need its own decision.
- Design:
superpowers/specs/2026-10-30-apps-operations-design.md in this repository.