RBAC / authentication
Authentication is centralized through core auth surfaces and user skill boundaries.
Security
Public security architecture without internal data.
This page publishes no secrets, hosts, customer data, logs or private brain content.
secret isolation
Secrets stay in local settings, ignored credential files or root-only server locations and are not exported to the public data layer.
audit trail
Git history, status metadata, audit logs and generated reports document relevant operations.
structured logging
Core log helpers and skill-local audit logs keep operational output separate from public documentation.
controlled execution
Read-only operations are separated from write, destructive and privileged actions.
public/private repository separation
The public website consumes filtered metadata generated from the private XvX repository.
no privileged automatic execution
Sudo/root operations remain operator-controlled and are not exposed through public pages.
human-controlled write/destructive gates
DNS, database, file deletion and deployment mutations require explicit review paths.