Search

Local protected secret store. Provider keys and other credentials are encrypted under a master key kept outside the project (secret://NAME) or kept as variables in the project's .env (env://NAME), referenced from versioned configuration and resolved only by the workers each secret allowlists; metadata reads never return a value, and the secrets::changed trigger reports rotations and .env edits.

binary·Supported platforms: macOS: arm64, x64 · Linux: arm64, armv7, x64 · Windows: arm64, x64·10 functions·credentialssecrets+2·iii

RBAC boundary proxy for the iii worker protocol — auth, gating, namespacing, middleware, and engine:: result filtering on its own port.

binary·Supported platforms: macOS: arm64, x64 · Linux: arm64, armv7, x64 · Windows: arm64, x64·3 functions·authorizationmiddleware+3·iii

Policy and decision surface for human-held function calls — pre_trigger gate, pending inbox, per-session permission settings, and two notification trigger types.

binary·Supported platforms: macOS: arm64, x64 · Linux: arm64, armv7, x64 · Windows: arm64, x64·16 functions·approvalhuman-in-the-loop+3·iii

Report-only security reviews of operator-configured repositories at immutable Git commits, dispatched through a read-only Harness policy.

binary·Supported platforms: macOS: arm64, x64 · Linux: arm64, armv7, x64 · Windows: arm64, x64·1 function·code-reviewgit+3·iii