Safe AI

Safe AI

Run the AI-assisted dependency pass inside the same isolation guarantees as the rest of the build pipeline, so an untrusted model or its fetched sources can never execute on the host or leak secrets into an artifact.

Why it matters

--ai-assist sends a description of your project to a model and gets back a dependency proposal. That is fine for a trusted local model, but an edge model or an MCP server can return malicious or misleading package names. Safe AI is the policy layer that keeps the proposal advisory only:

• the model proposes, the builder verifies against the real filesystem
• no code from the model is ever executed on the host
• secrets never leave the secret store and are never baked into the output

Scope of the AI pass

Safe AI treats model output as data, not instructions:

1. Proposal — the model returns candidate dependency names and versions.
2. Resolution — each candidate is resolved from the configured source (local vendor dir, package index, or the MCP server).
3. Verification — candidates that do not resolve on disk are dropped.
4. Assembly — only resolved, versioned dependencies enter the rootfs.

The sandbox used during resolution is the same seccomp + Landlock isolation the runtime launcher uses, so a poisoned resolution cannot spawn processes or write outside the build root.

Configuration

# daedalus.toml
[ai.safe]
verify = true            # resolve + verify proposals before assembly
trust_mcp = false        # treat MCP-sourced packages as untrusted until resolved
secrets_policy = "block" # block | warn (see detect_secret_keys)
max_proposals = 25       # cap on accepted proposal count

Environment overrides (higher priority):

export DAEDALUS_AI_SAFE_VERIFY=true
export DAEDALUS_AI_SAFE_TRUST_MCP=false
export DAEDALUS_AI_SAFE_SECRETS_POLICY=block

Key	Purpose
ai.safe.verify	Require filesystem resolution of every proposal
ai.safe.trust_mcp	Whether MCP-sourced candidates are trusted as-is
ai.safe.secrets_policy	block refuses secrets in layer, warn only warns
ai.safe.max_proposals	Upper bound on accepted proposals

Defaults are safe

By default (verify = true, trust_mcp = false, secrets_policy = "block"), the AI pass can never inject a dependency that does not resolve locally, cannot blindly trust a remote tool, and refuses to bake anything shaped like a PASSWORD, SECRET, TOKEN, API_KEY, PRIVATE_KEY, or CREDENTIALS.

Troubleshooting

• Proposals dropped — that is expected under verify = true; widen the resolution sources (vendored deps, MCP registry) so real packages resolve.
• Build blocked — secrets_policy = "block" stopped a secret-like value; move it to [secrets] so it is referenced, not embedded.