ADR2 min read
ADR-005 — Worktree Isolation Is Not Security Isolation
Filesystem separation in the normal workflow is not a hard security boundary.
Status
Accepted
Context
Worktrees reduce accidental interference but share a machine, credentials, kernel, and repository object store.
Decision
Document worktree isolation as workflow isolation only. Use a stronger execution provider for adversarial or sensitive workloads.
Alternatives considered
Treating a worktree as a sandbox.
Consequences
Security requirements stay visible instead of being implied by the default.
Extension path
Use containers, VMs, permissions boundaries, or remote workers.