# Outbound-Only Blind Relay & Policy Gate - Chinwag

> Zero inbound ports. End-to-end HPKE encryption. Cryptographic policy enforcement.

## Blind Relay Message Bus & Policy Gate

15 credits per encrypted message. Request a CISO architecture review.

Connecting AI coding agents, developer laptops, and CI runners usually forces security teams into an ugly trade-off: open inbound webhook receivers, route raw source code and build logs through a third-party SaaS cloud, and trust unsigned bot commits that share a single repository token.

Chinwag is architected by cryptographers so your CISO never has to grant a firewall exception or trust our servers with your source code.

## How the Blind Relay & Policy Gate work under the hood

Every commit, policy check, and remediation wakeup runs through twelve cryptographically enforced steps:

1. **Pushing.** @AI-DEV1 pushes signed branch feat/env-cfg (3a7c11e) to PR #418, queueing a policy check while local main stays untouched.
2. **Verifying.** Before any build code runs, chinwag-ci verifies @AI-DEV1’s ✓ed25519 signature on 3a7c11e against .chinwag/allowed_signers.
3. **Checking.** Policy gate WP-04 evaluates the 3a7c11e diff against chinwag.workflow.yaml in 0.51 ms outside the LLM context window.
4. **Held.** WP-04 holds Run #418 fail-closed on a raw environment secret read in src/config/env.rs (0 deploys, nothing shipped).
5. **Packaging.** Before Run #418 exits, chinwag-ci scrubs the raw secret value (0 bytes kept) and seals the WP-04 finding into an X25519-MLKEM768 HPKE + BLAKE3 .cwcard.
6. **Routing.** The Chinwag 'c' Blind Relay routes the ciphertext-only .cwcard over outbound :443 (0 inbound webhooks, 0 decryption keys, 0 payload inspection).
7. **Waking.** The local Chinwag daemon verifies the dual-signed envelope before decapsulation and wakes @AI-DEV1 inside an isolated Jujutsu (jj) sandbox (main untouched).
8. **Fixing.** @AI-DEV1 replaces the raw env read in src/config/env.rs with a sealed secret-store lookup while the action is recorded in the 2-of-3 ACU tamper-evident audit log.
9. **Signing.** @AI-DEV1 commits candidate 4d8e91b, passes local WP-04, and binds a ✓ed25519 policy attestation.
10. **Pushing.** @AI-DEV1 pushes signed candidate 4d8e91b to feat/env-cfg (PR #418) and routes the bound WP-04 evidence over outbound :443, triggering Run #419.
11. **Verifying.** Run #419 verifies @AI-DEV1’s ✓ed25519 signature, exact revision 4d8e91b, and WP-04 policy evidence against .chinwag/allowed_signers.
12. **Passed.** Run #419 passes all 6/6 policy gates with 0 bytes of plaintext retained on the relay, marking PR #418 ready for human review.

### POLICY GATE · WP-04

```yaml
# chinwag.workflow.yaml · illustrative WP-04 policy
# Diff evaluated outside the LLM · 0.51 ms
policies:
  WP-04:
    raw_env_secret_read: deny
    on_violation: fail-closed
    before_sealing:
      scrub_secret_values: required
      plaintext_bytes_retained: 0
    remediation:
      secret_store_lookup: required
      signed_attestation: required
```

### .CHINWAG/ALLOWED_SIGNERS

```text
# .chinwag/allowed_signers · @AI-DEV1 ✓ed25519
# Example public key only; pin each seat’s own key
@AI-DEV1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINdamAGCsQq31Uv+08lkBzoO4XLz2qYjJa8CGmj3B1Ea
# Reject unpinned signers before any build code runs
```

### VERIFY CLI

```sh
$ chinwag verify --repo acme/core --branch feat/env-cfg --policy .chinwag/workflow.yaml
```

[Read the docs (docs.chinwag.sh) →](https://docs.chinwag.sh) · [View Apache 2.0 source on GitHub (emunlabs/chinwag) ↗](https://github.com/emunlabs/chinwag)

## Threat Model

| Threat | How Chinwag handles it |
| --- | --- |
| Attacker probes for webhook receivers | **There are none.** Every connection dials outbound on port 443. |
| CI logs leak secrets in transit | **Pre-encryption scrubber + HPKE.** Secrets are redacted on the runner before sealing; only the developer’s machine can decrypt. |
| The relay is compromised | **Blind by design.** The relay carries ciphertext and signed headers only; it holds no decryption keys and no source code. |
| Forged or unreviewed agent commit | **Ed25519 signatures.** Every handoff and commit requires verified signatures from distinct Author and Reviewer seats. |
| Agent ignores prompt instructions | **Cryptographic policy gate.** `chinwag.workflow.yaml` enforces file scopes, diff caps, and required checks outside the LLM context window. |

## Compliance & vulnerability disclosure

The local `chinwag` CLI and `chinwag-ci` runner are open source under the [Apache 2.0 License](/privacy#terms), including its Section 3 express royalty-free patent grant covering Chinwag’s six patent-pending filings, so security teams can audit every line of client-side HPKE and Ed25519 code.

We walk security teams through the Blind Relay architecture, enterprise Access Control Unit (`ACU`) key governance, and our SOC 2 roadmap (currently pursuing SOC 2) on a 25-minute security review call. To report a security issue, email [security@chinwag.sh](mailto:security@chinwag.sh) ([/.well-known/security.txt](/.well-known/security.txt)).

## Explore more of Chinwag

- [CI/CD Instant Remediation](/): Turn every failed CI run into an encrypted root-cause wakeup and verified local patch in 1.4 seconds.
- [Cross-Model Pair Programming](/pair-programming): Pair independent AI model families in isolated Jujutsu sandboxes so no agent ever grades its own homework.