Skip to main content

​
Separate control and data credentials

The workspace key can create, inspect, reset, renew, and destroy sandboxes within its scopes. Keep it in trusted control code. Each ready environment receives a different short-lived provider credential. Give the application under test only the returned credentials.headers map. The data plane rejects workspace keys and credentials scoped to another sandbox or environment. Never send a production provider credential to Archal.

​
Use synthetic state

If a test needs production-derived structure:
  1. minimize fields
  2. remove secrets and personal data
  3. replace stable identifiers
  4. document source and retention
  5. validate the sanitized artifact before upload
Supabase SQL has an additional statement safety boundary. Customers still own the content and legality of every fixture.

​
Keep authority away from the agent under test

An untrusted agent should not receive Archal lifecycle or state-management authority. Give it only the provider tools and credentials required for the task. A trusted coding agent can manage the surrounding lifecycle while state replacement and reset remain approval-gated.

​
Isolation and cleanup

Sandbox ownership is checked for every lifecycle request. Scoped credentials bind provider calls to one sandbox and one environment. TTL cleanup, teardown retry, and orphan reconciliation are backstops when a caller disappears. Destroy is still the normal completion path. Keep raw session responses out of logs because they contain scoped provider credentials.

​
Evidence and retention

The current evidence endpoint returns bounded metadata, counts, retention status, and an integrity hash. It does not provide raw request, response, or state export. Availability targets, audit exports, reserved capacity, custom retention, and compliance commitments apply only when implemented and included in a signed agreement.