DoneState docs / Security & data
Know what crosses each trust boundary
DoneState is designed so identity, repository capability, objective authority, execution credentials, publication, and independent verification stay separate rather than collapsing into one broad permission.
Credentials
- GitHub OAuth
- Identifies the normal hosted operator and provides repository access for the supported OAuth path.
- DoneState GitHub App
- Provides selected-repository capability for private and maintenance paths under explicit repository policy.
- OpenAI API key
- Supplied by the user through the short-lived HTTPS settings flow, encrypted at rest, and never returned by credential-status tools.
- Verifier identity
- Pinned independently by fingerprint when a trusted verifier is required. DoneState does not substitute its own signature.
User-visible data categories
- Identity & entitlement
- GitHub identity and, when applicable, distribution-channel entitlement state needed to provide the service.
- Objective & authority
- Repository subject, goal, acceptance criteria, authority, budgets, and selected repository policy.
- Work & evidence
- Relevant source/diff evidence, validation output, branch and pull-request references, action results, and verifier evidence.
- Operational metadata
- Bounded timestamps, state transitions, delivery identifiers, failures, and security records needed for safe operation and recovery.
- Aggregate product measurement
- Privacy-minimal stage counters used to understand service flow without building a user-level analytics profile.
The authoritative public policy is the DoneState privacy notice.
Deletion and account controls
The hosted service exposes delete_objective for eligible terminal or cancelled objectives and delete_openai_credentialfor the stored user-funded execution credential.
The existing credential-setup browser flow also opens the authenticated DoneState account console. It can show credential state, selected repositories, and indexed objectives and can request deletion of indexed DoneState account data. Deletion refuses to proceed while an indexed objective is active.
Historical direct objectives created before owner-level run indexing may require deletion by their known run ID or a privacy request if they are not discoverable in the account console.
Execution and publication boundaries
- Isolated execution
- Hosted implementation runs in an isolated execution environment rather than granting a conversational model unbounded host access.
- Reviewable publication
- Remote changes are bounded to authorised branch/pull-request effects. DoneState has no self-merge authority.
- Independent verification
- Terminal VERIFIED requires a trusted external verification response for the sealed subject.