Architecting Disposable Worker Planes: Keeping Canonical State Separate

The core architectural principle presented is the absolute necessity of keeping canonical state off disposable, untrusted hosts. This applies to any free or rented compute resource where you don't control the full lifecycle or its environment. The article likens these hosts to a 'hotel printer' – you send a task, collect the output, but never store your critical 'filing cabinet' (canonical state) there.

The Fragility of Inverting the Split

Many teams mistakenly clone full repositories and environment files onto free hosts. This creates a 'second source of truth' that is inherently fragile. It leads to inconsistencies, security vulnerabilities (exposing secrets), and a loss of control over the authoritative state of the codebase. The architecture quickly becomes a distributed system with conflicting states, which is a recipe for disaster.

Defensible Data Flow for Worker Planes

The recommended data flow emphasizes a local-first, trusted repository as the sole writer to the origin. The process involves:

1. Exporting a review bundle: A stripped-down, allowlisted snapshot of the code, intentionally excluding sensitive files (.env, keys). This bundle is immutable and hash-addressed.
2. Secure transmission: The bundle and a structured request (with a clear 'question' and allowed/forbidden actions) are sent to the remote worker.
3. Sandboxed execution: The remote host unpacks and processes the bundle in an isolated sandbox, never receiving deploy keys or write access to the main repository.
4. Structured result: The worker emits only a predefined, structured result (e.g., comments, unified diff), preventing arbitrary code execution or unexpected outputs.
5. Local validation and merge: The result is fetched as a regular file, locally validated, and a human makes the final merge decision.

#!/usr/bin/env bash
# export-bundle.sh — canonical repo stays on your machine
set -euo pipefail
ROOT="$(git rev-parse --show-toplevel)"
REV="$(git rev-parse HEAD)"
OUT="${1:-/tmp/review-bundle.tgz}"
cd "$ROOT"
git archive --format=tar "$REV" \
 --prefix="bundle/" \
 ':!(exclude).env' \
 ':!(exclude).env.*' \
 ':!(exclude)**/*.pem' \
 ':!(exclude)**/id_rsa' \
| gzip > "$OUT"
python3 - "$OUT" <<'PY'
import sys, tarfile, re
path = sys.argv[1]
deny = re.compile(r"(.env|.pem|id_rsa|secrets?)", re.I)
with tarfile.open(path, "r:gz") as tf:
    names = [m.name for m in tf.getmembers() if m.isfile()]
    bad = [n for n in names if deny.search(n)]
    if bad:
        raise SystemExit("refusing bundle; denied paths: " + ", ".join(bad))
    print("bundle_ok files=%d rev_export" % len(names))
PY
echo "exported $OUT at $REV"

This architectural pattern provides strong security and reliability guarantees. By ensuring the remote worker is disposable and stateless, and by strictly controlling its inputs and outputs, you mitigate risks associated with compromised hosts, data exfiltration, and unauthorized modifications to your canonical codebase.