Restrict worker egress and publish manifest

2026-10-20 11:42:13 +02:00
parent 6f67b8012f
commit c4403f297a
3 changed files with 10 additions and 7 deletions
@@ -14,7 +14,9 @@ Responses echo the correlation ID and have status `evaluated` or `rejected`.

 The NATS user may subscribe only to the evaluation subject and publish only to
 reply inboxes. The service receives no credentials other than its own NATS
-identity and has no configured database or AI-provider secrets.
+identity and has no configured database or AI-provider secrets. Its chart
+limits pod egress to NATS and cluster DNS; Luau evaluation has no external
+network path.

 ## Local commands