Runner trust tiers

Every catalog runner has a trustTier of trusted or restricted. That attribute is Banana Peel's classification of whether we will inject vault secrets onto the runner under the default custody policy — it is not a copy of a vendor's compliance badge. Today the catalog marks 127 runner configurations trusted and 127 restricted:

How a tier is assigned

• Authored on the runner catalog (lib/data/runners.ts). Typical trusted set: hosted browser/agent providers we are willing to hand a vault secret. Restricted is the conservative default for extraction APIs, many OSS frameworks, and anything we have not explicitly marked trusted.
• <driver>-<model>combo slugs inherit the base driver's tier (e.g. playwright-gpt-4o follows playwright).
• Unknown slugs — not in the catalog — are treated as restricted.
• Operators can override with comma-separated env lists: BP_TRUSTED_RUNNERS and BP_RESTRICTED_RUNNERS. Env wins over the catalog.

We do not dump the full catalog here. Filter the runner catalog or inspect trustTier on a runner detail page.

What each custody policy does

• trusted_runners (create default) — only trustTier: trusted runners (after env overrides). routing: auto is rejected under this policy because it is an uncontrolled cascade.
• deck_only — only the deck runner. Opt-in.
• any — no trust filter. Restricted runners may receive the secret.
• pinned:browserbase,steel — those slugs only, regardless of tier.

Trust tier is not runner health

Two independent axes. Trust tier is a custody classification: may this runner receive a vault secret. Availability (live / suspended / probation on GET /api/v1/capabilities and the rankings) is an operational circuit breaker: is the runner healthy enough to dispatch to right now. A trusted runner can be suspended after provider failures; a restricted runner can be perfectly healthy. Suspended runners are skipped by routing regardless of tier.

Per-run receipt

Every credentialed run echoes the enforcement that actually applied under banana_peel.custody: the policy, its source, and the allowed runner list after tier filtering and env overrides. You do not have to trust this page — check the receipt on the response.

Egress isolation

Trust tier is about credential injection, not network egress. OSS runners Banana Peel launches apply a shared egress guard (private, link-local, and cloud-metadata destinations are dropped at the network). Hosted agents and infra CDP providers run in the vendor's network — Banana Peel cannot install a firewall there. That is listed as egressIsolation: vendor-unverified on the capability row: a supply-chain consideration, not a claim that we firewall their VPC. We still refuse private URLs before sending them.

Full enforcement semantics: Credential custody.