Eight Bits per Repository: GitHub Next's Disclosure Budget for Cross-Repo Agents
A confidential repository gives a cross-repository agent 8 bits per run. A sealed one gives it zero. That is the design GitHub Next describes in Limit what agents learn about private repos with enclaves, a feature the page labels experimental. It treats leakage between repositories as an accounting problem. The bound holds without the agent having to recognize an attack, because every answer must fit a schema and a budget.
We covered GitLost, the path the post says enclaves block, in GitHub’s Guardrail Lost to One Word. This piece is about the control class that answers it.
The budget table
Each repository carries a sensitivity tier. The tier sets how many bits an agent may learn from that repository in a single run:
| Tier | Budget per run |
|---|---|
| Trusted | Unmetered |
| Public | Unmetered |
| Internal | 64 bits |
| Confidential | 8 bits |
| Sealed | 0 bits |
These numbers are design parameters, and the post does not present them as measurements. They are small, and the post’s own example shows how small: of the 8 confidential bits, only 3 end up paying for the answer itself.
A trusted broker sits between the agent and the private repository and enforces the budget. The agent asks a question. The broker returns an answer only if it fits a finite schema, a fixed list of possible values declared in advance. A finite schema is what makes an answer countable, and a countable answer is what makes a budget possible.
How a question gets priced
The post works through one example. A question has three possible compatibility values and two possible migration values. That gives 6 possible answers, which need 3 bits to encode. Every answer then pays two fixed charges: one bit reserved for success or error, and four bits for timing. Three plus one plus four is 8, exactly the confidential budget.
The fixed charges deserve the most attention. Whether a call failed carries information. How long it took carries information. The authors price both, so an error code or a slow response is debited like any other answer.
Two more rules close the obvious workarounds:
- The charge is reserved before execution. The broker bills for the schema up front, before any query touches the repository.
- The ledger is shared across script enclaves and agent enclaves, and a schema change does not refill the budget. Swapping in a new question format leaves the meter where it was.
Pre-charging matters more than it looks. A filter that inspects output after the fact is already holding the secret when it decides. A broker that reserves the charge before execution has fixed the maximum disclosure before any answer exists.
What the budget removes
The post states the effect directly: “This blocks the unrestricted private-file-to-public-comment path demonstrated by GitLost without requiring either agent to recognize the attack.”
That sentence moves judgment out of the model. A maintainer sets a tier, the broker counts, and the count decides. If an injected instruction tells the agent to copy a private file into a public comment, the agent can try. What comes back from the broker is an answer drawn from a schema small enough to fit the budget, and a private file does not fit in 8 bits.
Stop Hardening the Sandbox. Take the Credential Out of the Agent. makes a related move with secrets: a broker in the path, so safety stops depending on agent behavior. Enclaves apply that move to information. They also extend the containment pattern from what an agent can touch to what an agent can learn.
For a governance team, the useful property is where need-to-know now lives. It used to be a sentence in a policy document. Here it is a number attached to a repository, set by whoever owns that repository, and enforced by a broker outside the model.
The limits, in the post’s own words
The authors are explicit about what the budget does not do. Anyone planning to adopt the idea should read these lines before the tier table.
“These are per-run budgets.” The meter is scoped to a run. On its own, a per-run bound says nothing about the total an agent learns across many runs. How often a workflow may run against a confidential repository is a separate decision, and someone has to make it.
“Agent enclaves necessarily send repository-derived content to the configured model provider.” The budget bounds what the requesting agent learns. Repository content still reaches the model provider behind the agent enclave, so contracts and data terms with that provider remain part of the control set.
“A disclosure budget is not a guarantee of harmless disclosure. Even one bit can answer a sensitive question.” Picture a yes-or-no question such as whether a given customer name appears in a repository. One bit answers it. The schema author decides which questions are askable, and a careless schema can spend a tiny budget on a damaging answer.
The post frames the whole guarantee in one line: “The guarantee is a bound on communication, not a judgment that every possible question or answer is safe.” Whether the content is safe to reveal stays a human call.
Where the cost lands
Budgets this small reshape cross-repository work. Take a hypothetical workflow whose questions are all priced like the worked example, 8 bits each. An internal repository at 64 bits would allow roughly eight such questions per run. A confidential repository would allow one. Questions have to become narrow, enumerable checks, and open-ended browsing of a confidential repository falls outside what the model permits.
Tier assignment becomes a governance decision with a named owner. Someone says which repositories are confidential and which are sealed. Someone reviews schemas, because a schema is now the definition of what may be asked. Both jobs sit most naturally with the people who own the data.
The experimental label means the pattern is the thing to adopt today. A broker, a finite schema, a pre-charge and a shared ledger can be built into an internal agent platform regardless of when or whether this implementation reaches general use.
Do this now
List the cross-repository agents you already run and every private repository each one can read. Tag each repository with a tier: unmetered, internal, confidential or sealed. Any agent that can read a confidential repository and also write to a public surface is the GitLost path the post says enclaves block. For those agents, put a broker in the path that answers only from a declared schema, charges for errors and timing as well as content, bills before execution, and keeps a ledger that schema changes cannot reset. Then write down how many runs per day each of those workflows gets, because a per-run budget leaves that number to you.
This analysis synthesizes Limit what agents learn about private repos with enclaves (GitHub Next, 2026).
Victorino Group helps engineering teams design brokers and disclosure budgets for agents that work across private repositories. Let’s talk.
All articles on The Thinking Wire are written with the assistance of Anthropic's Opus LLM. Each piece goes through multi-agent research to verify facts and surface contradictions, followed by human review and approval before publication. If you find any inaccurate information or wish to contact our editorial team, please reach out at editorial@victorinollc.com . About The Thinking Wire →
If this resonates, let's talk
We help companies implement AI without losing control.
Schedule a Conversation