§1 · Posture

An architecture you can audit

Network access is not ambient — it is a declared, consent-gated effect, so data does not leave the device by default. This is a property of how the system is built, not a promise in a policy document. Every effect is stamped with provenance you can inspect.

§2 · Guarantees

What you get, by design

PropertyGuarantee
On-device by defaultCompute runs locally; egress is explicit, declared, and consent-gated.
Content-addressedArtifacts are addressed by hash and verified before use — bytes never silently change.
AuditableEffects are declared up front and every run is stamped with inspectable provenance.
ReproducibleFixed seeds and stamped provenance enable bit-for-bit replay of any result.

§3 · Disclosure

Reporting a vulnerability

We take security seriously and welcome responsible disclosure. A published policy and disclosure path will live here; in the meantime, reach us directly.

Contact us to report a security issue.