What the perimeter does,
and where it stops
Strategic Agent runs on the owner's machine and is built so that nothing has to leave it. This page lists the controls: where it listens, how a key is checked, how often a key may ask, what is logged, how one corpus is kept from another. Then it lists what has not been hardened, because a security page that ends at the good news is not one.
Loopback · keyed · throttled · logged · walled
The threat is the ordinary one: your records read by something you did not intend. So it listens only to its own machine, checks a key on every request without leaking timing, limits how often a key may ask, logs every request to a file that only grows, and refuses to start any component that would post your text elsewhere.
Where it listens
loopbackBy default the process binds to the loopback address. A request from any other machine does not reach it, because nothing is listening on an address another machine can name. It is the first control and the cheapest, and every other control here assumes it.
It is also the edge of what we claim. If you put a tunnel or a proxy in front of it so it can be reached from elsewhere, the perimeter — who may connect, how the connection is encrypted, what is logged on the way in — becomes theirs, not ours. Nothing on this page claims transport encryption. On loopback there is no wire to encrypt; past loopback, the encryption is whatever you put there.
Who may ask, and how often
keys| Control | What the code does | What it does not do |
|---|---|---|
| Per-key authentication | Every request carries a key. The key resolves to one tenant, and that tenant is the only corpus the request can touch. | It does not identify a person. Whoever holds the key is that tenant. |
| Constant-time comparison | The presented key is compared to the stored one in a way that takes the same time whether the first character is wrong or the last, so a wrong key learns nothing from how long it took. | It does not slow a guess down. That is the throttle's job. |
| Throttle | 120 requests per 60 seconds, per key. Past that, the request is refused. | It throttles a stolen key; it does not block one. The limit is per key, not per source address. |
| Audit log | Every request is appended to a log. The code that writes it only appends; nothing in it edits or removes an entry. | This page does not claim the log is tamper-evident; the record does not say so. |
All four are in one module, perimeter.py, in an engine of 5,639 lines across 23
modules. That size is a security property: one person can read the whole of it in a sitting,
and the hardening pass did.
One corpus cannot see another
the tenant wallEach tenant's store is its own SQLite file on local disk. Inside the code, every read and every write of the store requires a tenant id, and a call without one raises an error rather than falling through to a default. No configuration turns this off, because no branch of the code works without it. That is what "enforced in the data layer" means: not a setting a person could forget to set, but the shape of the only door.
What it refuses to start
the embedderThe one model the engine loads is the embedder — the component that turns your text into
something searchable. It runs on your machine: on 12 September 2026 the health endpoint reported
fastembed:BAAI/bge-small-en-v1.5 with degraded: false. At startup the
process checks which provider it has been asked to use, and if that provider would send corpus
text off the device, it refuses to start. It does not log a warning and carry on. It stops.
There is no language model inside the engine; no call to one appears in its code. The answer is a line out of your document, so there is nothing to generate and nothing to send away. Nothing is required to leave.
What is not hardened
say it| Item | State | What the record shows |
|---|---|---|
| The abstention gate | Failed once | The gate that decides when to stay silent was measured once across three corpora and gave 45 unsafe answers — questions it should have declined. Fixing retrieval did not move it. An answer that should not exist is the fault this product is built to avoid, and it has one. |
| The conformal gate | Short | On the one corpus it was fitted to, about one unanswerable question in seven is still answered, and it was fitted on the same cases it was scored against. |
| The citation range | Short | A span stitched from non-adjacent lines is reported as one contiguous range. The text is right; the locator overstates its own contiguity. |
| Ten findings | Open | The hardening pass raised 40 findings; the 30 rated P0 or P1 were verified and none was refuted. The other 10 are not in the verified set. |
| Key handling | Not written up | How a key is issued, stored and rotated is not written up in the record, so it is not on this page. When it is, it goes here. |
| The disk | Not claimed | The store is a file on your disk. This page does not claim it is encrypted at rest. Protect the disk the way you protect the files it holds. |
| Outside review | Not claimed | The hardening pass is on the record under its own document number. No audit by anyone else is claimed; when one exists it will be named. |
The one that matters most
Of everything above, the abstention figure is the one to weigh. The perimeter keeps your records in. The gate is what keeps a wrong answer out, and on its one measurement it let 45 through. That measurement, and what would close it, is on the record in the same table as the things that went well.
Where this leads
three doorsStays on your machine
The files stay put and the model runs here, in plain words.
What local means ▸ What it isYour own records
Ownership, export and deletion; the tenant wall from the owner's side.
The corpus is yours ▸ TrustThe record
Every item above with its grade, the date it was read, and what would close it.
Read the record ▸