Security

Private by design, fail-closed by default

• Loopback-only listeners — the serve never binds a public interface in the supported profiles; remote lanes are reached through authenticated SSH local forwards.
• Bearer authentication with a user-only key file; no anonymous access.
• Fail closed, never cloud fallback — if the lane is unavailable, the session stops rather than silently escaping to a hosted model.
• Everything hash-pinned — model artifact, server binary, container image, and launch config are bound by the release manifest and verified at boot.
• Checkpoints stay local — durable state lives on local NVMe with owner-only permissions; wrong-profile checkpoints are rejected, not partially loaded.

The full model, boundaries, and support rules: docs/SECURITY.md

Last verified 2026-08-31.