Security

Private by design, fail-closed by default

• Loopback-only listeners — the serve never binds a public interface in the supported profiles; remote lanes are reached through authenticated SSH local forwards.
• Bearer authentication with a user-only key file; no anonymous access.
• Fail closed, never cloud fallback — if the lane is unavailable, the session stops rather than silently escaping to a hosted model.
• Everything hash-pinned — model artifact, server binary, container image, and launch config are bound by the release manifest and verified at boot.
• Checkpoints stay local — durable state lives on local NVMe with owner-only permissions; wrong-profile checkpoints are rejected, not partially loaded.

The v0.7.3 scope is RTX 5090 Windows 11 + Docker Desktop/WSL2 and RTX 4090 native Windows 11, with OMP 18.2.3; RTX 3090 is deferred. Release state and exact eligibility.

The full model, boundaries, and support rules: docs/SECURITY.md

Last verified 2026-08-31.