Deployment modes / Local first

The release standard starts local and makes every external route explicit.

Local-only, API-only, and hybrid packages are planned but not yet in the download catalog. Before release, each adapter must declare its provider, budget, allowed data classes, and customer authorization.

Architecture published · packages pending

Three planned explicit modes

DEFAULT

local_only

The planned default keeps inference and working data on customer-controlled hardware with external model egress disabled.

OPT-IN

api_only

The planned API mode requires a named provider, approved data classes, customer-owned credentials, and a defined budget.

CONTROLLED

hybrid

The planned hybrid mode routes by task and data class with visible failover rules and no silent privacy downgrade.

Planned portable artifacts

Source archives and OCI containers
Cross-platform CLI
JSON and YAML configuration with schemas
Apple Silicon MLX manifests
llama.cpp, GGUF, Ollama, and vLLM-compatible manifests where licenses permit
OpenAI-compatible provider adapters without vendor lock-in

Release data boundary

A package cannot be released under the local-first label unless PII, confidential, or regulated material remains local by default and any external provider route requires explicit customer authorization and an appropriate agreement. Diagnostics and remote support must be off by default, scoped, visible, and revocable.

Customer-owned API keys
No advertising telemetry
No hidden remote shell
No public access to the Kedabek lab

Next mission

Review the agent boundary

See how public knowledge and private execution stay isolated.

Agent architecture