Autonomy without invisible authority.

HowHow starts local-first and blocks when identity, authority or side effects are unclear.

POSTURE

What the system assumes

Local-first records: Project state, evidence, runs, failures and artifacts stay exportable and inspectable without depending on one provider.
Least privilege: Deny-by-default egress, allowlisted APIs and no ambient credentials.
Untrusted input: Papers, repositories and retrieved text are treated as data. Injected instructions cannot execute.
Pinned dependencies: Exact repository identities and commits are recorded. A similarly named mirror is not interchangeable.

TRUTHFUL LIMITS

Sandboxing: TRUSTED_LOCAL is bounded execution, not an OS security sandbox. Hostile code needs an external container.
Certification: No SOC 2, ISO certification, on-premise readiness or compliance certification is claimed on this website without current evidence.
Enterprise isolation: Private deployment is discovery work until separately verified for your environment.

FAILURE BEHAVIOUR

Ambiguous dispatch: Unknown handle or possible external effect moves the task to reconcile-required or BLOCKED. A different provider is never dispatched to paper over it.
Leases and fencing: Only the current fencing token may commit a result. Idle heartbeat does not prove a task is complete.
Cancellation: A durable event. Late results are kept as late evidence but never rewrite a cancelled task into a success.
Budget exhaustion: Hard stop at the policy limit. There is no silent upgrade or silent spend.

RESPONSIBLE DISCLOSURE

Current state: A security contact must be supplied by Navin Research before public launch. Until then this page is a product boundary statement, not a disclosure channel.
Do not send: Do not send sensitive research material or credentials through an unapproved channel.

HARD LIMIT

We will tell you plainly which ones are met today and which are not.