Chain · Sovereignty — your infra, your keys, your trust boundary
Parent: requirements-to-design
L0 · Vision
introduction — the corpus is yours to curate and push, never scraped; the act of attaching it is the trust boundary. design-principles — architectural prediction: individual + AI subagent as the unit of ownership. deployment — self-hosted single-tenant as the shape the product demands.
L1 · Promise
The owner's identity, voice, and data run on the owner's own infrastructure. Every external contact is explicit, credentialed, and inspectable. Even the visitor's AI can be the visitor's own.
L2 · Requirements (journeys & features)
No user journey is this promise (it's a stance the whole surface inherits) — its requirement form is the deployment stance + the BYOAI gate option (the /gate three-way entry: Code / BYOAI / Request access) + the connectors admin journeys.
L3 · Design decisions
Single-box compose, read-heavy/write-light, "stays trivially self-hostable" as THE invariant (deployment). the one-command-deploy cut (owner binds domain/cert). Trust boundary = deploy right, container isolation, no extra plugin sandbox in core. Creds never cross (connector-plugins, cryptobox AES-GCM). Egress fences (connector-egress-guard). Sandbox no-net + capsocket narrow verbs. BYOAI containment (byoai-envelope, byoai-browser-vault). Origin 3-tier trust (mcp-capability-plugins).
L4 · Engineering artifacts
docker-compose.prod.yml (9 services — app, backend, builder, im-bridge, db, redis, gotenberg, meilisearch, minio; no proxy — TLS is the owner's; every published port binds 127.0.0.1 by default since 2026-09-01 fc841f41f, APP_BIND_HOST opens the app deliberately), cryptobox, sandbox/sandboxws (bwrap, --unshare-net), storage (MinIO), owner_connectors tables, instance_settings (allowed_domains) + owners.public_url.
L5 · Verification
Connector red-contract region H largely built (connector-security / connector-secret-no-leak suites; part of the mock-infrastructure TODO tail). Sandbox hardening tests. check-connector-boundary lint.
Status & gaps
The stance is structurally everywhere but its adversarial verification is the thinnest part — region-H red contracts are mostly there now (e2e/test/connector-security.spec.ts, 11 tests, the 302→internal-net redirect case still fixme; connector-secret-no-leak.spec.ts), but there is no pen-test-style e2e; the one manual pentest (2026-09-01) produced fc841f41f (127.0.0.1 binds, code out of Referer) and 1ca9d9564 (64-bit code suffix, public/anonymous spend metered — gas-public-spend-is-metered.spec.ts). One honest tension to record: the platform-ification (the externalization migration) is architecture-driven with no vision-level promise behind it — its best available justification is THIS chain's "unit of ownership" prediction (plugins = the subagent economy), and that link is currently implicit, not written anywhere in the product docs.