Security #

thought stream has broad read access, so containment is a product property rather than deployment polish.

Capability separation #

Ingress can observe. Model cells can receive bounded context and produce typed proposals. Dispatchers hold narrow, explicit action capabilities. No layer inherits another layer's authority by proximity.

Private data #

Events carry a privacy class. Public-source derivations remain private by default because selection, routing, and model context can reveal private interests. Credentials, raw provider bodies, model reasoning, and malformed output are excluded from durable evidence.

Public website #

The public server renders only a fixed list of reviewed Markdown files. It has no Jazz handle, event query, manifest reader, trace reader, directory listing, arbitrary file route, or private upstream fallback. Unknown routes stop locally.

Inspector authentication #

The private inspector accepts an allowlisted ATProto identity through the official OAuth client. Protocol state and tokens stay encrypted on the server; the browser receives only a short-lived opaque session cookie. A separately configured Basic credential remains available as a break-glass path during activation.

OAuth proves identity only. It grants no write, publish, connector, model, dispatcher, or PDS-record authority.