Read the system model, evidence assurance standard, and threat model before selecting a deployment posture.
Current safe baseline
- Keep the server on stdio or loopback unless transport authentication, TLS, proxy trust, and network policy are explicitly owned.
- Keep strict validation enabled and treat
unknownas non-passing. - Admit the default namespace only when the operator deliberately enables it.
- Use least-privilege tool allowlists and deny-by-default schema ACLs.
- Network, remote MCP, subprocess, executable-provider, and remote-evaluator acquisition are not representable in the initial runtime configuration.
- Admit caller material through the hostile caller-evidence carrier only. The caller cannot supply semantic status, observed absence, assurance, or authorization facts.
- Register only named time, immutable allowlisted environment, and
capability-rooted JSON/YAML authorities, each under the bounded
DgValueFormatV1and operator limit profile. - Treat SQLite, object storage, runpack directories, logs, and generated artifacts as hostile inputs on every read.
Evidence posture
The current semantic pipeline factorizes acquisition channel, source identity,
scope, observation interval, assurance facts, independence, policy admission,
and retention. Malformed or forged material rejects admission; operational
acquisition failure mints no semantic evidence; only a canonical admitted
snapshot reaches pure evaluation. False means a valid admitted value failed
its typed predicate. Unknown is derived only from Missing or
Insufficient; it is not an operational error bucket or scalar trust score.
Namespace authority
Standalone OSS uses local validated namespace values and policy. Operators may
inject a product-neutral NamespaceAuthority implementation through server
overrides. That implementation is a trust boundary and must fail closed with
typed errors. Injection does not make the namespace a global lock and does not
provide placement fencing or residency enforcement.
Runpack metadata records none for the standalone authority and
operator_override when an authority is injected. Those labels describe the
configuration seam, not the trustworthiness of its implementation.
Dispatch and persistence warning
The local memory and SQLite stores implement the PF-04 accepted-run protocol, but the broker and stores must not be described as a qualified combined accepted-run plus effect-dispatch protocol. If a deployment performs external effects, its operator must supply idempotency and recovery controls until the separate PF-06A dispatch-model decision, PF-06B local runtime, and PF-06C effect-family recovery/refinement evidence close. PF-06D/PF-06E platform integration cannot substitute for those local dispatch authorities.
Memory is process-lifetime only. SQLite schema 12 is the durable-local profile; every other schema version rejects without migration. Neither profile detects a coherent rollback to an older internally consistent database image without an external anchor.
Mobile and multi-node warning
The current OSS server is not a mobile synchronization protocol, dynamic placement directory, or active-active writer. Offline evaluation may be built around pinned inputs, but offline authoritative mutation, ownership transfer, and multi-node recovery remain target capabilities.