Air-Gapped Private Execution

Picks the Right Brain for the Job · Shipped · workstation, home

Sensitive credentials and system configs never egress to cloud APIs. Fail-closed, not fail-open.

A safety boundary that prevents queries involving SSH keys, firewall rules, or private configuration files from ever being evaluated by remote third-party cloud endpoints. When sensitive context is detected, the agent latches to strictly local inference.

The secure context evaluator in the agent state machine detects sensitive tokens and system file paths. When triggered, execution locks to local loopback endpoints (Ollama, Metal, vLLM). If no local model is available, the turn halts and informs the user rather than silently downgrading to a cloud model.

Limits and invariants

Fails closed: absence of a local model means the query is refused, never silently sent to the cloud.

Where this lives

• halbert_core/halbert_core/agents/states.py
• halbert_core/halbert_core/model/tier_router.py