richlira

The contract for talking to the operator's local endpoint. One consolidated call, no credentials in code (the egress proxy injects them), and the only domain the sandbox may reach.

The agent's FIRST action. Delegate the RAW document to the local model on the operator's hardware for classification + redaction. The cloud never reads or reasons over raw content; it only receives masked spans back.

Assemble the report object and audit log proving the privacy claim, with raw_sensitive_bytes_processed_in_cloud = 0. Emitted as a file artifact between SENTINEL_AUDIT markers.

Code review con el rubric del equipo. Úsala cuando pidan revisar un archivo o un diff.