{
  "schema_version": 1,
  "dossier_version": "2026-07-20",
  "last_reviewed": "2026-07-20",
  "review_scope": "Public current-state product boundary; not an external audit, certification, compliance scope, or service-level commitment.",
  "default_product_egress": "none",
  "authentication": {
    "model": "per-principal registry tokens",
    "slug_capability_grants": "implemented",
    "token_expiry": "implemented",
    "token_revocation": "implemented",
    "rate_limits": "implemented per principal",
    "default_deny": "implemented for slug and tool dispatch",
    "access_audit_records": "implemented with a documented full-access owner-allow exception",
    "record_level_authorization": "not established",
    "hardened_multi_tenant_isolation": "not established",
    "externally_validated_identity_controls": "not established",
    "legacy_shared_bearer_compatibility": "available only when the principal registry is absent or an explicit unexpired compatibility block remains",
    "chatgpt_no_auth_mode": {
      "when_enabled": "only through separate operator connector or deployment configuration; the current unified app bearer-gates its MCP and ChatGPT routes",
      "exposure": "six read-only tools: memory recall, memory search, bounded context composition, local-root listing, allowlisted file discovery, and bounded allowlisted file reads; no write or command execution"
    }
  },
  "boundary_rows": [
    {
      "id": "agent-clients",
      "label": "Agent clients",
      "placement": "Same host or operator-selected client location",
      "data_received": "Context selected by the client",
      "default_state": "Outside the product host boundary",
      "control": "Client operator and agent provider"
    },
    {
      "id": "service",
      "label": "Ax0s service",
      "placement": "Operator-controlled host",
      "data_received": "Requests, principal context on authenticated paths, records, recall queries, and corrections",
      "default_state": "Required; bearer-protected in the current unified app",
      "control": "Operator and configured grants"
    },
    {
      "id": "storage",
      "label": "Local LanceDB storage",
      "placement": "Operator-controlled filesystem",
      "data_received": "Records, vectors, provenance fields, and addressable history",
      "default_state": "Required; local",
      "control": "Operator"
    },
    {
      "id": "client-service",
      "label": "Client to service",
      "placement": "Local process or operator-managed network",
      "data_received": "Product requests and responses; bearer credentials on authenticated paths",
      "default_state": "Required path; current unified app is bearer-protected",
      "control": "Operator and configured principal"
    },
    {
      "id": "service-storage",
      "label": "Service to storage",
      "placement": "Local filesystem I/O",
      "data_received": "Stored records and query results",
      "default_state": "Required; no external destination",
      "control": "Operator"
    },
    {
      "id": "network",
      "label": "Operator-managed network exposure",
      "placement": "Outside the application",
      "data_received": "Product requests and responses if remote access is enabled",
      "default_state": "Optional; no public topology is assumed; no-auth connector mode requires separate operator configuration",
      "control": "Operator"
    },
    {
      "id": "artifacts",
      "label": "Model artifact host",
      "placement": "External",
      "data_received": "Request metadata for a model download; model files return to local cache",
      "default_state": "Optional when required artifacts are not cached",
      "control": "Operator configuration and upstream host"
    },
    {
      "id": "external-model",
      "label": "External model endpoint",
      "placement": "External",
      "data_received": "Selected content sent by an operator-enabled workflow",
      "default_state": "Optional; not part of the default local path",
      "control": "Operator and configured provider"
    },
    {
      "id": "form",
      "label": "Website form provider",
      "placement": "External and separate from the product",
      "data_received": "Web3Forms receives name, email, request path, business decision, systems involved, current source of truth, accountable sponsor, acceptable completion receipt, required service-request consent, form metadata, and network or server-log metadata",
      "default_state": "Active on the Access page. Submissions are delivered by Web3Forms (the form processor) to a monitored founder mailbox at chris@ax0s.io.",
      "control": "Ax0s accountable operator and Web3Forms"
    },
    {
      "id": "analytics",
      "label": "Website analytics",
      "placement": "No provider configured",
      "data_received": "Nothing",
      "default_state": "Inactive; no network path",
      "control": "Provider decision pending"
    }
  ],
  "operations": [
    {
      "topic": "Supported deployment",
      "status": "documented",
      "statement": "One self-hosted Ax0s service with LanceDB data on an operator-controlled filesystem."
    },
    {
      "topic": "Required components",
      "status": "documented",
      "statement": "Ax0s service runtime, local LanceDB storage, and an operator-controlled filesystem."
    },
    {
      "topic": "Ports",
      "status": "not yet documented",
      "statement": "No universal public port or exposure contract is asserted."
    },
    {
      "topic": "Default egress",
      "status": "documented",
      "statement": "None from the product service for stored product data."
    },
    {
      "topic": "Secret handling",
      "status": "documented",
      "statement": "Per-principal token secrets and grants are supplied through operator-controlled configuration; no managed secret store is supplied. Legacy shared-bearer compatibility remains until registry cutover conditions are met. Automated secret redaction runs on the Fathom, Gmail, Google Calendar, Google Drive, SignWell, Stripe, and Mercury persistent-ingest paths before any write; the iMessage path and other ingest paths remain unredacted."
    },
    {
      "topic": "Data location",
      "status": "documented",
      "statement": "Local LanceDB directories under the operator-selected data root."
    },
    {
      "topic": "Logging",
      "status": "documented",
      "statement": "Operational logs and metadata-only access-audit records are implemented. External-principal decisions and all denials are recorded; routine full-access owner allows are omitted. No public log-retention contract is published."
    },
    {
      "topic": "Record retention",
      "status": "not yet documented",
      "statement": "No public automatic record-retention promise is made."
    },
    {
      "topic": "Backup and restore",
      "status": "not yet documented",
      "statement": "No application-managed backup or tested restoration claim is published."
    },
    {
      "topic": "Upgrade path",
      "status": "not yet documented",
      "statement": "No public compatibility or rollback promise is published."
    },
    {
      "topic": "At-rest encryption",
      "status": "not supported",
      "statement": "No established application control is claimed; filesystem and volume protections are operator choices."
    },
    {
      "topic": "Security review",
      "status": "no claim",
      "statement": "No external audit, certification, compliance scope, or service-level commitment is claimed."
    }
  ],
  "responsibilities": [
    {
      "area": "Runtime and storage",
      "ax0s_supplies": "Self-hosted service and LanceDB-backed storage path",
      "operator_controls": "Host, filesystem permissions, process supervision, capacity, and physical access",
      "external_provider_receives": "Nothing by default"
    },
    {
      "area": "Authentication",
      "ax0s_supplies": "Principal registry tokens; slug and capability grants; expiry, revocation, rate limits, default-deny checks, and access-audit records",
      "operator_controls": "Principal registry seeding, grants, token issuance and custody, compatibility cutover, and network exposure",
      "external_provider_receives": "Nothing from authentication alone; requests and responses only through a configured network path"
    },
    {
      "area": "Network",
      "ax0s_supplies": "Service endpoint",
      "operator_controls": "Bind address, firewall, remote exposure, transport encryption, and network logs",
      "external_provider_receives": "Requests and responses only when the operator exposes the service through an external path"
    },
    {
      "area": "Models",
      "ax0s_supplies": "Local model-capable runtime",
      "operator_controls": "Artifact cache and any optional external endpoint configuration",
      "external_provider_receives": "Download metadata, or selected content when an external call is enabled"
    },
    {
      "area": "Retention and recovery",
      "ax0s_supplies": "No published application-managed policy",
      "operator_controls": "Retention, backups, restoration tests, and disposal",
      "external_provider_receives": "Nothing by default"
    },
    {
      "area": "Public website",
      "ax0s_supplies": "Static page; analytics currently inactive",
      "operator_controls": "Website deployment and access-form processing",
      "external_provider_receives": "Submissions are delivered by Web3Forms (the form processor) to a monitored founder mailbox at chris@ax0s.io. The product store does not receive the form fields."
    }
  ],
  "disclosure_contact": "chris@ax0s.io; dedicated security channel and policy not yet published"
}