Security and Privacy

Security & Privacy

What runs where

Conversations, documents, memory and audit trail stay on the machine Agent Jo is installed on. Point it at a local model (Ollama) and nothing leaves at all. With a remote engine, only the prompt goes out — and only to that provider.

Data at rest

API keys are sealed on the machine — encrypted at rest (encrypt-then-MAC) and never sent anywhere except the engine provider. Everything else lives in .local_agent in your user folder.

Audit trail

A tamper-evident audit trail records what the agent did — and tells you where it stopped and why. This is what makes an unattended agent accountable: you can review what it actually did while you were away.

Release signing

Every release is signed, and you can verify a copy offline in about ten seconds:

pip install cryptography
python tools/sign.py --verify

You want to see:

ok: True
verdict: Signed and unaltered — every one of N files matches.

If a file differs, it names which — a changed agent/tools.py is a reason to stop; a README with different line endings is not.

What signing proves — and doesn't

• It proves the copy is byte-for-byte what the key holder published.
• It doesn't prevent copying — the licence, not the signature, governs that.

The public key (signing-key.pub) is in the repository; the private half never is.

Signing your own releases

The private key belongs on your machine and nowhere else. See SIGNING.md — the short version:

python tools/sign.py --make-key   # once
python tools/sign.py --sign       # before each release

Honest threat model

At-rest encryption protects secrets if a file is copied, synced or backed up without the key file — not against an attacker who already has full read access to your user folder. Guard that folder.