Data Privacy No Training

R15 — Data privacy / no training on private code by default

Requirement: Guarantee data privacy / no training on private code by default.

Status in atomic-forge: Depends on the LLM endpoint used — forge is BYO-endpoint (OpenAI-compatible or local Ollama), so this is a property of the chosen backend, not forge itself.

✅ IMPLEMENTED 2026-08-29: the guarantee is now enforceable, not just possible. llm.py::default_llm(local_only=True) (CLI: atomic-forge <phase> --local-only) resolves the endpoint exactly as before, then refuses to proceed (LocalOnlyViolation) unless the resolved base_url is loopback (localhost/127.0.0.1/::1) or a private-range IP — conservative by design: a base_url that can't be identified as local is treated as NOT local, since a false "yes it's local" is the failure mode that actually matters for a privacy guarantee. FORGE_MOCK is exempt (a Python callable, never network traffic, can't violate this by construction). Tests: test_llm.py (15 cases covering _is_local_host's loopback/private/public/missing-host matrix, hosted-endpoint rejection, loopback-endpoint acceptance, the "OpenAI key with no explicit base_url still defaults to a hosted endpoint" edge case, and that the flag is a true no-op when unset). Full suite green.

State of the art

No literature directly bears on this for forge specifically. The nearest research area — training-data memorization/extraction from LLMs — is a property of how a model provider trains and safeguards data, not something a client tool like forge can independently guarantee. Not sourced in depth here since it doesn't change forge's design.

Implication for atomic-forge

No action item for forge itself: the strongest privacy posture forge can offer is what it already has — BYO-endpoint, including fully local inference via Ollama, which structurally sidesteps the question (no data leaves the user's infrastructure at all when run that way). Worth stating this explicitly in docs as the answer to "how does forge compare to Jules on privacy," rather than treating it as an unmet requirement.

Implementation plan

Phase 1 — --local-only flag (~1 day)

• In the LLM-endpoint configuration path, add a flag/config option that checks the resolved endpoint host against localhost/127.0.0.1/an explicit allow-list, refusing to start the run otherwise with a clear error.

Phase 2 — docs (~0.5 day)

• Add the README section named above, cross-linking to this requirement's status as "met, and enforced" rather than merely possible.