Architecture and privacy
Surface map
Section titled “Surface map”| Surface | Build | Data posture |
|---|---|---|
| AI OS host | Local Vite and Worker-oriented application | Local operator data and guarded actions |
| Product website | Independent Astro static site | Reviewed marketing content |
| Public demo | Cloudflare Pages static output | Reviewed fixtures and no local bridge traffic |
| Documentation | Astro Starlight static output | Curated public content only |
The documentation build reads only its package content and reviewed assets. It does not traverse upward into repository maintenance documents, generated data, or session history. A deterministic scanner rejects path escapes, symbolic links, unsafe references, private path shapes, and secret-shaped values.
Local host flow
Section titled “Local host flow”The local host has four broad layers:
- Local scanners and optional providers collect or derive bounded state.
- Aggregate and scoped scheduler jobs validate and assemble generated data.
- The local development server exposes guarded read and action contracts.
- React routes render visible state, execution results, and recovery paths.
Floating Oracle, Hermes, Claude Code, OpenClaw, Knowledge Graph, Voice, Dream, and extension run controls reuse route-specific local guardrails. They are not public hosted APIs.
Product ownership
Section titled “Product ownership”- AI OS owns the host shell, local cockpit, scheduler, Dream host behavior, local-agent telemetry, and platform documentation.
- Trend Finder owns public trend evidence, source health, scoring, creator workflows, Watchlist, Brief, and Engine Replay.
- AI Rogue owns its browser-local game state and authored experience.
- Claude OS names inherited starter behavior and compatibility contracts only.
Extension and runtime ownership
Section titled “Extension and runtime ownership”Extensions are compiled from reviewed source code. Trend Finder is collector-backed and owns public-source evidence and scoring. AI Rogue reads bounded host data and owns browser-local game state. Neither extension can dynamically load remote code or merge its private state into the other’s data.
The subscription-backed OpenAI provider is host-owned script infrastructure. Dream and Trend Finder can consume it, but Hermes, Oracle, Voice, and Intelligence use different runtime boundaries.
Static documentation security
Section titled “Static documentation security”The first release has no server functions, runtime secrets, forms, accounts, uploads, or analytics. Security headers block framing and unnecessary browser features. Fingerprinted assets receive immutable caching; HTML and missing routes are never handled by a catch-all application fallback.
See Configuration boundaries and Testing and release for the operational checks behind these separations.