ADR 0008: The AI assist, and the boundary it lives inside

Date: 2026-09-11 Status: accepted

Context

The deterministic scanner (ADR-less, but see phase 8a) resolves the large majority of repositories: a Chart.yaml is a Helm chart, a Dockerfile is a build context, a postgres image is a shared dependency. That is pattern matching, it is exact, and it works in a sealed room.

What it cannot do is read a repository that expresses its deployment in a way nobody has seen before, write a Dockerfile for a service that has none, or turn a wall of Helm template errors into a sentence a developer can act on. Those are judgement, and a model is genuinely better at them than a rule.

The difficulty is that Nazeel's central promise to a bank is that it makes no outbound calls. A feature that sends repository contents to a model is, on its face, the exact thing that promise rules out. This ADR is about why it can exist anyway, and what has to be true for that to hold.

Decision

It is off by default, and Enterprise-only. A customer who never touches it has a product that behaves exactly as the whitepaper describes. Nothing is configured, no endpoint exists, and no code path can reach the network.

The model never acts. It returns text. A person reads it, decides, and then makes the change through the normal API, which applies the same RBAC and the same admission webhook as a change someone typed. The audit entry records the model and the person. There is deliberately no endpoint that applies a proposal, and the proposal type has no field that anything could apply: the shape of the API is the guarantee, not a policy in a document.

The endpoint is the administrator's, and the allowlist is the control. allowedHosts is checked immediately before every connection, not only when settings are saved, because a configuration can change under a running process. An empty list allows nothing, so enabling the feature and forgetting the list does nothing rather than quietly reaching out. * is not a valid entry: an allowlist that can be written as "allow everything" is not an allowlist, and somebody would write it.

This is what keeps the promise true rather than merely intended. "Nazeel makes no outbound calls except to endpoints your administrator wrote down" is a claim a security team can check, in one settings screen, and enforce with a NetworkPolicy besides.

Two protocols, and that is a deliberate ceiling. Anthropic's API, and the OpenAI-compatible protocol that vLLM, Ollama, llama.cpp and every sovereign deployment speak. One wire format covers every self-hosted option a bank would actually run; the other covers Claude. A third would be a third thing to keep working for no new capability.

For an air-gapped customer this is the whole point: the endpoint is a Service inside their own cluster, and the feature works with no route to the internet at all.

What is sent is bounded, redacted and stated. File names, manifest and Dockerfile contents, and error text, for the repository someone asked about. Bounded by maxInputBytes. Redacted first and truncated second, in that order, because truncating first could cut a credential in half and leave a fragment the patterns no longer match.

The redaction is deliberately aggressive: PEM blocks, URL credentials, anything named like a secret, the well-known token shapes, and the data: block of a Kubernetes Secret. A false positive costs the model slightly less context. A false negative costs a customer a credential in a request they cannot recall. The response says whether anything was removed, so nobody has to wonder what left.

Never sent: audit entries, user records, licence details, or any Secret the product holds.

The prompts are visible and editable. Shipped in the binary, readable in the dashboard in both languages, editable, resettable, and every change audited with who made it. A bank will want to read what is being sent on its behalf. A prompt nobody can inspect is a prompt nobody can approve.

Transcripts are not retained by default. The audit log is exportable and a prompt carries repository content; storing it there by default would quietly widen what an evidence package contains. retainTranscripts exists for customers who want it and says what it means.

Consequences

• The whitepaper's outbound-calls section has to name this feature. It does, and it says it is off by default and allowlisted when on.
• A customer running a sovereign or on-premises model gets the full feature with no external dependency, which is the only version of this that a Saudi bank will accept.
• A customer using a public API accepts that repository text reaches that vendor. The settings screen says so before the switch, not after.
• Proposals can be wrong. That is the reason a person approves them, and the reason every prompt tells the model to say when it cannot tell rather than to guess convincingly: an invention the reviewer cannot check makes their review meaningless.
• If a future feature ever needs the model to act rather than propose, it does not belong here. This decision is what makes the feature acceptable, and the shape of the API is what keeps it honest.