Trust Boundary — What Is Local, What Is Server

Agent processes and file operations run on the execution machine; the aachat server shares and stores Project documents, conversations, and execution records. That does not mean "fully local" or "the server stores metadata only." Use this page as the source of truth for security, data location, transport, and outage behavior.

There are three execution and storage layers.

Layer	Execution and storage
local agent runtime	Claude Code / Codex and file operations, raw inference traffic to the LLM provider, session environment secrets, workspace repo
Project HTML viewer browser	JavaScript authored under project `html/` executes in each member or public-share viewer's browser
aachat server	Project messages and execution records, Shared Documents, session transcripts, Project Media / HTML, credentials and access control

Local agent runtime

The coding-agent process and workspace file / command operations run on the owner's machine. The local runtime connects to the LLM provider, where provider inference is performed. Permissions follow Claude Code / Codex, with allow, deny, and interruption available from the WebUI Workspace panel
Raw inference traffic to the LLM provider originates from the local runtime. aachat does not run the LLM or meter and bill its tokens
Ordinary workspace and agent repo contents are not uploaded to the aachat server to run a session. Explicit project projections under docs/, media/, and html/ are the exception
Session environment secret values live in the owner's ~/aachat/.run/.env or Infisical CLI. Only names approved per agent in ~/aachat/.state/env.toml enter a session (Environment)
The agent repo itself lives on GitHub and in a local clone, not on the aachat server. Session stderr logs are also local under ~/aachat/.run/logs/

What is sent to and stored on the aachat server

The local runtime does not use WebSocket alone. WebSocket carries real-time runtime control and delivery; HTTPS APIs handle persistence and project operations.

project messages, Project Timeline, Asks, search indexes, membership, and roles
Shared Documents. The server is canonical; local aachat/projects/ is a projection synced while aachat up runs
Session records and transcripts. Session events persisted on the server include user and agent messages, display representations of reasoning and tool calls, and execution configuration and usage. This does not mean raw LLM-provider traffic passes through the server
Project Media; Project HTML source and serving snapshots
the agent catalog, skills / Skill Ledger, templates, and the Company model (Concept / Entity)
External Session Run credential configuration and token hashes. The token value is shown only when issued (External Session Runs)

Connecting an ordinary development repo with aachat init does not store that entire repo on the server. Do not place confidential code you do not want on the server under project html/, docs/, or media/.

Secrets and external credentials

Type	Storage	Recipient
session environment secret	Owner's local provider (`.env` / Infisical)	Local agent sessions whose name is approved in `env.toml`

The platform contract avoids intentionally printing secret values, but it cannot guarantee that local agent code receiving a value will never transmit it. Minimize approved secrets and review the code and authority that receive them.

The Bearer API key for an External Session Run is separate again. Its value is shown only when issued; the server stores a token hash and the fixed agent / mode / repo configuration. It is not injected into a workload. It authorizes an external system to start a new session (External Session Runs).

Project HTML viewer browser

Project HTML source and serving snapshots are stored on the server, but authored JavaScript executes in the browser of each member or public-share viewer who opens it. Delivery security headers use CSP to block framing, objects, base-URL changes, ordinary forms, and Workers, while Permissions-Policy disables device APIs. The CSP does not define script-src or connect-src; scripts can therefore run and initiate network requests under browser rules. Review generated HTML before opening or sharing it, and do not embed secrets or privileged credentials (HTML).

Authentication and writes

CLI authentication uses the local gh token to issue a short-lived JWT cached at ~/aachat/.run/tokens/user.jwt. The GitHub token itself is not stored in the project
aachat init writes only inside the connected repo and ~/aachat/.state/repo-connections/. Writes outside the repo and through symlinks are rejected
Each member using a team default workspace repo needs their own GitHub credential, repo read/write access, and organization SSO authorization where required. aachat does not grant repository access (Teams)

During a server outage

An already-running coding agent can continue local file operations and provider requests during an aachat server outage, provided its runtime, network, and LLM provider remain available. HTTPS API / WebSocket-dependent transcript persistence, messages, Shared Documents sync, new session starts, follow-ups, and handoffs stop. Project projections re-sync after recovery while aachat up is running.

Guarantees not implemented or evidenced

aachat has no mechanism that restricts a local agent runtime's network destinations. networking.type in environment.yaml is declaration-only. Use the Claude Code / Codex sandbox and permissions when restrictions are required
Current public documentation does not evidence SSO / SCIM / SOC2 / immutable audit logs or a complete retention and deletion guarantee for server data. Do not promise them

Quick answers

Question	Answer
Where does the LLM run?	At the LLM provider reached by the local Claude Code / Codex runtime; the client process runs on the owner's machine
Does session conversation reach the server?	Yes. The transcript, display representations of reasoning/tool calls, and execution metadata are persisted over HTTPS
Is WebSocket the only transport?	No. WebSocket is for real-time control; HTTPS APIs persist and operate on projects
Are all secrets local?	Session environment secrets are local. External Session Run credentials are issued once and stored as hashes on the server
What is canonical for Shared Documents?	The server. Local `aachat/projects/` is a projection
Where does agent-written code run?	Session code is local; Project HTML JavaScript runs in each viewer's browser
Where are conversation and execution logs?	Transcript on the server via `session read`; stderr local via `session logs`
What stops in a server outage?	Persistence, sync, messages, and session coordination. Existing runtime file operations and provider requests can continue if those dependencies remain available

Structured data and public access

Project Database rows live in a server-managed Cloudflare D1 database for each ordinary Project. Server-side Postgres holds its metadata and schema cache; db/schema.sql is a read-only local projection and db/migrations/ contains migration sources. This is another explicit Project data surface: local migration sync does not execute SQL, and editing workspace code does not automatically upload it into the database. A running covered Session uses role-checked server operations. The WebUI table browser is read-only.

New database operations stop when the Project is no longer active. Accepted work can finish, and Project deletion waits for query leases, migration reconciliation, and physical database deletion. A deleted local file is neither a rollback nor proof of server erasure.

Public shares deliberately cross the membership boundary. Anyone with a valid Markdown token can read its scope without logging in. A document token reads the current document and authorized media dependencies; an Admin-created context token can read Project records, documents, and Project session transcripts, including later content. These are live reads, not immutable exports. UI links last 7 days; authorized creators/Admins can revoke them as described in Sharing. Copies already downloaded cannot be recalled.

Media /m/<uuid> URLs still require membership unless access is delivered through an authorized share dependency. Share HTML exposes a built static surface and executes its JavaScript in the recipient's browser; it does not grant the author's server credentials or database access. Before publishing, inspect both content and dependencies and choose the smallest suitable sharing scope.