NoirCode Deployment and Privacy: What You Can Specify

This replaces the idea of a routing and privacy specification. NoirCode does not ship a policy engine that classifies tasks, redacts secrets, chooses models by budget, or validates one model’s output with another. The controls below are the ones the server implements.

How a request moves

client (TUI, mini, desktop, web, or noircode run)
  -> local session
  -> agent tools, after permission checks
  -> provider adapter for the selected model
  -> that model's endpoint

The selected model is the session model, the config default, the --model flag, or the agent file’s model. A variant is a suffix on that id. There is no routing.strategy field and no classify_task step.

The request the provider receives is the prompt for that step: instructions, included conversation, tool schemas, and tool results already collected. It is not a JSON envelope with task.type, privacy.redaction_enabled, and a file list chosen by a context engine. Files appear because a tool read them.

Timeouts and retries

The server schedules session.retry.scheduled after an error and tries the same step again. You do not configure exponential backoff, jitter, or a soft timeout that fails over to another vendor. Interactive work and noircode run use the same session loop. A long command is a shell tool call, subject to permissions, not a separate ten-minute “background agent” timeout profile.

Context limits

Compaction is the overflow mechanism:

{
  "compaction": {
    "auto": true,
    "keep": { "tokens": 15000 }
  }
}

Automatic compaction is on by default. It summarizes older conversation and keeps the recent window. You can also post /api/session/<id>/compact. Compaction is lossy. It is not a retrieval pipeline that ranks 5,000 files.

Privacy settings that exist

Use permissions to block paths and commands, and policies to block providers and tools.

{
  "model": "anthropic/claude-sonnet-5-5",
  "permissions": [
    { "action": "read", "resource": "*.env", "effect": "deny" },
    { "action": "read", "resource": "secrets/**", "effect": "deny" },
    { "action": "shell", "resource": "*", "effect": "ask" },
    { "action": "shell", "resource": "git push *", "effect": "deny" }
  ],
  "policies": [
    { "action": "provider.use", "resource": "*", "effect": "deny" },
    { "action": "provider.use", "resource": "acme", "effect": "allow" }
  ],
  "providers": {
    "acme": {
      "name": "Internal",
      "env": ["ACME_API_KEY"],
      "package": "@noircode/ai/providers/openai-compatible",
      "settings": { "baseURL": "https://llm.internal.example/v1" },
      "models": { "coder": { "name": "Internal coder" } }
    }
  }
}

Put the policies in managed system config when a project must not override them. macOS managed preferences for ai.noircode.managed outrank the system directory. Console workspace policies apply when that workspace is connected.

There is no redact_secrets, prompt_logging, retention_days, approved_providers list, or external_models flag. Secret handling is “do not read the file” or “ask first.” Provider retention is the endpoint’s policy. Go’s console privacy page is the exception that is documented for that subscription: training endpoints blocked by default, regions limited unless you change them.

Sessions, undo, and plugins

Session rows stay in the local database. Uninstall does not delete them. /undo restores files from snapshots taken around a model step and puts the prompt back in the composer. /redo cancels a staged rollback.

Plugins are packages or local directories in plugins. They run in the server. A malicious plugin is a trusted-code problem. Limit what you install, and use integration.use or tool.use policies where they apply. Prompt injection in a repository is a real risk because the agent follows text it reads. The mitigation in this product is permission rules and the ask prompt before shell and sensitive reads, plus you watching the tool stream. There is no separate output-validation model.

A deployment that matches the product

• One user, one local server, clients attached to it.
• An explicit model, or a private OpenAI-compatible endpoint.
• Permission denies for credential paths and for commands you never want run.
• Managed policies if the machine must not add other providers.
• Provider-side retention reviewed with that vendor, not assumed from a NoirCode config key.

That is the specification the app can enforce.