fortytwo
//trust

Local-first, with the boundaries stated.

What fortytwo enforces, what it leaves to the runtime, and where each claim comes from. This is a description of behaviour, not a promise of safety.

// 01where data lives

Where data lives

Local-first means your project directory, not our servers. There are none.

Memory is a local database
SQLite with sqlite-vec on your machine. Embeddings come from a local Ollama model by default.source: memory/README.md, installer/README.md
Identity is plain files
Persona and owner context render into files you can read, edit and version.source: persona/README.md
Your model provider still sees your prompts
The runtime you choose sends context to its provider, as it always does. fortytwo does not change that.source: telegram/README.md
// 02who can talk to it

Who can talk to it

A channel is a door with a lock. The lock is pairing.

Locked down until paired
With no bindings and no bootstrap list, the bot ignores everyone. fortytwo pair issues a one-time code; a chat redeems it with /login.source: telegram/README.md
Bindings are persisted
Each message is authorized against saved bindings. Authorization works even when memory is absent.source: telegram/README.md
Telegram does not authorize tools
Channels carry messages and identity. They do not grant approvals.source: telegram/README.md
// 03who authorizes actions

Who authorizes actions

The runtime does. fortytwo does not stand between the agent and its tools.

Native permissions are authoritative
Claude Code owns the effective tool permissions. fortytwo does not replace or override them.source: runner/README.md, telegram/README.md
Gate is optional
A fail-closed PreToolUse hook that allows, defers or denies by capability tier. Wire it in if you want one. It is not on the mandatory path.source: gate/README.md
No approval prompts in Telegram
Telegram offers no approval buttons. Conversational confirmation is not durable tool authorization.source: telegram/README.md
// 04content is not authority

Content is not authority

Words in a message, a memory or a web page are inputs to the model. They are not permissions.

Permissions live outside the conversation
What the agent may do is set in the runtime and, optionally, in Gate. Nothing a message says changes that.source: telegram/README.md, gate/README.md
Oneiros has a deterministic boundary
Its tool-free pass can only add plain-text bullets to three profile sections, backed by evidence the owner stated. The model’s judgment is not treated as a security guarantee.source: persona/README.md
// 05enforces and does not

What fortytwo enforces, and what it doesn’t.

fortytwo enforces

  • Which chats may talk to the assistant (pairing and bindings).
  • Where memory and identity are stored (locally).
  • What Oneiros may write to your profile.
  • Gate’s policy, if you wire it in.

fortytwo leaves to others

  • Tool permissions. The runtime owns them.
  • What your model provider does with prompts.
  • Isolation of the agent from your host. That is the runtime’s permissions and your machine’s boundary.
  • Delivery guarantees. This is 1.0 pre-release; crash recovery is best effort.

Back to the overview →