Rules decide. You confirm.

Documented risk levels, confidence, status verdicts, and proposed actions are determined by readable rules — not decided by the language model. Each score can be inspected and argued with, and the reasons behind every point are written down rather than hidden.

Confidence is kept separate from risk. It expresses how complete the view was, and it is bounded rather than presented as certainty.

The optional local model is not the authority for security decisions. Within documented constraints it may narrate an already-decided report, or choose one read-only tool for a question the rules do not recognise.

It does not decide risk levels, does not receive access to action tools, and is intended to run locally when enabled and configured.

Destructive actions are proposals until a person confirms them through the intended confirmation control. The target is re-checked at the moment of confirmation: if the target changed or a guard now refuses, nothing runs and the reason is shown.

A proposed action is not the same as an executed action. Typing a simple affirmative sentence is not a way to bypass the confirmation gate.

Logs and evidence-related mechanisms are documented as hash-chained and tamper-evident: a later edit or deletion can be made visible rather than silently accepted.

This does not amount to a claim of tamper-proof storage against an administrator, a fully compromised machine, or an attacker with equivalent privileges, since those cases are not proven by the threat model.