Documentation

The broker is a single ~4.9 MB Rust binary that listens only on loopback (127.0.0.1). Your AI agent never touches the shell or filesystem directly — it calls a governed tool, and the broker decides. Every call passes four checks before anything runs:

1. Destructive? rm -rf, dd, mkfs, fdisk, parted and their kin are blocked outright and filed as a proposal instead.
2. Secret? Reads or writes to .ssh, .env, key material and credential paths are refused.
3. Off-box? With the egress lane locked, the governed shell can't reach the internet at all.
4. Risky but allowed? It becomes a plain-English proposal in your queue rather than executing.

The rule when a guard is unsure is simple: the answer is no. The floor is deterministic code, not a model instruction the AI can be talked out of.

Anything that sends, spends, deletes, deploys, or changes who-can-do-what is turned into a proposal. Each one answers five questions without jargon:

• What is this? — in one plain sentence.
• Why now? — what made ORA reach this step.
• If you approve? — exactly what will happen.
• What it touches — money, the public internet, files, or email.
• Can it be undone? — honestly, including "partly".

Friction is proportionate to impact: a harmless local draft approves in one click, while a send that leaves your machine is flagged high impact and asks for a second, explicit confirm — so your attention lands where it matters instead of being worn down.

Every action ORA takes is appended to an audit log that is hash-chained with SHA-256 and signed with Ed25519. Each record commits to the one before it, so the log can only ever grow — you cannot quietly rewrite or delete history without breaking the chain.

A signed tree head (audit_sth) lets an independent witness verify the whole log in one check (audit_verify). If a record were altered after the fact, verification fails and the Today brief raises an integrity alert. This is the difference between "we log things" and "the log can prove it wasn't touched."

The constitution is the set of rules ORA follows on every action. Some are locked — principles like "nothing leaves this machine without intent" — and the broker will refuse to save a constitution that drops them, even if you ask it to in a hurry.

One authority level decides how much ORA may do on its own:

• A0 — advise only; takes no action.
• A1 — always ask first (the default).
• A2 — small, reversible things run on their own.
• A3 — approved playbooks run unattended.
• A4 — broader latitude inside the rules and caps.
• A5 — full autonomy — still under the locked floor.

Raising the level moves the line for what needs a yes. It never disables the fail-closed broker, the spend cap, or the audit chain — those hold at every rung.

The last floor is about data leaving. With the governed-shell internet lane locked (the default), the shell can work on your files but cannot open a network connection — so a prompt-injected or hijacked command physically can't ship your data off the box.

Opening the lane is a deliberate, audited act that restarts the broker into the open state; the other guards — injection detection, propose-then-approve, and the audit chain — stay on either way. You open it only when you mean to, and you can see at a glance whether it's locked.

ORA runs 3D3D's real operation: it works a lead pipeline, drafts outreach and email replies, produces invoices and quotes, and keeps the books of what it did — with you as the only approver. Every outward action (a send, a publish, a charge) is a proposal first.

A done-for-you setup wires your own operation in the same way: your constitution and authority level, your spend caps, your models running local-first, and your playbooks under Ops. See Get ORA for the setup path, or Sovereign AI for running it entirely on your own hardware.