Your compliance team wrote this page. We just answered it.

The fields come from your file. In the CSV you pass to the measuring command, every column beyond the first two is a field to extract, named by its header — nothing else to configure. The question put to the models is built from the column name, so a field this repository has never seen gets asked about without anyone writing code.

Your house rules enter as regexes and become a tier measured like any other — regexes only: your arbitrary rule code stays yours, and the tool says plainly it cannot see it. A filled‑in questionnaire becomes the assumptions of a run.

Four encoder models run inside the process, pinned by revision; three generative models run through a local Ollama, pinned by digest — and the generative models are optional: without them, four tiers are measured instead of seven. The only network call on the measurement path is the generative host, and it is verified local immediately before every call; pointing it at a remote machine makes the tool refuse to start unless an explicit override flag is typed by hand.

The watching is published too: an egress run observed 0 connections over 21 samples during a whole pass on client cases. Its own file states the limit — sampling is a floor, not a kernel capture.

Almost only once. The first measurement downloads 1.3 GB of pinned model weights from huggingface.co and says so before doing it. After that, one small call remains, measured and admitted: the model library asks huggingface.co for a public metadata file each time the extractors load — upstream behaviour, nothing of yours in it, and the offline flag turns it into a named refusal. The test suite downloads nothing, and the public benchmark is the one command that fetches a dataset: it comes down, nothing of yours goes up.

Closed network: the weights export to a USB drive on one machine and import on yours, every file checked against its SHA‑256 and pinned revision before anything is written. One honest stop sign: because of the metadata call above, the encoder tiers cannot yet run fully air‑gapped — under the offline flag the tool refuses loudly, cause named, rather than breaking mid‑run.

Nobody. Measurements on your data live in a folder git ignores, so nothing measured can travel into a repository. The file the tool hands back contains aggregates only — and a test holds it: the suite runs the tool on sentinel values and fails if any of them appears in the output.

The reverse direction holds too: when your own chain is graded, the outcomes file carries verdicts, never the values.

Then the report says so. Your current chain enters the record as a tier, ranked with the others — and when it wins, the output prints that it wins outright on this sample. Under 20 observations the tool refuses to recommend anything at all rather than dress up noise as advice.

The repository leans into this: its own README says the answer is rarely “buy the bigger model”, the validation dossier has a mandatory What gets worse section, and on the measured corpus 3 of the 5 fields are already carried by regexes at zero cost. The cheapest recommendation is on the table from the first line.

The evaluation grant runs 30 days on your own data, internally. What installs: Node 24 or newer on macOS or Linux — Windows is not claimed — then about 400 MB of packages and 1.3 GB of weights on first measurement. The published pass took 32 minutes of measurement on the machine named in the sealed record. The generative tier is 8 GB more, and optional.

And before installing anything at all: one script with zero dependencies reads the sealed records on a fresh clone and prints the conclusion in under a second.

Three tiers, one of them paid. Anyone, with no time limit, may read, study, fork and use the code noncommercially. An evaluating organisation runs it 30 days on its own data. Commercial use is a separately negotiated licence — the public licence, in its own words, is not what a client buys. Stated plainly: it is not an OSI‑approved licence, and some organisations exclude such licences from spontaneous adoption by policy; that has no effect on a negotiated engagement.

The dependency surface after you fork: 50 permissive packages, 1 with obligations, 0 blocking — the one obligation only bites the day the tool ships as a sealed binary, which it does not.

Because they are recomputed, sealed, signed — and retracted when wrong. The test suite first checks that the README, the landing record and the dossier still match the code, then runs 596 tests across 66 files, counted from the sources. The security and licence documents are generated, marked as such, and fail the suite when they drift. Measurement records carry a fingerprint, and a hand‑edited one is refused. Reports are signed; the public key lives in the repository and a bundled script verifies any report without trusting us.

The uncomfortable parts are published too: a retraction file lists every published conclusion that turned out to be wrong, and the secret sweep across 633 commits reports 0 undeclared secrets reachable from HEAD — zero among the 20 forms the sweep looks for, which is what a sweep can honestly say.