Confidentiality and Guardian

Confidentiality is an architecture, not a promise. One way out, one class per request, and confidential work can only reach the models you marked safe.

One class per request

Every request carries a class, open or confidential, in the x-coeos-class header. A request without a class is treated as confidential (fail-closed).

Web app: a Confidential switch per conversation, on by default. Switching a conversation to open is only possible if the instance allows it.
CoeOS Desktop: a run starts open; Confidential is chosen in the composer or in Settings.
The lock: a conversation that sent a confidential turn, even a failed one, never goes back to open. The client keeps the rule; the box only sees one request at a time.

Where confidential work goes

Provider safety. Every provider is declared in the box with its safety: safe or not, and its type, local (your machines) or ZDR/DPA (a cloud provider under a data processing agreement, with zero data retention).
The Local table. Confidential routing, axis by axis, is a separate table composed in the box from safe models only. The administrator manages it.
A safe decider. The model that classifies a confidential request on an axis is itself safe.
No fallback. If the confidential target does not answer, the turn fails; it never falls back to an open model. Open work, by contrast, has a fallback cascade to another provider or model.

Level	Where the Local table points
Open	EU providers under DPA + ZDR, or no distinction if you choose so
Hybrid	a model on your premises (OdyssAI-X)
Local	your cluster

The box verdict and the audit log

With every answer, the box returns its verdict in x-coeos-decision: requested class, served class, provider, model, axis, use of the decider. The client audits it before displaying the answer. Every egress attempt is written, before sending, to an append-only audit log that a DPO can export.

Memory and knowledge, split by class

Memory is read through a single gate that receives the class of the turn: an open turn never sees confidential memory (a canary test checks it continuously). Each document base carries one label, open or confidential, and a base whose processing goes through a cloud without a DPA is never served to a confidential turn.

Guardian, today and in V2

Today, Guardian is the governance layer: classes, provider safety, the box verdict, the audit log, base labels. It reasons on labels, never on document text. The operator can switch it on or off per instance; when off, every request is treated as open (a demo instance with no confidential target, for instance).
In V2, detection: Guardian will spot personal data, client files and trade secrets in an open conversation and propose switching to confidential. Detection and decision stay apart.