Deployment boundaries

Published 2026-10-03 · Updated 2026-10-03

The project website, authenticated gateway and self-hosted services have different responsibilities.

Keep the runtime self-hosted

Cloudflare serves this website. Rebekah's Nix-built OCI runtime hosts the agent, inference and evidence services on the operator's machine.

Follow the canonical deployment contract for image pins, per-service isolation, secret injection and container verification. Ephor remains an explicit opt-in integration.