Safety and data
What stays on your machine, what a step can reach, and what needs your approval. These pages describe the shipped factory. Limits sit next to the protections.
What stays on your machine, what a step can reach, and what needs your approval. These pages describe the shipped factory. Limits sit next to the protections.
| Question | Short answer |
|---|---|
| Where does the factory run? | On your machine. It starts no cloud agents or remote workers. |
| What leaves my machine? | What an agent step sends to the model provider you configured, as with any session of that tool. Telemetry is off unless you turn it on. |
| Can it push or merge? | No. It delivers a local commit; you merge and push. |
| What can a step touch? | Its worktree and its own folders. Optional OS sandbox (sandbox.mode: required) contains writes; the network stays open. |
| What about secrets? | Kept out of kusaw.yaml by name, passed only to the steps you name, and redacted from logs. |
| What needs my approval? | Gates you put in the pipeline, and anything outside the factory such as merging. |
Where does the factory run?
On your machine. You install a local binary and serve the factories you registered. The factory starts no cloud agents and no remote workers. The Dashboard, when you open it, is on 127.0.0.1.
What leaves my machine?
An agent step sends the code and text it reads to the Claude Code you already configured, as with any session of that tool. The factory does not ask for credentials or pick a model. Telemetry is off unless you turn it on. Detail: What stays local and what doesn't.
Can it push or merge?
No. Delivery is a local commit and a SUMMARY.md in the run directory. The factory does not push and does not merge. You do that yourself. Detail: What needs your approval.
What can a step touch?
A step is meant to work in its worktree and the run's own folders under data_dir. With sandbox off, the process still runs with your user's permissions. With sandbox.mode: required, the factory wraps the step in Seatbelt or Bubblewrap so writes stay in the worktree, artifacts, and a private temp folder. The network stays open. Detail: What a step can reach, OS sandbox.
What about secrets?
Do not put secret values in kusaw.yaml. Pass extra environment by name through access.env.allow and step.env_allow to the steps that need it. Redact patterns strip matches from logs, events, and artifacts. Redaction does not stop an agent step from sending a secret it reads to the model provider. Detail: What stays local and what doesn't.
What needs my approval?
Gates you put in the pipeline wait for you. Self-improvement proposals are not applied until you approve them. Merge, push, and publishing stay outside the factory. Detail: What needs your approval.
Editor schema for kusaw.yaml
Put this comment on the first line of a kusaw.yaml. Editors that speak the YAML language server then check the file against a schema on disk:
What stays local and what doesn't
The factory's own files stay on the machine that runs it. What an agent step reads can leave, because that step calls the model provider you configured. Telemetry stays off until you turn it on.