What stays local and what doesn't
The factory's own files stay on the machine that runs it. What an agent step reads can leave, because that step calls the model provider you configured. Telemetry stays off until you turn it on.
The factory's own files stay on the machine that runs it. What an agent step reads can leave, because that step calls the model provider you configured. Telemetry stays off until you turn it on.
The factory's data folder
Each factory is one kusaw.yaml plus one data directory. The default folder is .kusaw beside kusaw.yaml. It holds the database, runs, worktrees, and specs. The registry only stores where those files live. Relative paths in kusaw.yaml are resolved beside that file.
Worktrees
A run gets a worktree per repository it touches, under the data directory. A step is meant to edit that worktree. Delivery is a local commit on a branch in that worktree. The factory does not push. With sandbox off, the process can still reach paths outside the worktree. With sandbox.mode: required, writes stay in the worktree, artifacts, and a private temp folder. See What a step can reach and OS sandbox.
What an agent step sends
An agent step sends the code and text it reads to the provider for that step. In this version that is the Claude Code you already configured. The factory does not ask for credentials or a model. Treat it as you would any other session of that tool: if the step can read a file, that file can go to the provider.
The Cursor CLI is not a step provider in this version.
Telemetry
Telemetry is off until you turn it on. Nothing is sent before that. There is no built-in destination. When you enable it, the only level in this version is metadata: run and factory ids, outcomes, costs, hashed repository ids, and similar fields listed on that page. Task titles, spec text, diffs, logs, prompts, and file paths are not sent. The token and signing key are read from environment variables named in kusaw.yaml; those values are never written into the file.
Connectors
Connectors are user-declared MCP or command programs the factory talks to as a client. Intake items and tool results are fenced as untrusted connector:<name> data. Log-store context is redacted (secret-looking values, bearer tokens, keys in URLs, email addresses) before it is cut and fenced. Secrets in connectors.<name>.mcp.env reach only that stdio process; secrets in mcp.headers reach only the broker's HTTP requests to that URL. They never appear in a step, agent session, custom step, proxy, log, or event. Write-back tools are outside effects held at the human gate. Agents call listed read tools through the per-attempt factory-connectors proxy.
Safety and data
What stays on your machine, what a step can reach, and what needs your approval. These pages describe the shipped factory. Limits sit next to the protections.
What a step can reach
A step is meant to work in its worktree and the run's own folders under [`data_dir`](../config.md). With [`sandbox.mode`](../config.md) off (the default), the process still runs with your user's permissions: it can read, write, and open network connections as you can.