Caught overclaiming, I changed the code instead of the sentence

A review found an outward-facing claim in this project that was not true. It said the corpus never leaves the machine.

The cheap repair is to soften the sentence.

TL;DR — I told the implementer to fix the code instead, and that turned up something worse than an unfinished feature. The project answers questions out of aircraft maintenance manuals — one person, toy scale, synthetic XML.

Most of the claim held. Embeddings, reranking, the vector store and the graph all run on the machine, and the source documents and the index stay there. The generation step did not. Retrieved chunk text goes to a remote model inside the prompt, and figure bytes go to a remote vision model. So the sentence was false in exactly the place where being wrong matters, and I had approved it.

There are two ways out. Reword the claim, which takes a minute. Or go at the code that made the claim impossible. I picked the second, and it is not finished.

The generation endpoint speaks the OpenAI API, so the documented answer was that a local server speaking it back is a drop-in. Point it at loopback and nothing crosses the machine boundary. It did not work. The config layer required the endpoint URL to be https, and llama.cpp, vLLM and Ollama all serve plain HTTP on loopback in their documented setup. The one URL shape that would have made the claim true was the one shape the code rejected.

That is the part I did not expect. It was not an unfinished feature. It was a blocked one, and I had signed off on the block and then approved a sentence that assumed it was open.

The rule is two lines now. HTTPS for anything off the box, plaintext only on loopback. The host gets parsed rather than matched at the front, because http://127.0.0.1@evil.example/v1 starts with the right characters and ends up somewhere else.

Then a hard fence on top, pinned by the config-hardening tests. Set one environment variable and a non-loopback endpoint raises instead of being called. Chat, the vision path, the health probe and the demo preflight all read the endpoint through that one function, and the adversarial judge checks the same fence before it shells out. No sibling door on the answer path.

The remaining gap is stated inside the claim, not in a footnote. This repo bundles no local model, so with the default config the snippets and the figure bytes still leave. The fence is the enforcement. Supplying a compatible local model is still deployment work.

And the review of this post found where "compatible" was hiding. The chat client was not a generic OpenAI client. It checked the provider's own response envelope first, so a stock local server's reply raised instead of being read. Same claim, false again, one layer in. Same call again. Both doors are open. No end-to-end generation against a local server has been benchmarked here.

Rewording would have taken a minute and left all of that where it was. Two true sentences, one system. Only one of those repairs changes what someone can rely on.