Known state

What has been built and tested as of the date below, how the guards were checked, what the clean-install script proves, the ONNX Runtime version and why, what is not built, and the CI gate.

01Known state, 2026-09-23

Built and tested: the four gates, users, groups, agents and tokens with CLI administration, folder rules, password sign-in and sessions, agent tokens and MCP over HTTP, trust settings with an append-only change record, retrieval tuning read from settings on every search, a sources registry with recorded ingest runs and a chunker and a reader chosen per source, the reader seam, the extension host with its allow list and prem extensions, the conformance kit and the sample extension proven end to end, where each agent's model runs with the reserved hosted-model group, one seam for the ways a person signs in, groups mapped from an outside directory, per-deployment tool text, audit retention with prem audit prune, profiles validated, applied and shown, sources with an owner and the hosted-model switch, the connector abstraction, the filesystem connector, ingest with permission-change detection, prefix-scoped orphan reconciliation and skipped formats counted, Open Knowledge Format metadata and bundle mode, hybrid retrieval with the vector leg in process on stock PostgreSQL, numbered migrations with a stale text match body reported as pending work, prem setup for an existing PostgreSQL (14 or later, tested on 17) with a least-privilege application role, a search role behind row-level security, the first administrator, HTTPS, service hosting, a bundled PostgreSQL on Windows and a trusted-proxy setting, prem remove, the administration portal with the review queue and the tuning page judged by the golden set, the CLI, the HTTP and MCP surfaces, the evaluation harness. 1103 tests pass. The guards were checked by breaking them: one-line changes to the access gate (fourteen), the trust and freshness gates (twelve), the sign-in, session and caller guards of the HTTP and MCP surfaces (twenty-two), setup, the certificate and the service registration (twenty-two), the settings, change record and sources guards (forty-two), the bundled database, the proxy and the upgrade (forty), the second line and the locks (forty-six, of which two survive by design: with the application's gate removed, the database policy holds), the portal (nineteen), the text match function's single list condition and the tuning loader (twenty-three, of which one survives by design for the same reason), the chunker seam, the review queue, the settings command, the tuning page and the golden set run (forty-two), removal, the pending kind, the telemetry guard and the provider refusal (twenty-seven, two of them in a Linux container), the extension host, the composition point and the sample (fifteen), the model location, the sign-in seam, the mapping, the tool text and the retention (forty-three), the reader seam, the profile, the switch and the portal (thirty-two), the vector leg and the migration lock each fail the suite, and each of the two ingest safety fixes is backed by a test that fails when that fix is reverted.

scripts/clean-install/run.sh installs on a bare Ubuntu container with no network route out and proves the shipped Unicode library, the first administrator, the API answering over HTTPS as the application role, people signing in and searching over HTTPS, an agent searching over MCP with its token, and an upgrade from a release before row-level security with a rollback. With --offline it runs all of that except the upgrade with no network at all: first a deliberate outbound attempt fails and the cloud embedding provider refuses in one line, then the quick start succeeds, and under strace the ingest and the API connected to nothing but the database. Not yet proven, because each needs a machine this project does not have: the Windows service and the bundled database service starting under their virtual accounts, and prem remove taking them away (an elevated session on a clean Windows machine), the systemd unit under a real systemd host, and a managed PostgreSQL.

ONNX Runtime stays at 1.27.0. Its 1.30.0 build for Linux was measured uploading usage telemetry to its publisher from a long-running process (TLS connections to a collector during the API run, none during setup, ingest or a CLI search), while 1.27.0 made no outbound connection at all; the ORT_DISABLE_TELEMETRY environment variable stops it and the runtime's own API switch does not. PremAgentic now sets that variable itself before the runtime loads, in the native environment on Linux, with a test, and a later version is taken only after the same measurement on Linux and on Windows.

Not built: sign-in through a company directory, any connector beyond the filesystem, reading a file share's own permissions, Word, PDF and Excel readers (the reader seam is there; those come as the first extensions), a packed conformance kit, an installer package, and a calibration command for the no-answer floor.

CI builds with NuGet audit findings as errors, so a dependency that picks up a known advisory fails the build. That gate was checked in both directions: it failed on SSH.NET 2025.1.0 (two high-severity advisories, pulled in by Testcontainers.PostgreSql 4.13.0, test-only) and passes now that the test project lifts it to the patched 2026.0.0.