boxmaker/docs/egress.md

Egress

Every outbound network call the project makes, at run time or in development. Nothing else is allowed.

When	From	To	What
Development	cargo	crates.io	Downloading the crates listed in docs/dependencies.md
Development	make verify-device, tools/check-m3a-device.sh	straylight's llama-server	Checks against the real model through a private inferproxy; the script also reads /slots with curl first
Development	make audit	github.com/rustsec/advisory-db	The RustSec advisory database, fetched by cargo deny check advisories
Run time (M2a)	inferproxy	the llama-server router on the host (straylight:11434)	Every inference request loopd makes, forwarded byte for byte
Run time (M3b)	brokerd's egress proxy container, for one http_fetch call	only the hosts the call's grant names, on port 443, at public addresses	The tool's HTTPS request, end to end; the proxy sees only the host name
Run time (M4a)	gatewayd	the owner's Mattermost at https://straylight.scylla-hammerhead.ts.net (tailnet)	REST calls and one WebSocket: the owner's messages in, Boxmaker's answers out. Mattermost stores messages unencrypted in its database; the server is the owner's
Run time (M5c)	memoryd, through roncho	the owner's Honcho at [honcho] url (rift: http://rift.scylla-hammerhead.ts.net:8000, tailnet)	Finished turns (the speaker's message and the final reply), conclusions mirroring trusted memory writes and untrusted notes, deletions of those conclusions; from M5c-2, searches and dialectic questions, from a session of any class (queries are not stored; see the M5c spec, section 8). Nothing written to it from a secret session or above private. Honcho runs its own models on the owner's hosts to derive conclusions (none on the fleet workspace); its server counts telemetry events but sends none (telemetry_events_emitted_total, 0 on 2026-09-27)
Development (M5c)	the design model, planning M5c-1	rift's Honcho	Recording real responses for the tests' fake server, in the throwaway workspace boxmaker-plan-probe only, deleted afterwards
Development (M6b)	the M6b device check	a loopback OpenAI-compatible dummy the check starts on straylight (127.0.0.1)	One chat-completions POST per allowed consult; the check diffs the audit body against a captured request. No internet consult in M6. A live URL later is its own row, grant, and secret

The two run-time rows for M2a and M3b were missing until 2026-09-23; they were added with the M4a spec.