Local intelligence: the model-provisioning ceremony

Status: the provisioning ceremony described here ships in v1.8.4 and was exercised end to end on a clean macOS host from the signed release artifact during the release acceptance drill on 2026-09-06: the signed manifest was verified before the pull, tampered and foreign-signed manifests were refused before any download, and the local route was visible in the dashboard. The bounds below still hold: verification is digest-level (light assurance), macOS is the only host exercised, and Windows needs a manual Ollama install.

Local intelligence is Sanctuary’s own cognition running on a local model through Ollama: the concierge, the sentinel scorer, the gate advisor, the privacy filter, and template suggestion can each be routed to a local model instead of a hosted provider. The dashboard substrate selector and sanctuary intelligence diagnose cover picking and inspecting that routing and work with any model you have installed by hand.

The provisioning ceremony

sanctuary init --provision-local-intelligence and sanctuary protect <harness> --provision-local-intelligence enter the disclosed setup ceremony. It requires an interactive terminal, prints its plan, and asks for one confirmation before any change to the host.

Before any model pull, the ceremony verifies a Sanctuary-signed model manifest that ships inside the release package. The manifest is checked against a key pinned in the build (a dedicated model-catalog signing key, separate from the release-signing key), through a byte cap and a strict parser, and against a byte pin recorded when the package was built. A manifest that is missing, oversized, malformed, signed by any other key, or altered inside the package is refused with a named reason, an audit record is written, and no pull is attempted.

Each check defends against one thing, and it is worth being exact. The byte pin defends against an altered manifest file inside an otherwise intact package. The signature defends against a manifest signed by any other key. Neither defends against a package whose code has itself been rewritten; only the package’s own release provenance covers that.

The first manifest lists the default models for the three hardware bands (8, 16, and 32 GiB of RAM) with their exact Ollama registry digests, so the model that is pulled is the one that was signed.

Checking what is armed

sanctuary intelligence diagnose reports whether local intelligence is armed on a fortress, which model manifest version it is armed to, and the bound model tags with the signed manifest digest each one was verified against. Reading that state needs the fortress credential, so on a host where no credential is available in the session the armed state reads as unavailable, which is a different answer from unarmed. The command writes nothing to the fortress and prints no credential or key material. Add --json for the machine-readable form.

Bounds