AI transparency

Deterministic by default. Optional model advice is labelled and non-authoritative.

Runrail's core review, checks, evidence, and recommendation work offline and does not require a model provider. DeepSeek is an optional customer-controlled BYOK second opinion with a fixed input and output contract.

Human decision remains required. Model output cannot execute commands, change a patch, apply source, approve a merge, grant entitlement, or control the Runrail runtime.

What uses AI

Only the optional runrail recommend --provider deepseek --allow-network command calls an external model. The desktop and CLI identify the provider, model, fixed candidate IDs, confidence, abstention state, and authority: none in the resulting local receipt.

The default runrail recommend command is deterministic and offline. The browser workspace verifies a user-selected receipt locally and never calls a model provider.

Exact data boundary

the request leaves directly from the customer machine to the fixed DeepSeek API endpoint
only bucketed counts, booleans, schema version, and allowlisted extension counts are transmitted
source, diffs, paths, file names, commits, repository identity, task text, raw verifier output, audit ID, and provider key are excluded
the provider key is read only from the dedicated local environment variable and is not persisted or logged by Runrail
raw provider prose is rejected; only fixed candidate IDs or ABSTAIN are accepted

Limits and customer control

Model advice may be incomplete, wrong, or unavailable. It is not a code review, security assessment, test result, legal conclusion, or approval. The customer decides whether the optional transfer is permitted for its environment and remains responsible for tests, review, merge, and release.

DeepSeek is not required for any deterministic Runrail function. Disabling the BYOK environment flag or omitting --allow-network prevents the provider call and leaves the offline recommendation available.