ECHO · INFERENCE PROXY
Convenience, with its cost named out loud.
Reference v0.1 · stateless · logless · stores nothing
Some people can't run a model on-device and won't hold their own key. The proxy is for them — Oracle that works without a key. The Kernel has already minimized the context package on the device; this server only forwards it to a model and returns the answer. The honest catch: a proxy can read what it forwards. So this one keeps nothing, logs nothing, and refuses what must never cross.
When you can run on-device, do. When you can't, bring your own key. When neither — this, with its costs named out loud. The last choice, never the first.
The proxy is the last resort, by design.
Every inference option carries a different trust cost. Echo ranks them honestly — and the proxy openly sits at the bottom, chosen only when the better two aren't available.
The ideal. No new trust, nothing leaves the device. Hardest to ship, weakest models — for now.
You hold the key; the provider sees the package under your own account. Full capability, one honest trust assumption.
For when BYOK friction is too high. It minimizes the cost to the floor: stateless, logless, boundary-guarded. The last choice — and it says so.
Send the Kernel's minimized slice through the proxy.
Below is a minimized context package — a few self-asserted memories, one derived inference, and a list of items the Kernel withheld. Forward it through the real route handler and watch the proxy answer, refuse key material, and keep nothing.
Forwards the package to a real model through the zero-config AI Gateway. If it can't reach one, it falls back to the deterministic mock so the demo always answers.
The honest version of a convenience.
It stores nothing, ever. There is no database, no table, no queue. The request exists only for the moment it is in flight; the answer returns and the package is gone.
It records only provider, item-count, status, and milliseconds — never a package, never an answer. Adding request logging “for debugging” would break the one promise it makes (Law 6).
Structured key material — recovery fragments, private-key blocks — is refused before it can reach a model (Law 3). It is defense-in-depth, narrow on purpose: it never word-matches prose.
A proxy can read the package it forwards. That's unavoidable — and it's exactly why on-device and BYOK come first. The cost is named out loud, not buried.
The guard's honest limit: it refuses structured key material only — it does not word-match prose, because a memory that mentions a passphrase is not a key, and blocking it would break legitimate use. The real defense against keys reaching a package is the Kernel upstream, which never puts them in context. Pretending the guard does more would be a lie the size of the gap.