ECHO · INFERENCE PROXY
Convenience, with its cost named out loud.
Reference v0.1 · stateless · logless · stores nothing
Some people can't run a model on-device and won't hold their own key. The proxy is for them — Oracle that works without a key. The Kernel has already minimized the context package on the device; this server only forwards it to a model and returns the answer. The honest catch: a proxy can read what it forwards. So this one keeps nothing, logs nothing, and refuses what must never cross.
When you can run on-device, do. When you can't, bring your own key. When neither — this, with its costs named out loud. The last choice, never the first.
The proxy is the last resort, by design.
Every inference option carries a different trust cost. Echo ranks them honestly — and the proxy openly sits at the bottom, chosen only when the better two aren't available.
The ideal. No new trust, nothing leaves the device. Hardest to ship, weakest models — for now.
You hold the key; the provider sees the package under your own account. Full capability, one honest trust assumption.
For when BYOK friction is too high. It minimizes the cost to the floor: stateless, logless, boundary-guarded. The last choice — and it says so.
Send the Kernel's minimized slice through the proxy.
Below is a minimized context package — a few self-asserted memories, one derived inference, and a list of items the Kernel withheld. Forward it through the real route handler and watch the proxy answer, refuse key material, and keep nothing.
Forwards the package directly to OpenAI within the shared spending allowance. If unavailable, the demo labels its deterministic fallback.
The honest version of a convenience.
It stores nothing, ever. There is no database, no table, no queue. The request exists only for the moment it is in flight; the answer returns and the package is gone.
It records only provider, item-count, status, and milliseconds — never a package, never an answer. Adding request logging “for debugging” would break the one promise it makes (Law 6).
Structured key material — recovery fragments, private-key blocks — is refused before it can reach a model (Law 3). It is defense-in-depth, narrow on purpose: it never word-matches prose.
A proxy can read the package it forwards. That's unavoidable — and it's exactly why on-device and BYOK come first. The cost is named out loud, not buried.
The guard's honest limit: it refuses structured key material only — it does not word-match prose, because a memory that mentions a passphrase is not a key, and blocking it would break legitimate use. The real defense against keys reaching a package is the Kernel upstream, which never puts them in context. Pretending the guard does more would be a lie the size of the gap.