The key lives in .vault/llm/config.json, inside the permission floor: the app cannot read it, and the host makes the call. You send messages and receive text. Everything else here follows from one decision, that the credential and the code that spends it should not sit in the same trust boundary.
That sentence is true, and it is not the whole sentence. The bridge protects the vault's key: it never enters your frame, your bundle, or any message you receive. It is not yet an egress boundary. App frames are not served with a connect-src that blocks direct network access, so a malicious app could still reach a provider itself, with its own credential.
The project's own capability brief puts it in one line, and this site quotes it rather than paraphrasing: "The bridge protects your key; it is not yet a boundary that prevents all egress. This is the gap that turns the current design from a convenience into a guarantee."
So the honest scope is "we protect the credential you trusted us with", not "nothing leaves this frame". Those are different claims and only the first is currently true. The gap, in full, and the fix that would close it.
They differ in who holds the key and who needs permission, and most people assume there is only one. Start at the top and stop as soon as one fits: two of the three cost nothing to adopt and carry no attack surface of your own.
| Surface | Code required | Permission | Use when |
|---|---|---|---|
1. The vault chat panel/vault → ✨ AI Chat |
none | none | You want to chat about vault files |
2. The same panel, beside a running app/en-gb/app/ → ✨ AI |
none | none | You want AI beside an app you did not write |
| 3. AI inside your own app your app's own UI |
yes | permissions.llm.chat |
The model is part of what your app does |
Surfaces 1 and 2 run on host chrome at the real origin, so they hold the vault key and the microphone directly; the sandboxed app frame sees neither and cannot read the conversation. The full decision table.
Every existing vault app gets this without being changed.
Surface 2 is the highest-value thing on this site and until now it was documented in exactly one debrief. An app written before the AI panel existed, by someone who has never heard of it, gets a working chat panel beside it with the vault's key and the user's microphone, and needs no permissions.llm.* at all, because the app is not involved. How, and the one config line that turns it off.
The decision table, all three surfaces, the honesty mechanisms published as decisions with their reasons, and turning a vault on with its two key tiers.
Start here → RunnableEight samples for the surface that needs code: the minimum pane, cancel, a cost meter that does not lie, a picker that cannot be wrong, images, voice, file grounding, and the pre-ship checklist.
Read the code → GeneratedTen calls, four grants, nine error codes. Generated from the canonical contract rather than hand-copied, so this site cannot become a second source of truth that drifts.
The reference → And the gapGrant, consent, budget, policy: four independent checks, four different people who can say no, and an error that tells you which one did. Plus the limit, unsoftened.
The model →The earliest dated artefact in the whole estate is a talk: Deterministic GenAI Outputs with Provenance, OWASP AppSec Lisbon, 28 June 2024. Two years later the same instinct runs through everything, and the position has not moved: a model output is only usable when you can say where it came from. Not models are unreliable, use a better one.
| Thread | Where it goes |
|---|---|
| Provenance and determinism | The oldest thread, and the spine of the rest |
| OpenRouter as the provider layer | One key for many models, and what that costs |
| Local and offline models | Ollama, a flight, and the sovereignty argument |
| Pages that models read | The other half of the subject: being readable to a model that arrives from outside |
| Chat panes on plain websites | The thin half, labelled as such |
What is actually shipped, and what is not keeps the list of absences: no evals, no structured-output guidance, no model routing, and a fully instrumented cost ledger nobody has analysed.