Four source access modes
| Mode | Typical source | How it is bounded |
|---|---|---|
| Clone | Git repository | Resolved commit and frozen archive |
| Point | Local folder or file | Guarded copy and content hash |
| Connect | Supported live database | Bounded capture-time export from read-only queries |
| Ask | Human knowledge as text | Attributed report at a deliberately weaker evidence tier |
Live database capture
During freeze, SOCK performs read-only introspection and writes a native evidence package before analysis begins. From Survey onward, only the frozen package is read; the live database is never re-queried.
- Depending on engine and permissions, capture can include schemas, tables, keys, views, indexes, routines, sequences, triggers, row counts, grants, and bounded samples.
- One PostgreSQL connection captures one configured database, not every database in the server cluster.
- Sample rows are captured as-is and may contain sensitive business data.
- Row sampling can be constrained or disabled; agree masking and retention requirements before capture.
Use the read-only preview to validate scope. Even a small sample can contain sensitive business data and must follow data-handling policy. Labels, actions, and layout may vary by release.
Read-only and credential handling
- The capture path is designed not to mutate repositories or databases.
- For PostgreSQL, MongoDB, Oracle, and Confluence on the managed reveal path, the revealed credential is held in the signed-in user’s local operating-system credential store after authorisation.
- At extraction time, credentials are passed to the child process through standard input, not command arguments, environment variables, logs, or frozen artefacts.
- Generated packages from those paths are scanned for handled credential values of at least six characters.
- A matching secret quarantines and fails the source instead of accepting the package.
- A failed source produces a blocker or named gap, never a silently empty success.
| Operating system | Secure credential store used by Genesis | What that means |
|---|---|---|
| macOS | Keychain | The connector secret is stored as a user-scoped item through macOS Keychain Services |
| Windows | Credential Manager | The connector secret is stored in the signed-in user’s protected Windows credential vault |
| Linux | Secret Service-compatible keyring | Genesis uses the secure keyring available in the user session, commonly GNOME Keyring or KWallet depending on the desktop environment |
Where processing happens
Genesis and capture artefacts run locally on the operator’s machine. Deterministic capture processing also runs locally. AI comprehension and Ask use the installed, authenticated model runtime, so content handled by those stages travels to the configured model service.
Do not infer data residency from the desktop installation alone. Confirm the actual model-service configuration, network path, regional controls, and organisational agreement for each deployment.
Deployment review checklist
- Approved source locations and data classifications
- Whether source content may be processed by the configured AI model service
- Network, VPN, proxy, TLS, and database allow-list requirements
- Least-privilege repository and database accounts
- Sample-data restrictions or masking requirements
- Operating-system support for the release
- Retention and deletion requirements for local capture artefacts