relay, and the four rules it lives by.
role-scoped answers over real runbooks, with client data masked first.
Relay is the support product: it answers a question using thirty-one vendor-correct runbooks, and it scopes the answer to who is asking. The same question from a technician and from a client produces two different answers, because the technician needs the command and the client needs the outcome. That scoping is the product — not the retrieval.
vendor-correct, written from the ticket history, not from documentation
planted secrets all caught before they reach the model
multi-word vendor spans, up from 86, so real names stop being masked
down from 4/10, after the over-masking rules were written into the masker
role-scoped answers
The demo runs four named accounts. Each one asks the same underlying question and gets a different answer, because the answer is scoped to the role rather than to the keywords.
the four rules
Relay's redaction layer is a separate service with four non-negotiable rules. Each one came from a failure — the first one from a failure that permanently destroyed data.
The predecessor masked the raw JSON. A detector matched inside an escaped quote, produced invalid JSON, and permanently bricked forty conversations. Masking is only ever applied to the decoded value.
A secret has no safe placeholder. Substituting one produces a credential now sitting in a log, a prompt, and a database. If it cannot be told whether something is a secret, it refuses the request.
An unknown destination is treated as offshore. An unknown classification is treated as regulated. Anything below the confidence floor is masked anyway. Ambiguity defaults to the safe answer, always.
If only a precision number stands between a regression and production, the regression ships. Releases are gated on recall: a drop blocks. The evaluation harness exits non-zero on a recall regression.
the tripwire
A blocklist file is read at startup, and a guardrail wraps the loader. If the tripwire is absent or malformed, the request is refused with HTTP 400 — not allowed through with a warning. A tripwire that silently disables itself is worse than none, because it retires the instinct to check it.
A full PEM private key block, with its header, is not matched by the structural rules. This is the same gap as the production masker, and it is listed here rather than glossed. A redactor that covers the access-key-id half but not the secret half is not covering the key.
the contact form is a real pipeline
no fake form, no dead inbox
The form on this site posts to /api/contact, which now has two lanes. Relay is the primary lane — it opens a real ticket in the ticketing pipeline, so an enquiry becomes a tracked item rather than an email in a queue. Email is the fallback, so a Relay outage does not lose a message. The endpoint reports which lane is live, and the form shows the honest state instead of pretending to work.
The form carries a honeypot field, a per-address rate limit, and server-side validation of name, email shape, and message length. It does not trust the client for any of it.
One governance rule is worth stating because it is unusual: client data flows in one direction only — from Relay into the fleet's memory system, and never back out. The client record is not a shared resource. If you are evaluating this for your own practice, that boundary is the part to copy.
documented 2026-10-16 · runbook count and masker figures are live as of this date