Trust and data model

Promptless for Agent Instructions is built for data minimization. Trace content (prompts, tool activity, reasoning, and the rest of a session) flows from each host to the worker you run in your own infrastructure, and the worker sends trace-derived analysis input to the model provider you configure when it analyzes a session. The hosted Promptless Runtime receives a limited metadata projection and never the content itself. This page states exactly what crosses each boundary.

Data	Where it lives	What it contains
Native session traces	Your worker, your S3 bucket, and your Postgres database	Verbatim transcript content: prompts, tool calls and outputs, reasoning summaries
Source ledger and cached credential	The host, owner-only	Byte offsets already read, and the per-host credential
Metadata projection	Hosted Promptless	Identifiers, counts, and lifecycle, ingestion, and analysis status only

What the host sends the worker

The host runtime uploads to the worker you control:

• Verbatim native trace bytes — new byte ranges of each native session ledger, gzip-compressed and base64-encoded, with a SHA-256 digest the worker verifies. This is the transcript content the agent CLI wrote locally.
• Batch metadata — a batch identifier, the source and host, session identity when present, and plugin, policy, and collector versions.
• Analysis-context snapshots — optional immutable snapshots of instruction availability and the installed Instruction Hub release identity.
• Check-in reports — a configuration hash and booleans, and redacted drift reports.
• Enrollment metadata — sent once at enrollment: a host instance identifier, a host label built from the local username and hostname, and the host platform.

What stays local on the host

Two things never leave the host and are stored with owner-only permissions:

• The source ledger, which records the byte offsets already read from each native ledger so only new ranges are uploaded.
• The cached per-host credential minted at enrollment.

The source ledger only starts recording once a host enrolls; history from before enrollment is never uploaded, because the first collection pass records those byte offsets as already read rather than sending them.

What the worker sends hosted Promptless

The worker sends hosted Promptless only a limited metadata projection of each trace: worker and session identifiers, lineage identifiers, the host instance identifier and label, lifecycle, ingestion, and analysis status, timestamps, and event and turn counts. The projection deliberately excludes all trace content — prompts, tool activity, working directories, git metadata, models, and source fingerprints. Findings authored locally by the Friction Analyzer are also written to hosted Promptless, with provenance recorded server-side. A finding’s text — its summary, impact, instruction_failure, notes, and each evidence occurrence summary — is model-authored prose that describes what happened in the session, so it can reference session detail even though it is not the verbatim trace content the projection excludes.

What the worker sends your model provider

To produce findings, the Friction Analyzer sends trace-derived analysis input — the session digest and trace it builds from the raw session — to the external model provider you configure. You control which provider and endpoint receive it through INSTRUCTION_HUB_ANALYSIS_MODEL_PROVIDER (openai, azure_openai, or aws_bedrock), INSTRUCTION_HUB_ANALYSIS_MODEL_BASE_URL, and INSTRUCTION_HUB_ANALYSIS_MODEL_API_KEY. This is analysis input drawn from the session, sent to whichever provider endpoint you point the worker at — distinct from the limited metadata the worker sends hosted Promptless. See Configuration reference.

Credential model

Four credentials separate the boundaries:

• plih_ install token — authenticates your worker deployment to hosted Promptless. Set it as INSTRUCTION_HUB_INSTALL_TOKEN.
• plihost_ per-host credential — a host uses this to talk to your worker.
• plihenroll_ codes — opaque browser-approval and polling codes used during enrollment.
• Repository-scoped GitHub token — held only by the isolated remediation agent to open a pull request against your Instruction Hub. It is scoped to that one repository and is not used by the worker for anything else.

Hosted Promptless stores only the SHA-256 hash of each plih credential and returns the plaintext exactly once, to the approved poller. Your worker holds no shared plugin secret: it verifies every incoming host credential through hosted introspection, keyed on the deployment instance identifier, the credential hash, and the target. Introspection is target-scoped, so a credential minted for one host family or deployment cannot authenticate as another. Hosted Promptless projects findings to GitHub issues on its own side, so the worker’s ingestion and analysis paths never handle GitHub credentials; the repository-scoped token above is the only GitHub credential in the loop.

Known limitation

A host’s policy is the configuration that governs what that enrolled host collects and uploads. In the current runtime, the signed policy a host fetches is shape-checked rather than cryptographically verified; transport security relies on HTTPS. Cryptographic signature verification is a known gap noted in the code and not yet shipped.