One coordinator, one policy boundary
Chat, Documents and Code are entry points into a single local harness. They do not keep separate identity, memory, routing or audit systems.
Apache-2.0 · Air-gapped · Open-weight models
Sovereign intelligence,behind yourown walls.
A private agent workbench for confidential industrial work — chat, documents and code, running entirely on hardware inside your perimeter. The proof is a live counter at zero, not a promise in a brochure.
# every build is published with its checksum $ sha256sum refinix-0.1.0-windows-x64.msi # compare against the signed manifest $ refinix verify --manifest refinix-0.1.0.manifest.json
# mount the verified bundle, then install from it $ refinix install --bundle /media/refinix-0.1.0-bundle # no network is contacted at any point $ refinix selftest --offline
Sovereign = Local + Agentic + Proven
Design approach
Nothing leaves.Everything is recorded.
Capabilities arrive as packs
Enable document work or code work and the installer resolves the smallest model and tool plan for it, showing source, licence and size first.
Routing you can override
Auto picks a device from capability and health evidence. The chosen model, the device and the reason stay on screen, and you can overrule them.
Every run is replayable
Job state, tool calls, artifacts and approvals land on one append-only event stream, so a run can be inspected after the fact.
The product
Four surfaces, one harness.
Pick a surface to see what it shows. Every value below is sample content, not a measurement.
“Read the scanned inspection report and draft an approval note.” Four steps. The extraction pass needs the vision model, so it routes to node-02 and the rest stays here.
- [×]Extracted 14 pages, mapped findings to page numbersdocument.extract
- [×]Retrieved SOP-114 clauses 4.2 and 9.1knowledge.retrieve
- [>]Drafting the note with citations to pages 6, 9 and 11document.generate
- [ ]Validate, then ask you to approve the writeapproval
approval-note-SR-4471.docx 41 KB · unsigned
Routing
Selectednode-02
Reasonvision resident
Overridableyes
State
Jobrunning
Attempt1
Scans in, real deliverables out. OCR and vision run on device, and every extracted finding keeps the page it came from so a draft can be traced back to the sheet.
- [×]SR-4471.pdf — 14 pages, 300 dpi, scannedocr
- [×]6 findings extracted, 2 above the clause 4.2 thresholdvision
- [×]Citations bound to pages 6, 9, 11retrieve
- [>]Rendering .docx and validating against the templatevalidate
SR-4471.pdf 14 pp · local
approval-note-SR-4471.docx draft
Index
Scopelocal disks
Documents1,284
Embeddingson device
Egress
Externalnone
Changes are proposed, run, and only then offered. Execution happens in a sandbox with networking disabled and bounded CPU, memory and filesystem access.
--- a/tools/tag_export.py +++ b/tools/tag_export.py @@ -18,7 +18,9 @@ - rows = read_tags(path) + rows = read_tags(path) + if not rows: + raise EmptyTagFile(path) return normalise(rows)
pytest — 24 passed, 0 failed sandbox
Sandbox
Networkdisabled
Writestemp only
Timeout120 s
Patch
Statusawaiting approval
Enforced, observed, unavailable. Three different claims, never sharing a colour, each naming the layer or observer it came from.
- Public egress policyhost firewall rulesetactiveEnforced
- Public outbound flowscoordinator observer · 30 min0Observed
- External AI/API callscoordinator observer · 30 min0Observed
- Blocked attemptshost firewall counters3Enforced
- Kernel packet captureobserver not installed on this host—Unavailable
Devices
Thisnode-01
Paired1 trusted
Models
Main engineinstalled
Visionnode-02
Capabilities
Built for the work a plant actually generates.
Approval notes, inspection reports, engineering calculations, internal tooling code, and drawings that arrive as scans.
Read what is on paper
Scanned reports, handwritten annotations, P&IDs and photographs, through on-device OCR and vision. Findings keep their page numbers, so a draft traces back to the sheet.
Ground it in your own manuals
A local retrieval connector over your SOPs, standards and past correspondence. Citations point at your own disks, and the index never leaves them.
Produce the actual deliverable
Approval notes, spreadsheets and decks that open correctly as
.docx, .xlsx and .pptx — plus code
changes validated in a sandbox with networking off.
Use the machines you have
One workstation is a complete installation. Pair a second trusted device and a vision job can run there while a coding job runs here — one job, one model, one device, never weights split across machines.
The evidence rule
A claim, an observation and a blank are three different things.
A green tick cannot tell you whether a control is running, or whether anyone was watching. So Refinix does not draw one.
- Every figure names its source.
- A missing source stays visibly missing.
- No fourth state quietly means probably fine.
A named control is active
The host firewall ruleset is loaded and blocking, and the layer doing the enforcing is named beside the claim.
nftables · inet/filter
A named observer saw a count
Zero public outbound flows, on stated interfaces, in a stated window. No observer and no window means no figure.
flow-probe · 24 h window
There is no evidence
No observer installed on this host. Drawn as missing — never as a zero, because absence is not proof.
no source
2Execution targets without leaving your policy boundary
This device, or a trusted paired device
4Surfaces over one harness
Chat, Documents, Code, Control Center
0Public network calls in offline runtime
A design invariant, not a benchmark
3Kinds of evidence claim
Enforced, observed, unavailable
REFINIX
Confidential work deserves better than a policy nobody can check.
One local harness for chat, documents and code — every run recorded, every figure sourced, and nothing leaving your perimeter.