Nothing to breach.

It runs on your machine, reads files, and keeps nothing anywhere else.

Where it runs.

On your machine. No hosted service, no account, no telemetry.

It reads files. It never edits a case, never runs your solver, never opens a network socket while verifying.

The test suite refuses network connections while verifying.

Nothing is sent to Courant, ever: no account, no telemetry.

A command that goes out runs only when you run it, and names the host first.

The gate is Apache-2.0: read the code that decides every verdict.

Every release carries SHA256SUMS and its Ed25519 signature; courant update installs nothing unless it verifies.

The installer checks both where it can; COURANT_REQUIRE_SIGNATURE=1 makes it refuse otherwise.

Every pack carries a SHA-256 of every input and re-derives byte for byte.

A task edited after it was locked makes the verdict insufficient.

31 of 31 packs re-derive

The same inputs give the same verdict bytes, on every platform measured. No model decides.

31 of 31 verdicts identical

69 of 69 artefacts byte-identical across platforms

RM-34 · 11 Oct 2026 · courant 0.4.0

Over MCP the gate is read-only tools, confined to the folders you name.

The gate is not a service: it holds none of your data.

A private evaluation runs on its own runner; its report is signed and carries the deletion log.