Zero egress is a test, not a setting
A claim of no outbound traffic is worth exactly what its test is worth. We verify with the network interface physically down, not merely firewalled, and the system is expected to run through it unchanged — inference, alerting, recording, audit. No telemetry, no licence check, no model call that quietly needs a route out. Where a component cannot survive that test, it does not ship. The same rule governs the AI layer: if the record cannot leave the building, neither can the prompt containing it.
