Host parity
One product, two host adapters.
The same packaged workflow files are the business logic on Claude Code and Codex. Discovery changes by host; workflow, ownership, persistence, and guardrail contracts do not.
Trust Center
Local state. Human authority.
Founder OS is one product on Claude Code and Codex. This page names what stays local, what reaches the model host, and where operational guardrails end.
Data boundary
The durable state is local Markdown.
Role reads and writes pass through a local state gateway. Founder OS has no cloud service, network sync, or telemetry, and it does not automatically connect to calendars, CRMs, inboxes, banks, or accounting systems.
Prompts, attached context, and tool results sent through Claude Code or Codex remain governed by that model host's account and data settings. Local state does not mean model context never leaves the machine.
Human authority
It never sends and never pays.
Founder OS may draft, calculate, compare, and recommend. It never sends, publishes, signs, pays, transfers, buys, subscribes, cancels, or files anything. The founder performs every outbound or financial action.
Write boundary
Every file has one owner.
Roles may read shared business state, but each role writes only the files and sections assigned to it. Capability-bound sessions and hash-checked atomic replacement enforce that contract for packaged role writes.
Enforcement boundary
Hooks are guardrails, not a security sandbox.
Bundled hooks require review and trust where the host asks for it. If they are disabled or untrusted, session guidance and runtime guard coverage are absent. Main-thread founder activity remains outside the role boundary by design.
This website
The site runs no analytics script.
These pages are static files on GitHub Pages. Founder OS runs no page-view counter, no cookies, and no third-party tag on them; the Content-Security-Policy allows scripts only from this origin and the pages' own inline blocks, so a tag from anywhere else could not load by accident. GitHub keeps its own server logs and reports aggregate visit and clone counts for any public repository — that is GitHub's collection under GitHub's terms, and nothing joins it to a founder's workspace.
The plugin is the separate thing, and it sends nothing at all: no telemetry, not even opt-in. If a cookieless counter is ever added to this site, it will be named in this section in the release that adds it.
Reporting
A security issue goes to the private form first.
A hook that allows what it should deny, an outbound or spending path reachable from a packaged role, a path escape out of the workspace, or anything touching the no-telemetry promise: report it at Security → Report a vulnerability, which stays private between you and the maintainer until an advisory is published. SECURITY.md has the full scope, and the documented boundaries that are not vulnerabilities.
A trust question is not a security issue and is better in public — Discussions, or a problem report. Either way, never paste workspace contents: paths are useful, client names and amounts are not, and a private advisory becomes public when it is published.
Lifecycle
The host runs an installed copy.
Codex uses cached installed copies, and both hosts load package guidance when a conversation starts. After updating or reinstalling, review hook trust if prompted and start a new conversation. Uninstalling the plugin does not delete the founder's Markdown workspace or local overlay.