Nothing leaves the box

1. Prerequisites

A licence file — not a YAML tier

Without the licence file the proxy boots, prints the banner, and refuses everything:

HTTP 403
{"error":{"type":"pretense_enterprise_required",
  "message":"Air-gap mode (local model routing) requires an Enterprise licence. Resolved tier is \"free\". Install a signed enterprise licence at ~/.pretense/licence.jwt, or disable airgap.enabled to use a hosted provider.",
  "tier":"free","licensed":false}}

A runner on the OpenAI-compatible surface

ollama serve            # binds 127.0.0.1:11434
ollama pull llama3.2

Confirm the runner answers on /v1/chat/completions before involving Pretense — that is the only surface Pretense speaks to:

curl http://127.0.0.1:11434/v1/chat/completions \
  -H 'content-type: application/json' \
  -d '{"model":"llama3.2","messages":[{"role":"user","content":"hi"}]}'

Ollama, LM Studio, vLLM, llama.cpp's llama-server and LocalAI all expose this surface. Pretense does not have per-runner presets: you point baseUrl at whichever one you run, and it is the URL that matters, not the product name.

2. Configuration

Flip the switch, then declare where your model lives.

Exit 0. It creates pretense.yaml if there is not one yet, so it works before pretense init. It does not add a runner — do that by hand:

# pretense.yaml
airgap:
  enabled: true
  policy: secrets-pii-only      # or: full
  runners:
    - name: local-ollama
      baseUrl: http://127.0.0.1:11434
      protocol: openai-compatible
      models: ["llama*", "qwen*", "deepseek*", "gemma*", "mistral*"]

Which model names reach your runner

Routing is by model name, matched against the models: globs. Omit models: and you get these six:

Each glob compiles to an anchored, case-insensitive regex — ^llama.*$, not .*llama.*. The glob has to be a prefix of the tag. Real tags, and where they land:

3. Run

PRETENSE_UPSTREAM_ALLOW_LOCAL=1 re-permits cleartext http:// loopback, which the SSRF and egress guard blocks by default. The proxy prints a loud warning when you set it. Correct for a runner on your own machine; never set it to reach something you do not control.

Any OpenAI-compatible client works — put the model tag in the request and let the globs route it:

curl http://localhost:9339/v1/chat/completions \
  -H 'content-type: application/json' \
  -d '{"model":"llama3.2","messages":[{"role":"user","content":"hi"}]}'

Read the boot banner

[pretense] AIR-GAP MODE — outbound telemetry, usage reporting and entitlement
validation are disabled. Reachable upstreams: local-ollama=http://127.0.0.1:11434

The banner prints regardless of licence state, so the banner alone does not mean air-gap is working.

4. Verifying it actually works

Two checks. Each one can fail, which is the point.

Negative test — no cloud fallthrough

Ask for a model that matches no glob. It must be refused without dispatching anywhere:

curl -s http://localhost:9339/v1/messages \
  -H 'content-type: application/json' -H 'anthropic-version: 2023-06-01' \
  -d '{"model":"claude-opus-4-20250514","max_tokens":64,
       "messages":[{"role":"user","content":"hi"}]}'

Confirm it at the network layer — tcpdump, or a firewall deny rule on api.anthropic.com and api.openai.com— rather than trusting the proxy's own output. Silent fallthrough is the failure mode that matters, and a proxy that has been tampered with is not a trustworthy witness to its own egress.

Credential test — read the bytes

Ollama will not show you request headers, so point a runner at something that will:

Send one request and read what arrives. Authorization and x-api-key must be absent— Pretense withholds the caller's provider credential from local runners (TASK-605, shipped in 0.6.51). This is the one test where success proves nothing on its own: a leaked header still produces a perfectly working request. You have to look at the bytes.

Then confirm your build contains the fix:

npm ls -g @pretense/cli            # must be >= 0.6.51
grep -c isLocalRunner "$(npm root -g)/@pretense/cli/dist/index.js"

0.6.50 and earlier forward the caller's bearer token to local runners over cleartext loopback. Check the installed tree, not the source tree — they drift.

5. Known issues

Open against 0.6.52. Listed so you do not debug them twice.

There is no dedicated air-gap flag and no doctor-style preflight command. Air-gap is configured entirely through pretense.yaml plus the licence file, which is why this page spends so long on the banner.