AltimateAI · anandgupta42 · Aug 26, 2026 · Aug 26, 2026 · Aug 26, 2026 · Aug 26, 2026
diff --git a/.gitignore b/.gitignore
@@ -45,3 +45,4 @@ tsconfig.tsbuildinfo
 # Rendered VHS demos — regenerable from .tape files, kept out of git
 docs/media/*.gif
 docs/reviews/AI-7520-code-pr1001-review-threads.md
+docs/site/
diff --git a/README.md b/README.md
@@ -108,7 +108,7 @@ no hallucinated SQL advice, no guessing at schema, no missed PII.
 
 **Works seamlessly with Claude Code and Codex.** Use `/configure-claude` or `/configure-codex` to set up integration in one step. altimate is the data engineering tool layer — use it standalone in your terminal, or mount it as the harness underneath whatever AI agent you already run. The two are complementary.
 
-altimate-code is a fork of [OpenCode](https://github.com/anomalyco/opencode) rebuilt for data teams. Model-agnostic — bring your own LLM or run locally with Ollama.
+altimate-code is a fork of [OpenCode](https://github.com/anomalyco/opencode) rebuilt for data teams. Model-agnostic — bring your own LLM, or run fully local with `altimate local`.
 
 ## Quick demo
 
@@ -133,6 +133,9 @@ altimate-code is a fork of [OpenCode](https://github.com/anomalyco/opencode) reb
 
 # Generate dbt 1.8 unit tests for a model with CASE/WHEN and JOINs
 > /dbt-unit-tests for models/marts/fct_revenue.sql
+
+# Run fully local — no API key, no per-token cost, web tools ask before egress
+altimate local
 ```
 
 ## Key Features
@@ -160,6 +163,9 @@ Manifest parsing, test generation, model scaffolding, incremental model detectio
 ### Data Visualization
 Interactive charts and dashboards from SQL results. The data-viz skill generates publication-ready visualizations with automatic chart type selection based on your data.
 
+### Certified Local Mode
+Run the whole agent on your own hardware with one command — `altimate local`. No account, no API key, no per-token cost: hardware detection picks a recipe, every artifact is SHA-256-verified, and the endpoint must pass certification probes (tool calls, reasoning, long-context prefill) before your config is touched. An egress guard makes web tools ask before anything leaves the machine. See the [Local Mode docs](https://docs.altimate.sh/usage/local/).
+
 ### Local-First Tracing
 Built-in observability for AI interactions — trace tool calls, token usage, and session activity locally. No external services required. View session recordings with `altimate trace`. Features include loop detection, post-session summary, and shareable HTML exports.
 
@@ -195,7 +201,7 @@ First-class support with schema indexing, query execution, and metadata introspe
 
 ## Works with Any LLM
 
-Model-agnostic — bring your own provider or run locally.
+Model-agnostic — bring your own provider, or run fully local with `altimate local` (managed setup, certified endpoint, no API key) or your own Ollama / LM Studio server.
 
 Altimate LLM Gateway · Anthropic · OpenAI · Google Gemini · Google Vertex AI · Amazon Bedrock · Azure OpenAI · Databricks AI Gateway · Snowflake Cortex · Mistral · Groq · DeepInfra · Cerebras · Cohere · Together AI · Perplexity · xAI · OpenRouter · LM Studio · Ollama · GitHub Copilot
 

diff --git a/docs/docs/configure/index.md b/docs/docs/configure/index.md
@@ -33,7 +33,7 @@ Set up your warehouses, LLM providers, and preferences. For agents, tools, skill
 
     Connect to 35+ LLM providers — Anthropic, OpenAI, Bedrock, Ollama, and more. Configure API keys and model selection.
 
-    [:octicons-arrow-right-24: Providers](providers.md) · [:octicons-arrow-right-24: Models](models.md)
+    [:octicons-arrow-right-24: Providers](providers.md) · [:octicons-arrow-right-24: Models](models.md) · [:octicons-arrow-right-24: Local Mode](../usage/local.md)
 
 -   :material-puzzle:{ .lg .middle } **MCPs & ACPs**
 

diff --git a/docs/docs/configure/models.md b/docs/docs/configure/models.md
@@ -18,6 +18,9 @@ altimate supports models from all configured providers. Use the `model` and `sma
 
 The model format is `provider/model-name`.
 
+!!! note
+    `altimate local` pins `small_model` to the local provider automatically when you haven't set one — no background step (like compaction or title generation) silently calls a cloud model. See [Local Mode](../usage/local.md).
+
 ## Browsing Models
 
 In the TUI:
@@ -85,6 +88,7 @@ Models are referenced as `provider/model-name`:
 | OpenRouter | `openrouter/anthropic/claude-sonnet-4-6` |
 | Copilot | `copilot/gpt-4o` |
 | Snowflake Cortex | `snowflake-cortex/claude-sonnet-4-6` |
+| Local ([`altimate local`](../usage/local.md)) | `local/qwen3.8-27b` |
 | Custom | `my-provider/my-model` |
 
 See [Providers](providers.md) for full provider configuration details.
diff --git a/docs/docs/configure/permissions.md b/docs/docs/configure/permissions.md
@@ -104,6 +104,9 @@ Override permissions for specific agents:
 | `todoread` | No | Read tasks |
 | `doom_loop` | No | Loop detection |
 
+!!! note "Local Mode egress guard"
+    Running `altimate local` adds `ask` rules for `websearch`, `webfetch`, and `codesearch`, so a local-first session only reaches the internet with your approval. See [Local Mode](../usage/local.md#trust-model).
+
 ## Environment Variable
 
 Set permissions via environment variable:

diff --git a/docs/docs/configure/providers.md b/docs/docs/configure/providers.md
@@ -233,6 +233,20 @@ Run local models through [LM Studio](https://lmstudio.ai)'s OpenAI-compatible se
 !!! note
     If you changed LM Studio's default port, update the `baseURL` accordingly. No real API key is needed — the `"lm-studio"` placeholder satisfies the SDK requirement.
 
+## Altimate Local (Managed)
+
+Unlike Ollama or LM Studio above, `altimate local` does the setup for you: hardware detection, verified model download, certification, and config wiring, all in one command.
+
+```bash
+altimate local
+```
+
+This detects your hardware, downloads a SHA-256-verified model and pinned `llama.cpp` runtime, certifies the endpoint (tool-call, reasoning, and long-context probes), and writes the `local` provider block into your config for you — endpoint, model entry, and context limits included. Your default model becomes `local/qwen3.8-27b` if you haven't set one. There is nothing to paste by hand: re-running `altimate local` refreshes the wiring, and `altimate local models` lists the registry.
+
+No API key needed, and the server binds `127.0.0.1` only. `altimate local` also adds `ask` permission rules for the web tools (`websearch`, `webfetch`, `codesearch`), so a local-first session reaches the internet only with your approval.
+
+See [Local Mode](../usage/local.md) for the full command reference, supported hardware, and trust model.
+
 ## OpenRouter
 
 ```json

diff --git a/docs/docs/getting-started/index.md b/docs/docs/getting-started/index.md
@@ -53,7 +53,7 @@ npm install -g altimate-code
 
 ### [Bring Your Own LLM](/configure/providers/)
 
-Works with Anthropic, OpenAI, Google, AWS Bedrock, Azure, Ollama, and 10+ more providers. Swap models without swapping your harness. No vendor lock-in.
+Works with Anthropic, OpenAI, Google, AWS Bedrock, Azure, Ollama, and 10+ more providers — or run fully local with `altimate local`, no API key. Swap models without swapping your harness. No vendor lock-in.
 
 </div>
 </div>

diff --git a/docs/docs/getting-started/quickstart.md b/docs/docs/getting-started/quickstart.md
@@ -21,11 +21,12 @@ npm install -g altimate-code
 altimate        # Launch the TUI
 ```
 
-On a fresh install, a welcome panel appears with a curated 6-provider picker:
+On a fresh install, a welcome panel appears with a curated 7-provider picker:
 
 - **Altimate LLM Gateway** *(recommended)* — 10M tokens free, no API keys. Routes to the best model per task across Sonnet, Opus, GPT-5, and more. Sign-in opens a browser tab; complete Google or email signup and you're back in the TUI. If your terminal can't open a browser (SSH / tmux / WSL), the CLI prints the URL — paste it into a browser on your desktop.
 - **Anthropic** / **OpenAI** / **Google** — paste an API key or OAuth in.
 - **Big Pickle** — free tier, chats work but many data tasks fail; useful for kicking tires.
+- **Local model** — no account, no API key; a certified open model runs on your machine. The picker explains the one-time setup: exit and run `altimate local`.
 - **Search all providers…** — full picker if you need Bedrock, Databricks AI Gateway, Cloudflare AI Gateway, Snowflake Cortex, DigitalOcean Inference, etc.
 
 Or set an environment variable and skip the picker:
@@ -38,6 +39,9 @@ altimate
 !!! tip "Don't want to manage API keys?"
     The [Altimate LLM Gateway](https://help.altimate.ai/datamates/user-guide/components/llm-gateway/) is the top row of the picker — 10M free tokens, and altimate-code auto-selects the right model per task. First-run sign-in uses a loopback OAuth on `127.0.0.1:7317-7325` (falls back if the preferred port is taken).
 
+!!! tip "Air-gapped or compliance-bound?"
+    Run `altimate local` — one command detects your hardware, downloads a certified model, and wires your config so nothing leaves your machine. See [Local Mode](../usage/local.md) for hardware requirements and the full command reference.
+
 ---
 
 ## Step 2.5: First-run scan (optional)
@@ -300,3 +304,4 @@ by route.
 - [Warehouses Reference](../configure/warehouses.md): All warehouse types, auth methods, SSH tunneling
 - [Config Reference](../configure/config.md): Full config file schema
 - [CI & Automation](../usage/ci-headless.md): Run altimate in automated pipelines
+- [Local Mode](../usage/local.md): Run fully local — no API key, nothing leaves your machine
diff --git a/docs/docs/reference/network.md b/docs/docs/reference/network.md
@@ -46,6 +46,9 @@ altimate needs outbound HTTPS access to:
 | Your warehouse endpoints | Database connections |
 | `eastus-8.in.applicationinsights.azure.com` | Telemetry (Azure Application Insights) |
 
+!!! note "Local Mode"
+    `altimate local` needs outbound access only for the one-time model and runtime download (Hugging Face and GitHub). After setup, LLM traffic is loopback-only (`127.0.0.1`) — no outbound calls for inference. Egress-guarded web tools (`websearch`, `webfetch`, `codesearch`) still reach the internet, but only with your per-step approval. See [Local Mode](../usage/local.md).
+
 ### Disable Model Fetching
 
 If `models.dev` is unreachable:

diff --git a/docs/docs/reference/security-faq.md b/docs/docs/reference/security-faq.md
@@ -13,7 +13,7 @@ Answers to the most common security questions about running Altimate Code in you
 
 Altimate Code sends prompts and context to the LLM provider you configure (Anthropic, OpenAI, Azure OpenAI, AWS Bedrock, etc.). **You choose the provider.** No data is sent anywhere else except optional [telemetry](#what-telemetry-is-collected), which contains no code, queries, or credentials.
 
-If you use a self-hosted or VPC-deployed model (e.g., AWS Bedrock, Azure OpenAI), your data never leaves your cloud account.
+If you use a self-hosted or VPC-deployed model (e.g., AWS Bedrock, Azure OpenAI), your data never leaves your cloud account. With [Local Mode](../usage/local.md), inference runs on your own hardware entirely, and web tools ask before anything leaves the machine.
 
 ## Can the AI read my database credentials?
 
@@ -99,7 +99,15 @@ No other outbound connections are made. See the [Network reference](network.md)
 
 ## Can I run Altimate Code without internet access?
 
-Yes, with constraints. You need:
+Yes. The fastest path is [Local Mode](../usage/local.md):
+
+```bash
+altimate local
+```
+
+One command replaces the manual recipe below — it detects your hardware, downloads a SHA-256-verified model and runtime, certifies the endpoint, and wires your config. After the one-time model download, no outbound LLM traffic leaves your machine.
+
+If you're bringing your own runtime instead (a self-hosted model or a provider reachable only from your network), you need:
 
 1. **A locally accessible LLM**, either a self-hosted model or a provider reachable from your network
 2. **Model catalog disabled** by setting `ALTIMATE_CLI_DISABLE_MODELS_FETCH=true` or providing a local models file

diff --git a/docs/docs/reference/telemetry.md b/docs/docs/reference/telemetry.md
@@ -52,9 +52,10 @@ We collect the following categories of events:
 | `validator_check` | A completion-gate validator ran on session end — validator name, `ok` boolean, step, retry count, `enforced` flag (false in shadow mode), and structured `details` (model counts, elapsed time, concurrency limit — no SQL or model content). Only emitted when `ALTIMATE_VALIDATORS_ENABLED=1` or `ALTIMATE_VALIDATORS_SHADOW=1`. See [Validators](../data-engineering/validators.md). |
 | `validator_retries_exhausted` | A session terminated with unresolved validator failures after exhausting the synthetic-retry budget — names of the failing validators (no failure body content). |
 | `onboarding_started` | The first-run setup gate opened (fresh launch with no usable model). |
-| `model_picker_shown` | The provider picker was displayed. `trigger` distinguishes the first run from `/connect`, from declining Big Pickle, and from the prompt gate. |
+| `model_picker_shown` | The provider picker was displayed. `trigger` distinguishes the first run from `/connect`, from declining Big Pickle, from backing out of the local-model interstitial, and from the prompt gate. |
 | `provider_selected` | A provider row was chosen — `altimate_gateway`, `anthropic`, `openai`, `google`, `big_pickle`, `search_all`, or `other` for anything outside the curated five. `provider_id` carries the raw id only for publicly-known providers, so a provider you named yourself in config is reported as `other` with no name attached. `via_search` marks a pick made inside the full catalogue after choosing "Search all providers…". **Choosing search emits this event twice for one user** — once as `search_all`, then again with the provider actually chosen — so count distinct users or filter on `via_search`, not raw event count. Recorded at the moment of choice, so a sign-in that is then cancelled still counts. |
 | `big_pickle_confirm_shown` / `big_pickle_choice` | The Big Pickle interstitial was shown, and what the user decided (`accept`/`cancel`). |
+| `local_model_info_shown` / `local_model_choice` | The "Local model" interstitial was shown from the picker, and what the user decided — `acknowledge` (will run `altimate local`), `back` (returned to the picker), or `cancel`. No hardware details are sent. |
 | `gateway_device_code_issued` | The Altimate Gateway authorize URL was built and the browser open attempted. **Name note:** the flow is a browser loopback OAuth — there is no device code. The name follows the original event spec. |
 | `gateway_auth_completed` / `gateway_auth_failed` | Gateway sign-in outcome. `reason` is `timeout`, `denied`, or `error` — never the underlying message, which can contain the instance name. An unrecognised callback state does not reject the pending attempt, so a CSRF mismatch surfaces as `timeout`. |
 | `instance_connected` | Credentials received and saved. `time_to_connect_ms` runs from the start of the authorize call, so it includes the browser launch. No instance or tenant name is sent. |

diff --git a/docs/docs/reference/windows-wsl.md b/docs/docs/reference/windows-wsl.md
@@ -93,6 +93,21 @@ If you need to use Git Bash instead of WSL:
 export ALTIMATE_CLI_GIT_BASH_PATH="C:\\Program Files\\Git\\bin\\bash.exe"
 ```
 
+## Local Mode on Windows
+
+[Local Mode](../usage/local.md) (`altimate local` — run a local model with no
+API key) has two paths on Windows:
+
+- **WSL 2 (recommended today):** uses the Linux Vulkan build; follow the
+  Linux instructions inside your WSL distro.
+- **Native Windows (experimental):** the Vulkan runtime is pinned and
+  unpacks correctly, and memory detection works, but there is no GPU probe
+  yet and the flow has not been certified on physical Windows hardware.
+  `altimate local doctor` reports certification state honestly.
+
+See the [platform status table](../usage/local.md#platform-status-and-roadmap)
+for what is auto-detected and certified per platform.
+
 ## Known Limitations
 
 - The TUI works best in Windows Terminal or a modern terminal emulator

diff --git a/docs/docs/usage/cli.md b/docs/docs/usage/cli.md
@@ -35,6 +35,7 @@ altimate --agent analyst
 | `mcp`       | Model Context Protocol tools   |
 | `acp`       | Agent Communication Protocol   |
 | `models`    | List available models          |
+| `local`     | Set up and manage the certified local model server ([Local Mode](local.md)) |
 | `stats`     | Usage statistics               |
 | `export`    | Export session data            |
 | `import`    | Import session data            |
-Original file line number
+Diff line change
@@ Expand Up / @@ -53,7 +53,7 @@ npm install -g altimate-code @@
     ### [Bring Your Own LLM](/configure/providers/)
-    Works with Anthropic, OpenAI, Google, AWS Bedrock, Azure, Ollama, and 10+ more providers. Swap models without swapping your harness. No vendor lock-in.
+    Works with Anthropic, OpenAI, Google, AWS Bedrock, Azure, Ollama, and 10+ more providers — or run fully local with `altimate local`, no API key. Swap models without swapping your harness. No vendor lock-in.
     </div>
     </div>
@@ Expand Down @@