# The 25 / v3 — local-only policy (custodial & practice)

**Confirmed requirement:** Black Diamond, Redtail, Fidelity cash/ladders, and Outlook
all fall in the **same local-only scenario** as Client Desk + local llama:

- Data stays on Lenovo / Mac Mini (or Tailscale Reach peers).
- Hostinger `v3` may host **UI shells** and public market/econ facts.
- Custodial / CRM / mailbox payloads must **not** POST to Hostinger proxies
  or cloud LLMs from v3 tools.

## Production mismatch (do not copy into v3)

Today’s main site still has Hostinger paths that **do** move this class of data:

| System | Risky production path | What happens |
|---|---|---|
| Black Diamond | `bd-extract.php` → Anthropic | BD PDF bytes to cloud LLM |
| Redtail | `rt_proxy.php` | CRM via Hostinger → Redtail SaaS |
| Outlook | `email-proxy.php` / Graph | Full mail bodies on Hostinger |
| Fidelity cash | Lenovo cash manager (OK) | Local CSV + Ollama — **keep this pattern** |

v3 Client Desk / Cash Desk / Practice Cockpit **must not** call those Hostinger proxies.

## v3 contract

1. Browser UI on `v3.ulm-fpg.com` talks to **Reach** (`/desk/`, `/cash/`, `/runway/`, …)
   on the tailnet, or shows “Reach offline.”
2. Identity + holdings + mail never round-trip through Anthropic from v3.
3. PII insert for client-facing copy happens **locally** (Comms Studio later).
4. Market Desk may use **public** feeds (Yahoo/FRED/RSS) with provenance —
   that is not custodial data.

If a future feature needs BD/Redtail/Outlook and Reach is down, **fail closed**
(show empty + reconnect), never fall back to Hostinger CRM/Graph proxies.