# Architecture

```text
User chat
  |
  v
SmallPersonalAgent
  |-- MemoryStore: local JSON only
  |-- MemoryExtractor: candidate facts
  |-- Sanitizer: hides accepted private facts
  |-- Router
        |-- local_answer
        |-- DirectSearchAgent
        |-- CodexBigAgent or mock fallback
  |
  v
Private ranking and synthesis
```

## Privacy Boundary

Accepted memory facts are never passed into `DirectSearchAgent` or `CodexBigAgent`.

External payloads can include:

- the sanitized current task
- neutral keywords
- explicitly approved context

External payloads cannot include:

- accepted profile facts
- local memory JSON
- API keys
- private local files

The Agent Trace makes this visible by separating `private_memory_used` from `outbound_payload_preview`.