Skip to content
ZeravaDocs

Several computers, and options

6. Several computers

Section titled “6. Several computers”

For the first operator.

The example. The office has three computers with agents on them. Perun on the office server is the host; the two laptops run Perun as members. A laptop’s agent still points at 127.0.0.1:8787; its calls travel to the server, where the one SHARED_LIB decides.

One system, one SHARED_LIB. Your system is every computer on your network that you have the legal right to enter and that you joined to it. It has exactly one SHARED_LIB, on the host — the computer where Perun was installed first. Two would be a panic (Part 5).

Joining a computer

  1. On the host, switch on the gateway (Settings → Network gateway → On). It answers only private addresses of your local network, never the internet. Without HTTPS the connection across the network is not encrypted; with HTTPS, Perun makes its own certificate and members pin it.
  2. On the host: perun system invite --address <the host's address> --device "<laptop name>". You get a join code, shown once. It carries the system’s secret: give it only to that computer.
  3. On the new computer, before Perun first starts there: perun system join <code>, and type YES — by this you state that you have the legal right to join it.
  4. Start Perun on the new computer. It is a member: it decides nothing itself and sends every call to the host.

An agent on a computer without Perun. In the System tab, Name a new agent. SHARED_LIB gives it its name and a token, shown once. In that agent, use the token as its API key and the base URL http://<host>:8789/v1 (or /anthropic). The model sees only the key held by Perun on the host.

Moving the host (first operator only). Stop Perun. perun system move-out <file> packs SHARED_LIB under a passphrase and removes it from this computer. On the new host, before Perun starts: perun system move-in <file>. SHARED_LIB is moved, never copied.

An example from a managed-services company (MSP). An MSP looks after twelve client offices. Each office is its own system, with its own host and its own SHARED_LIB — the offices are separate companies, and the MSP’s technicians are operators in each of them, with each office’s own boss for the reports. When a source attacks one client, the MSP exports that office’s enemy list and offers it to the other offices, where an operator of each office decides whether to import it.

Between different systems (for example yours and a partner’s), only the list of stopped sources can be shared: perun enemies export <file> and, on the other side, perun enemies import <file>, which shows who signed it and waits for an operator’s YES. A source’s name means something only in its own system — import only what you can match.

What Perun 1.0 protects. The computers of your system that run Perun or send their agents through its gateway. It does not yet pair your devices automatically, and it does not run on ARM computers yet (for example some Windows laptops on Snapdragon, or a Raspberry Pi).

The rule. One host, many members, one SHARED_LIB — and nothing reaches the model except through it.

7. Options

Section titled “7. Options”

For the first operator. Every option is off until you switch it on; each asks you to confirm and says whether anything leaves the computer.

Network gateway — Part 6.

Harm classifier (attack type 5, dangerous content). A small model on this computer reads every reply; a harmful reply is replaced by “Perun withheld this reply.” It must run on this computer, so the text never leaves it. With Ollama: ollama pull llama-guard3:1b, then perun harm on. While it is on, streamed replies are held whole until judged, so they arrive a little later. If the classifier is not running, replies pass and the screen says so.

Model check (attack type 3, tampered models). Perun runs the command you give it — our Pivot check — for every model your agents use: when you switch it on, when the model changes, and weekly. If a model fails, its irreversible actions wait for a human until it passes. perun modelcheck on --command "<the Pivot command with {model}>". A model in the cloud can be recognised only by its name; the result says so.

Swarm specialists. Four more units per agent, each watching one channel — messages, documents, tool calls, output — and the strictest of them decides. The tool-call specialist also reads the arguments of every call as language. Reading work grows about four times. perun specialists on.

A reader. Without one, Perun reads with its built-in rules only. A reader adds a language model to the reading:

  • local — a model served on this computer by Ollama or llama.cpp; nothing leaves the computer. For example ollama pull qwen2.5:3b, then perun reader online --provider openai --base-url http://127.0.0.1:11434/v1 --model qwen2.5:3b (an address on this computer counts as local);
  • online — an AI service on the internet; the text being read is sent there, and the screen says so for as long as it is on.

The rule. Switch on what your work needs, knowing what each option costs: time (harm classifier, specialists), a dependency (a local model), or text leaving the computer (an online reader).