DR-043 — "Zero-egress" means no client data at rest in shared infra + no non-essential egress

Operationally, the zero-egress commitment means no client data at rest in shared multi-tenant third-party infra, and no non-essential egress — terms-protected model/transit egress (Anthropic no-train/ZDR; the client’s single-tenant Supabase project) is the accepted, bounded exception; it never meant literally zero. This definition is the load-bearing premise for DR-044/046. Provenance: S456 ratification (decision 2), reports/arch-assessment-compute-posture-s456.md §B (re-filed from reference/ S504).

Merged S456 companions (superseded → here, S498): compute posture — pipeline on-prem, app on Vercel; “on-prem” = residence + processing (ex-DR-042). Agent topology — data-plane agents run inside the client’s own isolation boundary; the central control-plane is telemetry-only (ex-DR-045; the goose pilot on the shared Platform box is the sanctioned pre-G6 carve-out per retired DR-017’s pilot ruling).