That split is the tell. If the useful path still depends on remote creds and provider APIs, you haven’t really fixed the trust boundary. That’s why rig.ai being local model + local execution matters.