FAQ
Product boundaries, security, offline use, and docs site tokens.
Common product and operations questions.
Is Carina a hosted cloud agent?
No. Carina is local-first. Nebutra Cloud identity/sync may wrap it, but policy and tool execution stay under local authority.
Does Carina replace Git?
No. Patch rollback recovers agent edits inside the runtime. Git remains the collaboration and history system of record.
Is Carina a full editor product?
No. It can sit behind an IDE, but it focuses on runtime governance — sessions, policy, audit, rollback, workers, embedding.
Can I run fully offline?
Yes for the runtime itself. Model providers and package installs may still need network depending on your setup. Use --offline to avoid auto reasoner wiring.
How are secrets handled?
Agents never read the environment directly. Secrets use a handle-based broker; logs never contain secret plaintext; command output is redacted against known values.
How do I report a security issue?
See SECURITY.md in the repository. Do not open public issues for undisclosed vulnerabilities.
Where is the design system for this site?
Brand authority: docs/brand/design-system/.
Docs package sync: pnpm sync-brand from apps/docs.
Public component API: --docs-* tokens in src/styles/docs-tokens.css.
Where is the full RPC surface?
protocol/jsonrpc/methods.json is authoritative. Narrative: docs/rpc-api.md and JSON-RPC reference.
Source of truth
Section titled “Source of truth”- Product posture:
docs/product.md· cloud boundary:docs/nebutra-cloud-boundary.md - Security:
docs/security-model.md·SECURITY.md - Live machine truth:
carina doctor·carina --help - Related: Overview · Policy · CLI reference
- Installation · Local deploy
- Method catalog — full RPC surface
Was this page helpful?
What went wrong?
Thanks for the feedback.
One vote per page is recorded during this session.