Limits · ForgeVigil

Not established

Detection quality at real-world scaleAll 61 shipped cases are fictional and share an author with the policy and prompt. That is too small and too close to measure field accuracy.
Stable verdictsModel verdicts vary occasionally between runs. An attack carrying a valid approval is stopped only if Muse flags it.
Resistance to prompt injection beyond the tested casesThe model’s own robustness has not been measured outside the evaluation sets.
Readiness for hostingThe server is a development server bound to the local machine. Hosting needs a production server, TLS, per-client tokens and spend limits, and rate limits first.
Malware defenseEmail inspection reports structural signals only. The optional file scan reports what Microsoft Defender says about one file; ForgeVigil issues no malware verdict of its own.
Encryption at restRegistered document bytes, including restricted ones, are stored unencrypted in SQLite and in backups. Key rotation is not supported.

An authorized attack can be delivered if Muse misses it. When the document, recipient and approval are all valid, the only remaining defense is the model noticing manipulation in the message. The walkthrough shows this case.
Genuine evidence can support a false positive. Evidence checking proves that quotes and cited facts exist, not that the model interpreted them correctly.
The spend cap can overshoot by one call. Cost is reserved from an estimate before each call; actual usage can exceed one reservation.
The digest key lives beside the database. It protects a database file copied on its own, not a copy of the whole state folder.

Sending real email or delivering to external systems. Delivery stays in a local outbox.
Connecting to a mailbox, opening links, or extracting attachments.
Automatic remediation of anything a scan reports.
Running as a hosted service. This website is information only; it does not run ForgeVigil.