Proactive Support
Proactive Support is System9's phone-home support telemetry: a cell can send bounded health snapshots and per-channel event streams to corporate-owned infrastructure so a support team can triage a fleet and an operator can review the state of their own estate, the pattern an appliance vendor's "call-home / auto-support" channel follows.
Because System9 is sold to sovereign and air-gapped operators, this page treats the sovereignty question as the main question, not a footnote. A phone-home path is in direct tension with air-gapped-as-first-class, and the honest answer is architectural: telemetry is opt-out on every cell, consent-gated, redacted before it leaves, and governed by a single egress gate whose default is posture-aware and fails closed where it matters. The rest of this page is precise about what that does and does not guarantee today.
What actually phones home
Two pipelines carry telemetry, and one operator gate governs both:
| Pipeline | What it carries |
|---|---|
| Event streams | Per-channel operational events from the cell |
| Health snapshot | A single bounded cell health snapshot, sealed |
Every transmitted unit is wrapped in a signed and encrypted envelope that carries the cell principal that produced it, so a receiver can attribute and verify each one. The health snapshot is bounded by hard operating-mode limits. It is a health summary, not a data extract, and not a log dump.
Proactive Support is not the Activity Ledger and it is not metering. Metering (billing) is a separate, always-on plane and is not governed by the telemetry gate, opting out of Proactive Support never stops metered usage reporting, and never sends usage over this channel. Do not conflate "turn off phone-home" with "stop being metered."
The telemetry flow: with the air-gapped "sends nothing" branch
Figure: the phone-home flow. A bounded snapshot and event streams are redacted cell-side (cyan), then a verifier re-scans the serialized bytes and rejects the batch if a rule still matches (red), redaction is belt-and-braces, not best-effort. Two amber gates then stand in the path: a deny-by-default consent gate (both a config opt-in and a runtime consent flag must be set, or the payload is held on the cell), and a posture-aware egress gate. The detached, dashed node is the air-gapped outcome: on a TACTICAL posture (or when the posture or config cannot be resolved) the gate is off by default and fails closed, so the cell sends nothing. Only a COMMERCIAL/SOVEREIGN posture that has not opted out reaches the signed and encrypted envelope (green). Ceiling: the gate governs the two phone-home pipelines and metering is a separate always-on plane it does not touch; and while the gate is proven to fail closed on the restrictive cases, no whole-platform "egress-denied" conformance run exists yet, and whether phone-home sits on any startup-critical path is unverified.
Table equivalent
| Stage | Behavior | On failure / refusal |
|---|---|---|
| Redaction (cell-side) | Redact PII, customer id, and model output before serialization | |
| Redaction verifier | Re-scan the serialized payload for any surviving match | Reject the batch (deny) |
| Consent gate | Require both a config opt-in and a runtime consent flag | Hold on the cell; transmit nothing |
| Egress gate: TACTICAL / air-gapped | Off by default, fails closed | Sends nothing |
| Egress gate: posture/config unresolvable | Treated as air-gapped | Sends nothing (fail closed) |
| Egress gate: COMMERCIAL / SOVEREIGN | Permitted unless the operator opted out | Proceed to envelope |
| Envelope | Sign + encrypt; carry the cell principal |
How it is governed
Redacted before it leaves
Redaction runs cell-side, before transmission, driven by a consent profile: PII, customer identifiers, and model output are either replaced with a marker or deterministically hashed with a deployment-scoped salt (so the same value is correlatable across snapshots without disclosing it). A second, independent verifier re-scans the already-serialized payload; if any redaction rule still matches, the batch is rejected rather than sent, the assumption is that a surviving match means the redaction step had a bug, and the safe response is to not transmit.
Deny-by-default and consent-gated
The phone-home worker is default-off. Its scheduler enabled flag defaults
to off, the per-channel telemetry license features default to off (an issuer
must turn each customer on), and the envelope builder refuses to construct an
envelope at all unless a runtime consent flag is set with a non-empty consent
grant, so the scheduler requires both a configuration opt-in and a
runtime consent before it will transmit, and either one missing keeps the payload
on the cell. Redaction, in turn, defaults to deny-all (strip every class;
callers opt in per class). This is the deny-by-default posture the platform
applies everywhere: the capable path exists, but nothing flows until it is
explicitly turned on. The lifecycle also refuses to start the pipeline unless
an ingestion endpoint, a signing key, and the cell principal are all present, and
a further data-loss-prevention gate on the send path fails closed, a
raising inspector withholds the bundle rather than letting it out.
One operator opt-out gate, honored by both pipelines
A single operator control, an operator-facing config key named for the concept, never for any internal program name, stops all telemetry egress from the cell. It is honored by both the event-stream pipeline and the sealed-snapshot pipeline, so one toggle halts phone-home regardless of the licensing posture. The licensing model says what corporate infrastructure may collect; the operator can always decline locally.
The default and the failure direction are posture-aware
The opt-out flag is only half the decision. The deployment posture decides the default and, crucially, the failure direction:
| Posture | Default | If posture or config cannot be resolved |
|---|---|---|
| TACTICAL (military forward-edge, air-gap-friendly) | Off (opted out) | Suppress egress: fail closed |
| COMMERCIAL / SOVEREIGN | On unless the operator opts out (sovereign redacts) | Read as not opted out: a config hiccup never silently suppresses telemetry |
An explicit operator setting always wins in both directions: a tactical operator can deliberately opt in, and a commercial or sovereign operator can opt out. The load-bearing property is the tactical failure direction, reading "cannot determine policy" as "egress is fine" is exactly the silent failure that would turn an air-gapped deployment into a phone-home one, so on the air-gap-friendly posture an unresolvable posture or an unreadable config suppresses egress.
Be precise about what is and is not guaranteed:
- "Sovereign" posture is not "sends nothing" by default. In the deployment posture model, COMMERCIAL and SOVEREIGN keep phone-home on per the licensing model (with redaction); it is the TACTICAL / air-gap-friendly posture that is off by default and fails closed. A sovereign operator who wants zero egress must opt out (which is always honored locally).
- The gate is proven only on the restrictive cases in isolation. Tests assert the tactical default, the unresolvable-posture case, and the unreadable-config case, alongside the preserved commercial behavior, but no whole-platform "egress-denied" conformance run exists yet.
- It is unverified whether phone-home sits on any startup-critical path. Until the conformance run above exists, treat "the cell never egresses" as an operator-enforced posture, not a proven whole-system invariant.
Across the deployment matrix
| Corner | Behavior |
|---|---|
| Single-cell | The one cell decides its own posture and opt-out; redaction and both gates run locally. |
| Multi-cell | Each cell gates its own egress independently; there is no coordinator that can re-enable a cell that opted out. (When phone-home is on, an org's outbound socket is owned by an elected cell: see Multiple node egress per org.) |
| Sovereign / air-gapped | On the TACTICAL posture, egress is off by default and fails closed; an unresolvable posture or unreadable config suppresses egress. A SOVEREIGN posture that wants zero egress opts out locally. With air-gap mode enabled the worker transmits nothing over the network at all: the snapshot is written to a signed, encrypted support bundle for physical (sneakernet) carriage instead. |
| Cloud-enabled | COMMERCIAL/SOVEREIGN cells phone home per licensing unless opted out; every envelope is still signed, encrypted, redacted, and attributed to its cell principal. |
| Edge | The Edge Agent carries no phone-home implementation: its heartbeat to the cell is the edge's support channel; there is no separate telemetry envelope leaving the device. |
Related topics
- Monitoring & logging, the in-estate telemetry pipeline Proactive Support is distinct from; monitoring stays local, phone-home is the governed path out of the estate.
- Node log rolling, how on-cell logs are rolled and retained, separate from what phone-home summarizes.
- Metering, FinOps & tokenomics, the separate, always-on billing plane the telemetry gate does not govern.
- Multiple node egress per org how an org's outbound path is owned and elected, the road any egress rides.
- Edge & fleet management, fleet triage and response, one consumer of proactive support telemetry.