Self-hosting

Run it yourself.

TRACE is the same engine whether it's our managed cloud or your laptop. Two shapes: a single container for personal use, or a multi-tenant Kubernetes deployment.

Personal — one container

The instance image bundles the engine, all models, and the web UI, and holds everything in memory. Build from the repo and run behind the gateway:

cd trace-search/web && npm ci && npm run build && cd ../..
docker build -f trace-search/deploy/instance/Dockerfile -t trace-search-instance:latest .
docker build -f trace-search/deploy/gateway/Dockerfile  -t trace-search-gateway:latest .
docker compose -f trace-search/deploy/docker-compose.yml up -d

The engine's C kernel is checksum-gated at build — the image won't build if the search implementation was altered by a byte.

Multi-tenant — Kubernetes (GKE)

The cloud deployment gives every session its own gVisor-sandboxed pod with a default-deny NetworkPolicy, memory-backed storage, and immediate disposal on exit. Humans connect a wallet; agents pay per request over x402. Full runbook:

Create a GKE cluster with Dataplane V2 and a GKE Sandbox (gVisor) nodepool.
Push the instance + gateway images to Artifact Registry.
kubectl apply -k trace-search/deploy/k8s after setting your domain, wallet, and ops public key.
Point your subdomain at the ingress; a Google-managed certificate handles TLS.

See trace-search/deploy/k8s/README.md in the repository for the step-by-step runbook, including the KYC intake VM.

Offline — Android

There is a native Android app that runs the same byte-parity engine entirely on-device. It has no network permission at all — the strongest possible no-remote-calls guarantee — and seals its library into an encrypted vault when you leave.