Support

// what ghost architect™ local is

Ghost Architect™ Local is the LAN-deployed edition. Every scan runs against a model server you host yourself, on a machine you own. Your code is read from your disk, analysed by your model, and written to reports on your machines.

// getting it

How do I get the download?

Local is delivered directly by us, not through a public package registry. Fill in the form on the download page and EJ replies with the link, or with access to the delivery repository, usually the same day. If you already have repository access:

gh release download v7.0.4 --repo EJWisner/ghost-local-delivery

How do I verify the tarball before I install it?

The file is about to become a global command on your machine, so check it first:

shasum -a 256 ghost-architect-local-7.0.4.tgz

On Windows PowerShell: Get-FileHash -Algorithm SHA256 ghost-architect-local-7.0.4.tgz

Expected for 7.0.4: 12b6d385a7f4f9140c0378064a6c1235fed19f6729275e65759041d5a9e9d8fb

If the hash does not match, stop. Do not install it. Email [email protected] with what you got.

// requirements

• macOS 13 or later, Linux, or Windows 10 or later. The installer checks the OS floor and stops below it rather than guessing.
• Node.js 24 or later. The installer checks for it and does not install it.
• A model server on your network with a model pulled: Ollama, vLLM, LM Studio, Jan.ai, or any OpenAI-compatible endpoint. Our own estate runs qwen3:14b on Ollama.
• Roughly 20 GB of disk for a code-capable model.
• A second machine only if you want the fleet view. Any of the three platforms can be a spoke.

The installer does not install Node.js, Homebrew or Ollama for you. It checks for them and stops with a single list of what is missing.

// installing

Everything happens inside the directory you unpack. Keep that directory: the global ghost command links into it rather than copying it.

tar -xzf ghost-architect-local-7.0.4.tgz
cd package
bash install/setup.sh              # macOS
sudo bash install/setup-linux.sh   # Linux
.\install\setup.ps1                # Windows, elevated PowerShell

The installer tells you the three things it changes on your machine before it changes them, and the full guide, INSTALL.md, is in the directory you just unpacked.

How do I upgrade?

Re-running the installer is the supported upgrade path. Your service account, data root and signing key are left alone.

Is the Windows installer safe to use?

Honest answer: it ships covered by tests but has not yet been run on a real Windows machine, and says so in its own header. Treat a Windows install as a first run and send us the console output either way.

// first run and the evaluation trial

Run ghost. The evaluation trial starts on first use, registered against that install, and the product tells you the day it ends. No card, no account.

Start with Recon: one planner call that sizes the codebase and tells you what a full scan would read, how many passes, and how long, with the basis of that estimate printed beside the number.

Then open the portal it prints (https://localhost:3443 by default) for the Fleet page, the queue, LLM Status and the reports.

To keep it, convert from inside the product during the evaluation. The licence arrives by email, signed, and activates against that install.

// hub and spokes

What is the difference?

One machine is the hub: it holds the model server, the user roster, the licence, the portal and the queue. Every other machine is a spoke. A spoke runs scans and reports them back, and its model calls relay to the hub's model server over your LAN, so a spoke does not need its own model. A solo installation is just a hub.

How do I add a machine?

Enrol it from Admin Console on the hub. On the new machine, run ghost, choose Spoke, and enter the hub address plus the activation token from your admin.

What do the roles mean?

• admin and architect see the full portal
• developer works with assigned projects
• viewer sees project health and reports
• auditor sees the audit log and compliance exports

// the portal says "not secure"

That is expected on a first visit, and please do not just click through it. Your hub generates its own TLS certificate at install time, and a browser will not trust it until you tell it to. The connection is encrypted either way; what the browser cannot confirm yet is your hub's identity.

Admin Console, System Settings, TLS prints the exact commands with your own hub address already filled in, and docs/PORTAL-CERTIFICATE.md in your install has the steps for macOS, Windows and Linux. It takes about two minutes per machine. A certificate from your own internal CA removes the step entirely.

// zero egress

Does anything leave my network?

One call, once: licence activation sends the licence key and an install id to ghostarchitect.dev and gets a signed licence back. Nothing from your codebase is in it. After that you can turn on zero-egress mode and the product refuses every internet-bound destination at the code level.

What stays reachable under zero egress are the LAN destinations you control: your model endpoint, your SMTP relay, your SIEM collector, and hub-to-spoke traffic between your own machines. Those do need to actually be on your network for the containment to hold.

How do I know what it can send?

Look in the product, not at a page like this one: Admin Console, System Settings, Egress Inventory lists every vector, its current on/off status, exactly what it would send, and how to turn it off. That screen is generated from the same code that gates the traffic, so it cannot drift from reality the way documentation can.

Activation fails with zero egress on. Is that a bug?

No, that is the design. Licence key activation is an outbound call, so zero egress blocks it and the product says so directly. Install the signed licence file instead:

ghost --install-license /path/to/license.json

Ask us for the file rather than turning zero egress off.

// licences

How do I install a purchased licence?

Two paths, both ending with a signed license.json in your data root, after which licence checks run fully offline. With outbound access: run ghost, open Admin Console, then License Management, and enter your key. Fully offline: we send you the signed file and you run ghost --install-license.

What does it cost?

Local is an annual licence with no per-token bill. Current terms are on the pricing page, and for anything that turns on team size, departments or seats, email [email protected] and EJ will confirm it for your situation directly rather than have you work it out from a table.

// if something goes wrong

• ghost --version confirms the CLI is installed and on your PATH.
• logs/portal.log in your data root (usually ~/.ghost-local/logs/portal.log) is the first place to look if the portal address does not answer. It holds both the portal's output and its errors.
• logs/scheduler.log is where to look if a scheduled job did not run.
• If the installer's self-test failed, the product is installed and your model provider is the thing to look at. That is why the installer says so rather than claiming a broken install.

Anything else: email [email protected] and include the installer output, or start a chat above with the product set to Local.