EagleFrontier Diligence Q&A

01Problem问题

The first version stored investors' confidential files on our cloud backend, but the company's data policy says the raw data never leaves our own machine. The fix had to keep the rest of the product shipping.第一版把投资人的保密文件存在云端后端，而公司的数据政策要求原始数据不离开我们自己的机器。修复不能拖住产品其余功能的上线。

02How it works原理

• Data and answering stay on one machine we own. Cost: a single machine, no auto-scaling or managed backups.数据和回答都留在我们自己的一台机器上。代价：单机，没有自动扩容和托管备份。
• The portal stays in the cloud (login, MFA, CRM) and only relays questions. Cost: one more hop and an inbound path to the local machine, limited to one address.门户留在云端（登录、MFA、CRM），只转发问题。代价：多一跳，以及通向本地机器的入站路径，仅限一个地址。
• If the local machine is down, answers wait. It never falls back to a cloud model, because one fallback is one leak that cannot be undone.本地机器停了，回答就等。绝不退回云端模型：一次回退就是一次无法收回的外流。
• Numbers never come from a model. The service looks up approved facts by company, metric and period, cites file and row, and says “not in the data” when it finds nothing. Cost: open-ended analysis is not supported.数字不交给模型。服务按公司、指标、期间查批准过的事实，带出文件和行号，查不到就说“不在数据里”。代价：不支持开放式分析。
• Data counts only once approved: a manifest with a SHA-256 hash per file, and a changed file is not served. Cost: adding data means editing the manifest and restarting.数据批准后才生效：清单登记每个文件的 SHA-256 哈希，文件被改动就不再服务。代价：加数据要改清单并重启。
• Logs say who asked, when, and how it ended, never what was asked. Cost: a wrong answer cannot be replayed from the logs.日志只记谁问的、何时、结果如何，不记问了什么。代价：答错了没法从日志重放。

03What I built我做了什么

• A master switch (off by default) and a people list with approver, reference and a 90-day expiry, so everything else shipped while diligence stayed closed.总开关（默认关闭）加 people 名单，记录批准人、凭据和 90 天到期，其余功能照常上线，尽调保持关闭。
• Turned the backend into a relay: removed upload, storage and six tables. The migration refuses to run if any of them holds data.把后端改成转发层：删掉上传、存储和 6 张表；迁移遇到表里有数据就拒绝执行。
• The relay accepts only private-network and loopback IP addresses, checked before any DNS lookup or connection. Anything else, or a missing token, returns 503.转发层只接受私有网络和回环 IP 地址，在任何 DNS 查询和连接之前就检查；其他地址或缺少令牌一律返回 503。
• The audit row is written before the question is forwarded and records only who, when, outcome and latency. The database transaction is closed before the wait, so a slow answer holds no connection.审计行在转发之前写入，只记录谁、何时、结果和耗时；等待回答之前先结束数据库事务，慢回答不占连接。
• Per-person limits (20 a minute, 200 a day) and 8 in flight per process, backed by Redis; if Redis fails, the request is refused, not let through.按人限流（每分钟 20、每天 200），每个进程最多 8 个同时转发，由 Redis 支撑；Redis 出错时拒绝请求，不放行。
• A strict contract with the local service: unexpected fields, oversize or malformed replies return 502 and are never shown.与本地服务约定严格的契约：多出的字段、超大或格式不对的回复返回 502，不显示给用户。

04Architecture架构

05Measured测量结果

06Limits, stated plainly局限，直说

• Employer code is private; this page describes the design only.雇主代码不公开，本页只描述设计。
• The local Q&A service is not running in production yet, so diligence stays switched off until the people list is approved and the service is installed.本地问答服务尚未在生产中运行，所以在批准名单确定、服务装好之前，尽调保持关闭。
• One machine: if it is down, answers wait. External investors are not enabled yet; that needs per-company grants and NDA dates first.单机：机器停了回答就等。外部投资人暂未开放，需要先补按公司授权和 NDA 日期。
• It answers only what is in the approved tables; open-ended analysis is out of scope.只回答批准表格里有的内容，不做开放式分析。

07Next下一步

• In progress: code computes totals and rankings, and a check compares every number in an answer with the data before it is shown.进行中：由代码计算合计和排名，答案显示之前，逐个数字与数据核对。
• After go-live: a running count of outbound connections and canary strings in the data, as ongoing proof that nothing leaves.上线后：持续统计出站连接，并在数据里放金丝雀字符串，持续证明没有东西流出。