L0

Node

What stops here:
Tokenized / safe (Streamable HTTP + WSS)
PII-bearing — never crosses L3
Audit (dual-write)
MCP elicitation