Self-hosted Core

Run the full pattern pipeline locally.

PATAS Core is the AGPL-3.0 Python system behind the wider research and rule-management workflow. It is separate from the smaller hosted audit contract.

Before you choose Core

Use Core when

You need on-premises data control.
You have labeled historical logs.
You can operate Python, a database, and optional model providers.
You need rule lifecycle, evaluation, and monitoring surfaces.

Use the hosted API when

You want a first report quickly.
Your audit fits 500 rows per request.
You do not need to operate infrastructure.
You can send a narrow sanitized export.

Repository quickstart

The current repository requires Python 3.10 and Poetry. Start by proving the CLI before configuring external services.

git clone https://github.com/PATAS-TAS/PATAS.git
cd PATAS
poetry install
cp .env.example .env
poetry run patas --help

The repository's current .env.example is intentionally sparse. Treat the wiki configuration pages and production Compose file as references, then verify every variable against the code version you deploy.

Pipeline

1. Ingest: normalize labeled historical messages from CSV, JSONL, or an integration adapter.
2. Discover: fast deterministic scanning finds candidates; optional semantic analysis examines the suspicious subset.
3. Generate: create inspectable pattern and rule candidates.
4. Evaluate: run candidates against historical spam and ham labels.
5. Promote: only your own policy and measured thresholds determine deployment.
6. Monitor: track precision, recall, coverage, and degradation over time.

Safety profiles

Profile	Intended use	Hard action
Conservative	Highest-precision candidates and low-impact actions	Only after local validation
Balanced	Signals, prioritization, and review	No automatic ban
Aggressive	Offline research and discovery	Never in production

Wiki thresholds are starting points, not universal guarantees. Recalculate them on your own labeled data and keep representative ham examples in every evaluation.

Privacy and models

Core can run without an external LLM. For strict environments, keep model and embedding providers disabled or point them at internal endpoints, minimize logs, and define retention before ingestion. Never infer that “self-hosted” means private if you configured an external provider.

Deployment checklist

Pin the exact commit and dependency lock.
Set non-default database and monitoring credentials.
Keep the API behind authentication, TLS, and a rate-limiting proxy.
Run safety evaluation and shadow evaluation before promotion.
Back up the database and test restoration.
Measure false positives on local ham, not only spam recall.

Full technical references

Source repository Wiki quickstart Configuration reference Safety profiles Privacy and data protection