Settings and outbound network control
Every setting explained, and every connection this program makes named.
In the adminSettings

| To | Run |
|---|---|
| Everything settable, and its default | quilzo config show |
| What one is for, and what it costs | quilzo config explain KEY |
| Change one; a weakening needs a reason | quilzo config set KEY VALUE --accept-risk "why" |
| Put one back | quilzo config unset KEY |
| What this may connect to, and why | quilzo network |
Every connection, named
Each outbound connection has a declared purpose (models, integrations, connectors, webhooks, guardrail, fleet and others) and is checked against the address actually dialled, after DNS. Set network.mode to offline and every connection that would leave the host is refused before a packet is sent, naming the feature that wanted it; loopback still works, so a local model keeps working.