3.5 KiB
Privacy, telemetry, and PII (Capability word 10)
Bare OS telemetry is operator-controlled and bounded. Guests must treat every field as potentially visible to hosts, log sinks, and replicated drives.
Fields to scrub or never emit
When building custom NDJSON / OTel mirrors or Pear-side aggregators, treat these as PII or secret-adjacent unless you have an explicit retention policy:
- Identity:
BARE_OS_SESSION_ID,BARE_OS_PUBLIC_KEY, device or account ids from Pear, HDMS vault labels that name people. - Network: full URLs with query strings, raw IP addresses paired with timestamps, DHT bootstrap strings copied from operator clipboards.
- Crypto / auth: TLS session keys, Hypercore secret keys, multisig payloads,
BARE_OS_LKG_SYSTEM_KEY_HEX, any*TOKEN*or*SECRET*env values. - Paths: home directory absolute paths on the host when they include real usernames (prefer basenames already used in
$HOMEmapping). - Capability word 8 fields:
sessionForkGeneration,vaultRotateCount, multisig / trust-graph ids surfaced as pointers, OIDC publishing URLs, subprocessuidGidMapHint, RocksDB / sidecar manifest pointers — treat as operator metadata; scrub before cross-tenant export. - Capability word 9 fields:
bareModuleCryptoStagingProbeId,bareModuleProbeClass, Pear stage / appling / updater / radio / wakeups sketches fromBARE_OS_*_JSONenv mirrors, SOCKS / HTTP proxy map keys (host-only interpretation) — treat as deployment fingerprinting; scrub or bucket before multi-tenant export. - Capability word 10 fields:
pearInspectLoggerTlsProbeId,bareRpcProbeClass, Pear doctor / workshop / RTI / user-dirs sketches, Bare logger tap payloads, mTLS proxy map keys, thread-pool telemetry JSON — treat as operator metadata; scrub before cross-tenant export. - Capability word 11 fields:
hypercorePackHrpcLifecycleProbeId, hypercore replicate budget / drive graph / protomux backpressure / Pear matrix / bundle preload / HRPC allowlist / sidecar cap / git LFS / net QoS / storage tier / indexer catchup / multisig quorum / relay geo sketches — operator hints only; no secret material in stock paths.
Stock emitters avoid logging env wholesale; /proc/self/environ omits secret-like keys. Prefer hashed or bucketed counters (e.g. pairing backoff counts) over raw payloads.
GDPR / subprocessors (operator template)
Operators running Bare OS as part of a service should maintain a subprocessor list (who processes telemetry, drive replication, Pear runtime updates, HDMS pairing) and tie it to retention policies. The stock tree does not ship legal text; use this section as a checklist when filling DPA / privacy policy annexes.
Schema versions
- NDJSON lifecycle / telemetry: see
BARE_OS_LIFECYCLE_SCHEMA_VERSION(10 in stock tree) and rows indocs/reference/compatibility-matrix.md. - OTel-inspired lines:
otlSchemaVersion: 7, examplekernel/etc/bare-os/otel-jsonl.example.json, schemadocs/schemas/otel-bare-os-jsonl.schema.json. - Audit JSON:
auditSchemaVersion: 7(delegate depth / Capability word 9–10 RPC classes); optionalrequestSmugglingClassremains defaultnonein stock emitters where applicable.