R1

docs/security-privacy.md

@@ -0,0 +1,44 @@
+# Security and privacy
+
+The default posture is local-only, explicit, and fail-closed. No telemetry or
+cloud inference is required. The network policy rejects unexpected outbound
+model or tool traffic; optional model-fetch features remain user initiated.
+
+```mermaid
+flowchart TD
+  R[User request] --> P{Permission gate}
+  P -->|read| X[Execute locally]
+  P -->|write / dangerous| C{Explicit confirmation?}
+  C -->|yes| X
+  C -->|no| B[Block and explain]
+  X --> A[Audit metadata]
+  X --> D[Return result]
+  L[Lock screen] --> K[Revoke CU + mute overlay]
+```
+
+## Protected assets
+
+- Microphone audio remains in a RAM ring buffer unless transcript retention is
+  explicitly enabled.
+- Screen frames remain in memory or temporary storage and are wiped on
+  computer-use revoke by default.
+- Computer-use audit logs store action metadata and screenshot hashes, not
+  screenshots.
+- Voice references, memory, and model caches are user-owned files.
+- QVAC binds to localhost; bearer tokens, when used, come from user-owned
+  configuration and are not logged.
+
+## Computer-use controls
+
+Computer use requires a spoken or HUD grant, shows a visible cursor/target, and
+stops on revoke, Escape, lock screen, or grant expiry. It refuses password
+fields, dangerous actions without confirmation, and actuation when the portal
+or EIS backend is not ready. Legacy input is opt-in.
+
+## Threat model boundaries
+
+The daemon assumes the local user account and installed desktop libraries are
+trusted. A malicious local process with access to the user's session bus or
+filesystem is outside the protection boundary. Keep the repository and model
+cache user-owned, use a restrictive token file mode, and avoid running the
+daemon as root.