54 lines
2.1 KiB
Markdown
54 lines
2.1 KiB
Markdown
# Security and privacy
|
|
|
|
The default posture is local inference, explicit writes, and fail-closed
|
|
computer use. No telemetry or cloud inference is required. Model endpoints
|
|
stay on localhost. Public `web_search` and `web_fetch` are allowed by default
|
|
without a confirmation prompt. Shell commands that open public HTTP (curl,
|
|
wget) remain blocked by the runtime; use the web tools instead.
|
|
|
|
```mermaid
|
|
flowchart TD
|
|
R[User request] --> P{Permission gate}
|
|
P -->|read| X[Execute locally]
|
|
P -->|write / dangerous| C{Explicit confirmation?}
|
|
C -->|yes| X
|
|
C -->|no| B[Block and explain]
|
|
X --> A[Audit metadata]
|
|
X --> D[Return result]
|
|
L[Lock screen] --> K[Revoke CU + mute overlay]
|
|
```
|
|
|
|
## Protected assets
|
|
|
|
- Microphone audio remains in a RAM ring buffer unless transcript retention is
|
|
explicitly enabled.
|
|
- Screen frames remain in memory or temporary storage and are wiped on
|
|
computer-use revoke by default.
|
|
- Computer-use audit logs store action metadata and screenshot hashes, not
|
|
screenshots.
|
|
- Voice references, memory, and model caches are user-owned files.
|
|
- QVAC binds to localhost; bearer tokens, when used, come from user-owned
|
|
configuration and are not logged.
|
|
|
|
## Filesystem access
|
|
|
|
Path tools default to the Jarvis workspace (`~/.local/share/jarvis-qvac` when
|
|
installed). Settings can widen that to your home directory or the entire
|
|
filesystem. This is still your user account: Jarvis does not gain root, and
|
|
writes plus shell commands still go through the confirmation gate.
|
|
|
|
## Computer-use controls
|
|
|
|
Computer use requires a spoken or HUD grant, shows a visible cursor/target, and
|
|
stops on revoke, Escape, lock screen, or grant expiry. It refuses password
|
|
fields, dangerous actions without confirmation, and actuation when the portal
|
|
or EIS backend is not ready. Legacy input is opt-in.
|
|
|
|
## Threat model boundaries
|
|
|
|
The daemon assumes the local user account and installed desktop libraries are
|
|
trusted. A malicious local process with access to the user's session bus or
|
|
filesystem is outside the protection boundary. Keep the repository and model
|
|
cache user-owned, use a restrictive token file mode, and avoid running the
|
|
daemon as root.
|