gnome-jarvis/docs/security-privacy.md

Security and privacy

The default posture is local inference, explicit writes, and fail-closed computer use. No telemetry or cloud inference is required. Local QVAC chat stays on this computer. An opt-in Settings switch can send only web-page thinking to Groq (agentInference: "groq"). Chrome still crawls locally. Speech, wake, files, shell, desktop, and camera stay on the local model. Groq is off by default. The only public web tool is browser. It does not wait for confirmation and does not need an extra API key. It runs in a Jarvis-owned Chromium window. Private, loopback, and metadata URLs are blocked before the browser starts. There is no SearXNG dependency. Shell commands that open public HTTP (curl, wget) remain blocked by the runtime; use browser instead.

flowchart TD
  R[User request] --> P{Permission gate}
  P -->|read| X[Execute locally]
  P -->|write / dangerous| C{Explicit confirmation?}
  C -->|yes| X
  C -->|no| B[Block and explain]
  X --> A[Audit metadata]
  X --> D[Return result]
  L[Lock screen] --> K[Revoke CU + webcam + mute HUD]

Protected assets

• Microphone audio remains in a RAM ring buffer unless transcript retention is explicitly enabled.
• Screen frames remain in memory or temporary storage and are wiped on computer-use revoke by default.
• Webcam stills stay under /tmp/jarvis-webcam and are wiped on camera revoke, lock screen, cancel, or WipeComputerTraces(). Camera access is off by default and needs Settings plus Allow now.
• Computer-use audit logs store action metadata and screenshot hashes, not screenshots.
• Voice references, memory, and model caches are user-owned files.
• QVAC binds to localhost; bearer tokens, when used, come from user-owned configuration and are not logged.
• Groq API keys live in config.json or GROQ_API_KEY / JARVIS_GROQ_API_KEY. Runtime status redacts them. They are never written to the privacy log.
• Opt-in Groq chat sends conversation text to api.groq.com. Webcam stills are included only when a Groq vision model is selected. Microphone audio is not sent. Do not enable Groq if that cloud path is unacceptable.

Filesystem access

Path tools default to the Jarvis workspace (~/.local/share/jarvis-qvac when installed). Settings can widen that to your home directory or the entire filesystem. This is still your user account: Jarvis does not gain root, and writes plus shell commands still go through the confirmation gate.

Computer-use controls

Computer use requires a spoken or HUD grant, shows a visible cursor/target, and stops on revoke, Escape, lock screen, or grant expiry. It refuses password fields, dangerous actions without confirmation, and actuation when the portal or EIS backend is not ready. Legacy input is opt-in.

Camera access is a separate fail-closed grant. Enable it in Settings, press Allow now, then the agent may call webcam. Revoke, lock screen, cancel, and grant expiry wipe captured stills.

Threat model boundaries

The daemon assumes the local user account and installed desktop libraries are trusted. A malicious local process with access to the user's session bus or filesystem is outside the protection boundary. Keep the repository and model cache user-owned, use a restrictive token file mode, and avoid running the daemon as root.