71 lines
3.3 KiB
Markdown
71 lines
3.3 KiB
Markdown
# Security and privacy
|
|
|
|
The default posture is local inference, explicit writes, and fail-closed
|
|
computer use. No telemetry or cloud inference is required. Local QVAC chat
|
|
stays on this computer. An opt-in Settings switch can send **only web-page
|
|
thinking** to Groq (`agentInference: "groq"`). Chrome still crawls locally.
|
|
Speech, wake, files, shell, desktop, and camera stay on the local model. Groq
|
|
is off by default. The only public web tool is `browser`. It does not wait for
|
|
confirmation and does not need an extra API key. It runs in a Jarvis-owned
|
|
Chromium window. Private, loopback, and metadata URLs are blocked before the
|
|
browser starts. There is no SearXNG dependency. Shell commands that open public
|
|
HTTP (curl, wget) remain blocked by the runtime; use `browser` instead.
|
|
|
|
```mermaid
|
|
flowchart TD
|
|
R[User request] --> P{Permission gate}
|
|
P -->|read| X[Execute locally]
|
|
P -->|write / dangerous| C{Explicit confirmation?}
|
|
C -->|yes| X
|
|
C -->|no| B[Block and explain]
|
|
X --> A[Audit metadata]
|
|
X --> D[Return result]
|
|
L[Lock screen] --> K[Revoke CU + webcam + mute HUD]
|
|
```
|
|
|
|
## Protected assets
|
|
|
|
- Microphone audio remains in a RAM ring buffer unless transcript retention is
|
|
explicitly enabled.
|
|
- Screen frames remain in memory or temporary storage and are wiped on
|
|
computer-use revoke by default.
|
|
- Webcam stills stay under `/tmp/jarvis-webcam` and are wiped on camera
|
|
revoke, lock screen, cancel, or `WipeComputerTraces()`. Camera access is
|
|
off by default and needs Settings plus Allow now.
|
|
- Computer-use audit logs store action metadata and screenshot hashes, not
|
|
screenshots.
|
|
- Voice references, memory, and model caches are user-owned files.
|
|
- QVAC binds to localhost; bearer tokens, when used, come from user-owned
|
|
configuration and are not logged.
|
|
- Groq API keys live in `config.json` or `GROQ_API_KEY` / `JARVIS_GROQ_API_KEY`.
|
|
Runtime status redacts them. They are never written to the privacy log.
|
|
- Opt-in Groq chat sends conversation text to `api.groq.com`. Webcam stills are
|
|
included only when a Groq vision model is selected. Microphone audio is not
|
|
sent. Do not enable Groq if that cloud path is unacceptable.
|
|
|
|
## Filesystem access
|
|
|
|
Path tools default to the Jarvis workspace (`~/.local/share/jarvis-qvac` when
|
|
installed). Settings can widen that to your home directory or the entire
|
|
filesystem. This is still your user account: Jarvis does not gain root, and
|
|
writes plus shell commands still go through the confirmation gate.
|
|
|
|
## Computer-use controls
|
|
|
|
Computer use requires a spoken or HUD grant, shows a visible cursor/target, and
|
|
stops on revoke, Escape, lock screen, or grant expiry. It refuses password
|
|
fields, dangerous actions without confirmation, and actuation when the portal
|
|
or EIS backend is not ready. Legacy input is opt-in.
|
|
|
|
Camera access is a separate fail-closed grant. Enable it in Settings, press
|
|
Allow now, then the agent may call `webcam`. Revoke, lock screen, cancel, and
|
|
grant expiry wipe captured stills.
|
|
|
|
## Threat model boundaries
|
|
|
|
The daemon assumes the local user account and installed desktop libraries are
|
|
trusted. A malicious local process with access to the user's session bus or
|
|
filesystem is outside the protection boundary. Keep the repository and model
|
|
cache user-owned, use a restrictive token file mode, and avoid running the
|
|
daemon as root.
|