1.7 KiB
Security and privacy
The default posture is local-only, explicit, and fail-closed. No telemetry or cloud inference is required. The network policy rejects unexpected outbound model or tool traffic; optional model-fetch features remain user initiated.
flowchart TD
R[User request] --> P{Permission gate}
P -->|read| X[Execute locally]
P -->|write / dangerous| C{Explicit confirmation?}
C -->|yes| X
C -->|no| B[Block and explain]
X --> A[Audit metadata]
X --> D[Return result]
L[Lock screen] --> K[Revoke CU + mute overlay]
Protected assets
- Microphone audio remains in a RAM ring buffer unless transcript retention is explicitly enabled.
- Screen frames remain in memory or temporary storage and are wiped on computer-use revoke by default.
- Computer-use audit logs store action metadata and screenshot hashes, not screenshots.
- Voice references, memory, and model caches are user-owned files.
- QVAC binds to localhost; bearer tokens, when used, come from user-owned configuration and are not logged.
Computer-use controls
Computer use requires a spoken or HUD grant, shows a visible cursor/target, and stops on revoke, Escape, lock screen, or grant expiry. It refuses password fields, dangerous actions without confirmation, and actuation when the portal or EIS backend is not ready. Legacy input is opt-in.
Threat model boundaries
The daemon assumes the local user account and installed desktop libraries are trusted. A malicious local process with access to the user's session bus or filesystem is outside the protection boundary. Keep the repository and model cache user-owned, use a restrictive token file mode, and avoid running the daemon as root.