gnome-jarvis/docs/security-privacy.md

Security and privacy

The default posture is local inference, explicit writes, and fail-closed computer use. No telemetry or cloud inference is required. Model endpoints stay on localhost. Public web_search and web_fetch are allowed by default without a confirmation prompt. Shell commands that open public HTTP (curl, wget) remain blocked by the runtime; use the web tools instead.

flowchart TD
  R[User request] --> P{Permission gate}
  P -->|read| X[Execute locally]
  P -->|write / dangerous| C{Explicit confirmation?}
  C -->|yes| X
  C -->|no| B[Block and explain]
  X --> A[Audit metadata]
  X --> D[Return result]
  L[Lock screen] --> K[Revoke CU + mute overlay]

Protected assets

• Microphone audio remains in a RAM ring buffer unless transcript retention is explicitly enabled.
• Screen frames remain in memory or temporary storage and are wiped on computer-use revoke by default.
• Computer-use audit logs store action metadata and screenshot hashes, not screenshots.
• Voice references, memory, and model caches are user-owned files.
• QVAC binds to localhost; bearer tokens, when used, come from user-owned configuration and are not logged.

Filesystem access

Path tools default to the Jarvis workspace (~/.local/share/jarvis-qvac when installed). Settings can widen that to your home directory or the entire filesystem. This is still your user account: Jarvis does not gain root, and writes plus shell commands still go through the confirmation gate.

Computer-use controls

Computer use requires a spoken or HUD grant, shows a visible cursor/target, and stops on revoke, Escape, lock screen, or grant expiry. It refuses password fields, dangerous actions without confirmation, and actuation when the portal or EIS backend is not ready. Legacy input is opt-in.

Threat model boundaries

The daemon assumes the local user account and installed desktop libraries are trusted. A malicious local process with access to the user's session bus or filesystem is outside the protection boundary. Keep the repository and model cache user-owned, use a restrictive token file mode, and avoid running the daemon as root.