52 lines
2.0 KiB
Markdown
52 lines
2.0 KiB
Markdown
# Security and privacy
|
|
|
|
The default posture is local-only, explicit, and fail-closed. No telemetry or
|
|
cloud inference is required. The network policy rejects unexpected outbound
|
|
model or tool traffic; optional model-fetch features remain user initiated.
|
|
|
|
```mermaid
|
|
flowchart TD
|
|
R[User request] --> P{Permission gate}
|
|
P -->|read| X[Execute locally]
|
|
P -->|write / dangerous| C{Explicit confirmation?}
|
|
C -->|yes| X
|
|
C -->|no| B[Block and explain]
|
|
X --> A[Audit metadata]
|
|
X --> D[Return result]
|
|
L[Lock screen] --> K[Revoke CU + mute overlay]
|
|
```
|
|
|
|
## Protected assets
|
|
|
|
- Microphone audio remains in a RAM ring buffer unless transcript retention is
|
|
explicitly enabled.
|
|
- Screen frames remain in memory or temporary storage and are wiped on
|
|
computer-use revoke by default.
|
|
- Computer-use audit logs store action metadata and screenshot hashes, not
|
|
screenshots.
|
|
- Voice references, memory, and model caches are user-owned files.
|
|
- QVAC binds to localhost; bearer tokens, when used, come from user-owned
|
|
configuration and are not logged.
|
|
|
|
## Filesystem access
|
|
|
|
Path tools default to the Jarvis workspace (`~/.local/share/jarvis-qvac` when
|
|
installed). Settings can widen that to your home directory or the entire
|
|
filesystem. This is still your user account: Jarvis does not gain root, and
|
|
writes plus shell commands still go through the confirmation gate.
|
|
|
|
## Computer-use controls
|
|
|
|
Computer use requires a spoken or HUD grant, shows a visible cursor/target, and
|
|
stops on revoke, Escape, lock screen, or grant expiry. It refuses password
|
|
fields, dangerous actions without confirmation, and actuation when the portal
|
|
or EIS backend is not ready. Legacy input is opt-in.
|
|
|
|
## Threat model boundaries
|
|
|
|
The daemon assumes the local user account and installed desktop libraries are
|
|
trusted. A malicious local process with access to the user's session bus or
|
|
filesystem is outside the protection boundary. Keep the repository and model
|
|
cache user-owned, use a restrictive token file mode, and avoid running the
|
|
daemon as root.
|