Repository navigation
Make grouping opt-in and document local privacy storage - #3
Open
yeelam-gordon wants to merge 4 commits into
Open
yeelam-gordon wants to merge 4 commits into
yeelam-gordon wants to merge 4 commits into
Conversation
Default manual suggestions to wordmatch, preserve explicit engines and legacy ACP opt-in, and disclose local indexes, discovery/model caches and outbound data. Ship and expose the privacy notice, update localized defaults, and cover startup gating with regressions. Co-authored-by: Copilot <[email protected]>
There was a problem hiding this comment.
🟡 Changes recommended
Storage descriptions and localized setup instructions remain inconsistent with the implementation and generated template.
17 open findings
What changed in this PR
Makes grouping privacy-preserving by default and documents local storage/network boundaries.
Changes:
- Defaults to manual wordmatch grouping with explicit automatic opt-in.
- Adds early
--help/--privacyhandling and comprehensive privacy documentation. - Packages privacy guidance and updates configuration/install documentation.
| File | Description |
|---|---|
src/ui/mod.rs |
Gates automatic grouping on opt-in. |
src/main.rs |
Adds early help/privacy output. |
src/grouping/remote.rs |
Corrects remote payload documentation. |
src/grouping/mod.rs |
Marks remote grouping opt-in. |
src/config.rs |
Adds manual wordmatch defaults and opt-in resolution. |
SECURITY.md |
Expands sensitive-storage guidance. |
README.md |
Updates installation and privacy guidance. |
PRIVACY.md |
Documents storage, retention, and network boundaries. |
docs/usage.md |
Updates operating and removal guidance. |
docs/i18n/README.zh-TW.md |
Updates localized privacy guidance. |
docs/i18n/README.zh-CN.md |
Updates localized privacy guidance. |
docs/i18n/README.vi.md |
Updates localized privacy guidance. |
docs/i18n/README.tr.md |
Updates localized privacy guidance. |
docs/i18n/README.ru.md |
Updates localized privacy guidance. |
docs/i18n/README.pt-BR.md |
Updates localized privacy guidance. |
docs/i18n/README.ko.md |
Updates localized privacy guidance. |
docs/i18n/README.ja.md |
Updates localized privacy guidance. |
docs/i18n/README.it.md |
Updates localized privacy guidance. |
docs/i18n/README.id.md |
Updates localized privacy guidance. |
docs/i18n/README.hi.md |
Updates localized privacy guidance. |
docs/i18n/README.fr.md |
Updates localized privacy guidance. |
docs/i18n/README.es.md |
Updates localized privacy guidance. |
docs/i18n/README.de.md |
Updates localized privacy guidance. |
docs/i18n/README.ar.md |
Updates localized privacy guidance. |
config.toml.template |
Documents new defaults and storage behavior. |
AGENTS.md |
Records the revised design decisions. |
.github/workflows/release.yml |
Packages PRIVACY.md in release archives. |
.github/instructions/security.instructions.md |
Updates sensitive-data guidance. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Address PRIVACY-001: direct older and unknown builds to browser/archive policy reading without executing the binary. Explain that unsupported privacy/help flags can start discovery and automatic remote grouping. Co-authored-by: Copilot <[email protected]>
Distinguish HF_HOME model assets from the fixed embedding cache, document summary-enriched local grouping separately from original-title outbound fields, and repair all 15 localized setup steps. Add offline production-payload capture and localized TOML regression tests; released runtime behavior is unchanged. Co-authored-by: Copilot <[email protected]>
There was a problem hiding this comment.
🟢 Approval recommended
The implementation, compatibility behavior, tests, documentation, and release packaging consistently enforce the stated privacy defaults.
0 open findings
17 resolved since last review
🧠 Review effort: Balanced
Separate TUI orchestration and cache writes from Tantivy indexing, fastembed model downloads, and installed agent CLI behavior. Co-authored-by: Copilot <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Default startup grouping can send session metadata to a hosted service before the user explicitly opts into automatic grouping. Search also persists more than basic metadata, without one authoritative privacy statement describing the locations and retention.
Changes
Evidence
Latest stable core and semantic release clippy passed. Core unit tests on corrected head: 235 passed, 1 existing ignored; semantic tests: 5 passed. Generated OS configurations validated; built executable help/privacy probes produced no runtime config/data/log files. No dependency updates or user-history operations.
Final Windows/Linux CI passed; independent full/delta behavior review found no remaining evidenced blockers. No release is published by this PR.
Review follow-through
Copilot review at head 2e09e25 recommends approval with zero open findings (2026-10-13T05:38:56Z). The local review helper still does not recognize the new zero-open-findings wording; its convergence flag is not being overridden.