Claudinite growth: discover local pack on-device-privacy - #43
Merged
Conversation
The repo's defining constraint — an always-on living-room mic whose audio never leaves the machine — was stated in docs/DESIGN-AND-TRADEOFFS.md §0/§6 and the README's Privacy section, and enforced nowhere. No canon pack homes it and the repo had no local packs, so it lands as one, spanning both implementations (laughcounter/ and mac/Sources/) because the boundary is the same on either side. Three deterministic rules, each red-first fixtured in pack.test.mjs (fires on a violating input, quiet on the repo's real files): - on-device-privacy/no-network-client — no outbound client API in the capture path; token-based, so the optional extras' documented one-time model download (the TF-Hub handle, SpeechBrain's weights) stays legal. - on-device-privacy/loopback-default — host defaults in laughcounter/ must be loopback; the dashboard serves the whole laugh log unauthenticated. - on-device-privacy/on-device-speech — every SFSpeechAudioBufferRecognitionRequest must set requiresOnDeviceRecognition, or Speech streams living-room audio to Apple. What no check can carry is RULES.md prose: metadata persists but audio doesn't, one deletable home directory, the single accepted egress, the dashboard's CSRF guard, and keeping the Info.plist usage strings true. Refs #37 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mi6CmRAnQgKW3XEDg2xhiL
This was referenced Jul 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Weekly
growth-discover-packsrun (#37). The repo had no local packs; its captured knowledge lives indev/procedures/(CI/release, macOS audio lifecycle). Held the repo's stack against the canon shelf (basics,barriers,git-github,github-actions,grow_with_claudinite,tidy-repo) and one domain came out genuinely unhomed: the on-device privacy boundary — an always-on living-room mic whose audio never leaves the machine. It is the product's founding requirement (docs/DESIGN-AND-TRADEOFFS.md§0/§6, README Privacy, the Info.plist usage strings) and was enforced nowhere, in either implementation.The pack:
.claudinite/local/packs/on-device-privacy/Three deterministic rules, each with a red-first fixture in
pack.test.mjs(fires on a violating input, quiet on the repo's real files —node --test .claudinite/local/packs/on-device-privacy/pack.test.mjs, 6/6 green):no-network-clientlaughcounter/**.py,mac/Sources/**.swift). Token-based, not URL-based, so the optional extras' documented one-time model download (the TF-Hub handle indetector/yamnet.py, SpeechBrain's inspeaker.py) stays legal.loopback-defaultlaughcounter/must be loopback — the dashboard serves the entire laugh log with no auth (config.py:56,dashboard.py:40/122).on-device-speechSFSpeechAudioBufferRecognitionRequestmust setrequiresOnDeviceRecognition, or Speech streams the room to Apple (VoiceCommand.swift:48).RULES.mdcarries only what no check can: metadata persists but audio doesn't, one deletable home directory, the single accepted egress, the dashboard'sapplication/jsonCSRF guard, and keeping the Info.plist usage strings true as behaviour changes.Declared as
local/on-device-privacyin.claudinite-checks.json;check_the_world --listshows all three rules registered, and the sweep reports no new findings (the one blockingclaudinite-isolationhit onCLAUDE.md:4predates this branch).Fixtures live inside the pack rather than in
tests/because a consumer file outside.claudinite/may not reference into it (theclaudinite-isolationbarrier) — the first attempt at atests/bridge tripped exactly that.🤖 Generated with Claude Code
https://claude.ai/code/session_01Mi6CmRAnQgKW3XEDg2xhiL
Generated by Claude Code