on-device-privacy: convert "metadata persists, audio doesn't" to a check

[missingbulb]

The prose-to-checks-sweep run over .claudinite/local/packs (the only local pack here is on-device-privacy). One RULES.md rule that two prior sweeps (#51, #54) left as prose is now a check.

Tracker: #42

Converted

"No audio is stored at all" → on-device-privacy/no-audio-persistence (blocking)

Both prior sweeps considered this rule and declined it, reasoning that "does this new persisted field carry audio" is a judgment about a field's meaning, not a static signature. That framing is correct for classifying arbitrary new fields — but it isn't the only way to hold the rule. Instead of classifying fields, this check bans the known audio-file-writing APIs directly in mac/Sources/**.swift: AVAudioFile(forWriting:), AVAudioRecorder, ExtAudioFileCreateWithURL, AudioFileCreateWithURL. That's the same absolute-ban shape no-network-client already uses for egress — a fixed list of API tokens, not an attempt to reason about what a hypothetical future field "means."

AVAudioFile(forReading:) is deliberately excluded from the ban — loading a bundled sound asset (e.g. a custom chime) isn't persistence, and a fixture pins that specific non-finding so the check can't drift into banning it by accident.

This holds the promise for v1 (docs/DESIGN-AND-TRADEOFFS.md §6: "in v1, not stored at all"). The roadmap's v3 deliberately adds a rolling audio buffer for on-device retraining — landing that is a product decision, so it updates this check (and the mic usage strings) in the same PR, exactly as no-network-client already expects of any future egress decision.

See-it-fail

node --test .claudinite/local/packs/on-device-privacy/pack.test.mjs — 7/7 pass (3 new): fires on AVAudioFile(forWriting:) and AVAudioRecorder, stays quiet on a read-only AVAudioFile(forReading:) load, and stays quiet on the real capture path (AudioHub.swift, VoiceCommand.swift, Store.swift, LaughDetector.swift, AppLog.swift).

run-active-pack-rules.mjs, check_the_world.mjs, and check_the_work.mjs all exit 0 with the new rule registered.

Left as prose

• One deletable directory — confidently checking this would need tracking which variable a FileManager write targets back to its declaration, not just grepping a token; left as prose per the skill's guidance rather than shipping a check that can't be made confident.
• No egress at all / no server or listener — already covered by the existing no-network-client check (it bans import Network outright, which already rules out a listener too); converting either as a separate rule would just duplicate it.
• The disclosure must stay true — judgment about whether prompt text is still accurate, and "changes in the same commit as the behaviour" is a diff-shaped invariant this check style doesn't hold; no artifact to scan.

Prose trimmed

RULES.md's audio-persistence paragraph drops the mechanical claim, keeps the rationale, and points at the check plus the v3 caveat. README.md's enforcement table moves that row off "prose".

Surface

One new rule module, its pack.mjs line, its fixtures, and the trimmed prose (plus the README table). Nothing outside .claudinite/local/packs/on-device-privacy/.

Left open for review, per this task's open-pr ceiling — a new blocking check is exactly the thing that shouldn't self-merge.

---

Generated by Claude Code